{ "Event": { "published": true, "date": "2024-01-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-01-29", "timestamp": 1706572981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4f267682-7784-4c40-a777-dc84e6bd990e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b2ec20-bede-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706557282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557282, "uuid": "d96ea749-6f6e-4188-8f71-e57b44de9a8a", "comment": "Malware payload", "value": "56453f4255cf8b57ecebab1bb1c41589", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557282, "uuid": "1bc976f6-0eb8-4a3a-b971-9961a6824d98", "comment": "Malware payload", "value": "004dc00f66098d37167a52a7fc0814f497d30814dc00a8da7083a4765510d79a", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557282, "uuid": "95861035-3ca8-4a96-a53d-16ebe0033f93", "comment": "Malware payload", "value": "83b19553e9027dcc21efa10f85fa867ec14f28af", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557282, "uuid": "8fc34fad-cb24-4bc3-bc40-e740d7276b65", "comment": "Malware payload", "value": "77177502917430e2af10af120e62947b0e57df51924fa5d98e0e42c3e5abbedcc490ec956fe75a54da47912247e35fed", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706557282, "uuid": "68ddfea6-8420-4ac8-a814-7be7c2c051cd", "value": "T11DB533ED632E187844C5AA62838F5F44358C255FE2A3748DCDC20B2D9FFE498E52619F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706557282, "uuid": "7c45dbb4-2250-4dab-b71c-465c696af382", "value": "49152:RRXNYFRA4azy37q/riun5EKeeKTc6KKJ6NjK2cFnd5PfZ:RNNYFR/Oy3WFn5EKzOc6Jyc1dFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706557282, "uuid": "f4ac09f3-dc27-4f5f-9b8f-d29e45a7af6e", "value": 2271220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706557282, "uuid": "ff45b33b-1785-4447-8542-6cbaf572551a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706557282, "uuid": "aed1b080-26b0-43bb-a72a-1952bc50ec07", "value": "pullofmaster.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590ee90a-beaf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706537081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537081, "uuid": "b5304bf5-92c1-4666-b509-10e71d1b3c43", "comment": "Malware payload (Formbook)", "value": "34475a9c0884a24fda37eb6adcbac6fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537081, "uuid": "7855c6d0-7fc8-4c35-b38c-a4e14d7b0ea2", "comment": "Malware payload (Formbook)", "value": "00a8a8cf766ce7534d2a94bd8e8863dfd5b87e930bac3d3171ae58be6846a2a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537081, "uuid": "5f023d70-a9b5-4757-b8f7-cef68fc08cc0", "comment": "Malware payload (Formbook)", "value": "fc46fb5375292ec94757f5203b405c4452cc956b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537081, "uuid": "795d9dae-0cd1-4874-822c-3c7aa20b0cfa", "comment": "Malware payload (Formbook)", "value": "03e076328a59708383d3ce96c0831dbead41dab322f395303be8a47b0e7b9de237dd0e2ef5de94e68bed082de0c0335a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537081, "uuid": "1da8b42f-c267-42c8-9565-f570c541d29d", "value": "T12E727E663F181262C5EA07794DF39A2369B0A3D70CA45D4DADD4C18E3D46BC03F592EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537081, "uuid": "208a9f93-22ea-4f44-9209-61ecf5fddc2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537081, "uuid": "39ba9e69-e328-42d4-b292-c63ebde190ea", "value": "384:YQQJHp1MKIXLlDNYOknqJsNkGoGCJEF8ZpHlj:YQQrRIX1InqjEFiR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537081, "uuid": "36e816dd-fe5c-4614-99f3-9e6f58a6b481", "value": 16792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537081, "uuid": "8e64c315-7f5b-4739-b941-6ae30d9e8b51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537081, "uuid": "636fb0c3-1928-4189-b357-cb3c1ea3621a", "value": "order n\u00ba 23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def62368-be6b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706508100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508100, "uuid": "e96915e6-e4b2-45bc-a051-8cbb8aed0415", "comment": "Malware payload (Mirai)", "value": "76d30b418fce3a277b7893913f6d76f5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508100, "uuid": "4888f384-f052-4d37-b69d-99e1931fa22a", "comment": "Malware payload (Mirai)", "value": "00bede2be9b914525b5c1173636621e2c988444583266960faf0ff65442a3008", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508100, "uuid": "335d2f47-d887-4b7b-8ee8-967259bc5c6d", "comment": "Malware payload (Mirai)", "value": "730614b89a63134fc1b9a87b212cb68d41637513", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508100, "uuid": "da9c62cb-0fa3-4153-9a01-aa7d161e977c", "comment": "Malware payload (Mirai)", "value": "c73f1cd6c18a71a2b915849cc27c090aa84cd9eb954697d356b598395e3661f784a036cf5b143c9bcea4f9e2128e395f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508100, "uuid": "78ee5ae3-7ab3-4e26-9a72-e3aa7cc1c2c6", "value": "T1ABE34A17B5C184FDC4DAC1B44B9FBA36DD32F4AD0238B16B37C4AA222D5DE205B5EA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508100, "uuid": "20596206-5db3-4b8d-8869-6c5267d1b06c", "value": "3072:Ycux7mpR+XJA8hsqb6gaBAD5xwdPrC2WOrFbjWNKTxaW1:Ycux7mpR+XJbuYRgwExaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706508100, "uuid": "48d36bb7-88f9-4669-a303-f2a7a5f7a1c8", "value": 155992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706508100, "uuid": "91e9f014-77cd-47c5-8c16-95ced9525e8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508100, "uuid": "ecc30542-a81b-4f62-853c-7d7467c1f6f0", "value": "huhu.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6853d0e0-be80-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706516921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516921, "uuid": "af6e2e4b-0ebf-4196-9c00-e90053c62777", "comment": "Malware payload", "value": "c0e5b07cbf2d02c54f39ce6aad676dc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516921, "uuid": "39646d9c-358a-465b-ac04-4ef1c70e85bf", "comment": "Malware payload", "value": "0198b7c285a13c98123bbcf85d1b072bcc00f225f6d30867f4ab3be1ea927da8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516921, "uuid": "aacd8926-8a94-43e9-b31c-74c159400345", "comment": "Malware payload", "value": "4100b839d867b252ffa991f91fb9e403b8e41256", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516921, "uuid": "865feae5-9b86-4d94-8982-d4d57689af61", "comment": "Malware payload", "value": "ab1629f5d6d7940cd6c9d78c8354a32d78d6055f0e79b3906c96fb968d5c18cba3a297c39a1568d0653ce8728c3c1575", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516921, "uuid": "a4484fe2-d7b5-4f04-acde-69f9a65b0c33", "value": "T1459506137281553AC06236F948A6D2B45C367E102BE658476FF1BE0F3E39643EC3669E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516921, "uuid": "cbb0b611-da62-4fdc-941d-28e2de58ac60", "value": "d9d89a540ccdbb6ae8951f49668ccb3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516921, "uuid": "803e0e24-8064-48b3-9984-412e5797be38", "value": "24576:+tjkC9sS0W1PJY7BaSjwI1nTmtO2WC780/TaSX88:w0MSNnWXWC71TaSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706516921, "uuid": "c507f60a-9c13-4f3c-9b10-b879db1a9df6", "value": 1907200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706516921, "uuid": "6886cd62-d60d-44be-a4fd-a8c484f7eff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516921, "uuid": "b9b4cf17-f7e2-4f93-84cb-2966c5798672", "value": "SecuriteInfo.com.BScope.Trojan.Malex.3312.19349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909901a7-beaf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706537174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537174, "uuid": "ef2d8d9b-73e3-40bc-af64-8ebfe09047ec", "comment": "Malware payload (AgentTesla)", "value": "6921da9747a3d37f3e2e88c0fa32e702", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537174, "uuid": "cd369157-4078-44da-954c-915fd14a76a9", "comment": "Malware payload (AgentTesla)", "value": "01ddbf5b4b62bdb5070f06d312c6f641dc60b38933599618224d3fcad9301563", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537174, "uuid": "69308520-6cab-4e4b-8538-3fd5d15c0760", "comment": "Malware payload (AgentTesla)", "value": "72aefaa3d07d2e06b0b597945ccfba538d651cbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537174, "uuid": "fe43ebcf-f3ba-49b4-b7ab-c4f7e65a5b5a", "comment": "Malware payload (AgentTesla)", "value": "38d3304618569be510cfc55bc3bda8a57bbb7eeba66fd29a945db7c04444b4a6763968e7ba0801191e2e2681b884e693", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537174, "uuid": "8a9334aa-d601-49f6-9712-252b4677d6dd", "value": "T190E4236E9569E03ACB7B2CEF9388EC930F6F444384C647321F6AC4276E3BE184C65255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537174, "uuid": "0deea9c8-b4a6-432f-b636-01fa17c4fd5f", "value": "12288:naXcHQtUNIiaiwhCPXfCWzcXS7KHYsU/5EurVSyOE11S0:nYPip6WKHs5dJfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537174, "uuid": "a3a5ec23-4bc1-4233-8216-c0ac593155aa", "value": 661596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537174, "uuid": "264a1f09-b682-4ddf-8a99-51224233fdb4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537174, "uuid": "6548aabd-d43f-4230-9db1-b1ff8c649611", "value": "Chitanta bancara - #113243.pdf.uu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dda445b-beb4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1706539344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539344, "uuid": "e546cf29-c7ec-497a-bc7d-21c73dfd01d3", "comment": "Malware payload (AveMariaRAT)", "value": "2c6646286a2e2682229fa060c1d16374", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539344, "uuid": "37dcbc0d-e3ce-4e4f-8047-6d816d1f6f40", "comment": "Malware payload (AveMariaRAT)", "value": "01f69aee0b89173efd74b9ab64b4f6b9a2f4810ec1778983d71ed4c8ed5824b7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539344, "uuid": "50fc3191-f609-47d2-8464-89f2079da703", "comment": "Malware payload (AveMariaRAT)", "value": "4b78d96b33e9da1a3f819d04945a6e20e26ff955", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539344, "uuid": "f061fc97-83e4-4a27-96ab-dd1dfa15fa01", "comment": "Malware payload (AveMariaRAT)", "value": "2d4d6d00c11eafa10c37accbc18f67b00501f4bcb13d9e7ea1ee719931c2fc7b328e65c01260f2762c30adc1554718dd", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539344, "uuid": "6c92a3ab-3ec4-4d2b-ad83-22a1bc0106f6", "value": "T1B0E4D09C361876DFC813CA76CA542C64A761B4A7874BD383A05712EDAA0D6D3CF189F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539344, "uuid": "c7d83533-20ed-4a39-bbc6-f729822d0077", "value": "12288:+Gk0OTKGZrQQE97YCdjhrZiVdO7KOviMIgtCG2PdgHodcp7iJ2gfpZlNK2dmbVCt:6VDzCdRZ7jggtCG2Pkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706539344, "uuid": "bd61ddb9-63e5-438d-ba1b-78937cb91e91", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706539344, "uuid": "41cb2ea3-0fa2-4e7f-a824-ac973d9d5e4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539344, "uuid": "0630dbe4-e16d-46ae-86e8-b513e610254e", "value": "SecuriteInfo.com.Trojan.MSIL.Crypt.19699.11292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbff2339-beab-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706535583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535583, "uuid": "6cdeb3c4-c021-4644-9e17-7d5839598a07", "comment": "Malware payload", "value": "c3120de31c3e1df056bd4fff30111989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535583, "uuid": "e215d6b2-9ad6-434b-aa74-8b7db49cfe74", "comment": "Malware payload", "value": "02191da82bddd3dbb790bfe4bf5ce19d4c0d8bea4824f39767e2f18674edc6c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535583, "uuid": "b45655c7-4760-4b4c-bc68-e72c3945ef13", "comment": "Malware payload", "value": "0a92a59183f154f2994e38d5a244f84dca7a00c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535583, "uuid": "e559998e-266a-429e-9eac-326d6ccd72f1", "comment": "Malware payload", "value": "5c19b6afcad11206e8afcc353b0a88d9e73073d36005d15ddc5675fd348e8c024725403fa9920cb7ea23e28e01863e16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535583, "uuid": "a4b65f22-40e7-409b-958a-50f31baa6539", "value": "T152559E7357EF5602E3B8707997CC29DA91E0C91A2274B2932DDCF4AE8B8473E1E241D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535583, "uuid": "07be4340-53df-461f-8f95-b88c30675cd5", "value": "24576:V8KqTEAWYABtEzeatYW+zEbPfWB+ojbUd3HvlW08:m1TXd/PfHls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706535583, "uuid": "c87170d0-029c-46e7-90e4-57f7bc964dab", "value": 1347584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706535583, "uuid": "c4324cf7-3d11-4dd8-96dd-6f0ad6b4f8a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535583, "uuid": "5f8ccb8a-1402-4388-bde8-d392e4b96aa0", "value": "SecuriteInfo.com.Trojan.SMSSend.3942.30932.13700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400501be-beed-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706563668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706563668, "uuid": "1878bc7c-843c-4e6e-9586-8c4476c647c8", "comment": "Malware payload (RedLineStealer)", "value": "e49a1230e7e31ec54d481fc6eed81f66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706563668, "uuid": "c3da27a1-a5bc-4a80-97da-bb4d13a63560", "comment": "Malware payload (RedLineStealer)", "value": "0219acdb61c874c91016c1552944e12399e0815726515378985e23ff657b2778", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706563668, "uuid": "e4b7ad8c-32e8-4a50-8de8-dfe93a8b630a", "comment": "Malware payload (RedLineStealer)", "value": "bf6e3af6c040c3c1a09031d65649d3390524ace2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706563668, "uuid": "e791e9c5-0751-4acd-99bc-c7e058b718ed", "comment": "Malware payload (RedLineStealer)", "value": "cf6b1468e953222f6a9945f85e9d7a6d228bd4bbcb55e07b35b38169e778a7ec6987182136a03cb4fa41298315f0236c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706563668, "uuid": "74618658-d87d-4323-8111-5a85d632a409", "value": "T1EBE412117181C2B3E4B7067444EACF7899792071037E16D7BB9D277A7E612E2A33A3C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706563668, "uuid": "d53f1e5a-c4eb-46fa-a990-c440b7c5aa12", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706563668, "uuid": "91d8b9b5-a4cb-4da4-83ed-d342b7127f6c", "value": "12288:4h1Fk70Tnvjc7hSy/qI+dtWG7YtJi97n8M2P3YDdq9VroH++mNBgcv4aFx6R:Ok70Trc7hSyqImWGmJi9789YDAMHxmNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706563668, "uuid": "645d60af-a71b-4e06-aa40-38361275f75d", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706563668, "uuid": "cf9971ea-9eaf-4017-8d2c-ed15300509bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706563668, "uuid": "8d9ea61c-f943-48ce-b327-ce0b67664cfd", "value": "Investor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb42812-beab-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706535584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535584, "uuid": "59445124-222d-4a66-8c6f-1a1dd699aa8a", "comment": "Malware payload (LummaStealer)", "value": "0f3153c1eeee865da08e195cfa34a70c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535584, "uuid": "e1975002-7072-42e3-a7f7-ddf52c7dad30", "comment": "Malware payload (LummaStealer)", "value": "027c99520dacf084ad96858e3c7c46bccd59f4a978c2c879e48e319381248bc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535584, "uuid": "1789abc9-d4bc-4df9-a21e-1099ca0cc938", "comment": "Malware payload (LummaStealer)", "value": "b174be179bce2c8e6dc6941615700e6716ef9614", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535584, "uuid": "72368c22-2842-4398-b581-6f2a2fc1714d", "comment": "Malware payload (LummaStealer)", "value": "672bf13a63d4d40419f18e43be04a0338f43b1c6e04a986851fe8aac6aa05bfdb8919c616424739b64110e101425fa9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535584, "uuid": "838eaf83-87da-4688-a200-4fe339a4b981", "value": "T1C8C412D6CEC5EF40EF34343453B97DFE413B1A6AD7294E8298E4944C5B9108D7270A9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535584, "uuid": "788dbdec-76cb-4839-9036-84d2972eb057", "value": "201c5ca62dd9dd40b1235ecbe8d6686e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535584, "uuid": "41209773-51e8-4fc0-a9de-a3706cdead3f", "value": "12288:gY6pQLz/3r8y8EktSwbqNsXZgewKQFmUyedJImKvU6XkW:gY6pqU7EktVP2G23JxKvU6XD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706535584, "uuid": "69d70b84-83b5-4fdc-9580-b65efa8907f1", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706535584, "uuid": "e329e931-3eef-41b9-a927-13da0eeddc23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535584, "uuid": "71635ca9-2343-4e29-8ff8-90f028a18c64", "value": "SecuriteInfo.com.Trojan.Packed.1278.4459.9610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d090716-be85-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706519049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706519049, "uuid": "a8a169e3-9f10-4160-a759-a1d10c2fa00c", "comment": "Malware payload (AgentTesla)", "value": "3b82baf1808e24a3d629c08160c5f6b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706519049, "uuid": "c6b639f4-e47b-4c5e-a4ac-4007b6b458d2", "comment": "Malware payload (AgentTesla)", "value": "02f5fafa023bbc9d67028aabafdf3d2215998c4d353658459390eddfc6d0d25e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706519049, "uuid": "e7e188a7-48fb-48fb-996a-b06b62ce34bb", "comment": "Malware payload (AgentTesla)", "value": "bc76ca520a4f62954b974d14106137440050b534", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706519049, "uuid": "150ff119-1723-4e84-8fb5-15d5fb2f3d74", "comment": "Malware payload (AgentTesla)", "value": "c5d1f3fdeed32d54669a82698bfd3e25a50ebb7846391ee78c24e2c86a3399acf1d836d3d1dac714e6c41a52677df4a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706519049, "uuid": "96bf1211-1a62-4e1b-9bba-2d229580b2dd", "value": "T1DBE4234E0342E6AADFE8C850CC523640D6EE1BAF9CACB857DDBBA44870D2E451D8C75D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706519049, "uuid": "f7e22775-a093-40a0-b353-4dac4e13957f", "value": "12288:20v8JS2vaVU2BcqUbFDcdRPT51FJTul7+jA1SO43FV45zScaBDnqA:2ERqVDcfXnTulqme45zSBqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706519049, "uuid": "40901248-e623-47ca-a025-781020096038", "value": 683661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706519049, "uuid": "11c17b6f-6454-48ab-a9e4-3a8518facda0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706519049, "uuid": "461df4af-fbf2-4d3e-9f70-4c25b1e43d01", "value": "PO amount drawings pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff690e90-be79-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Dridex)", "timestamp": 1706514168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706514168, "uuid": "4c7991e4-547d-4047-84f4-265c648d2259", "comment": "Malware payload (Dridex)", "value": "3ea61e934c4fb7421087f10cacb14832", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706514168, "uuid": "79399863-b6f9-4984-bfd4-fc9371208a58", "comment": "Malware payload (Dridex)", "value": "034e193f88a93ebb4ac8ca8da5b3b1429600ef04e5c124457ce0bc1830bae558", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706514168, "uuid": "e166dac0-510e-42aa-bb99-5abc9d753b01", "comment": "Malware payload (Dridex)", "value": "bffb40c2520e923c7174bbc52767b3b87f7364a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706514168, "uuid": "472e69dd-8919-4c63-b1f4-ed9babb38db5", "comment": "Malware payload (Dridex)", "value": "3237b31026eab8bad24a9477531c686f9d66ad27911d51e3898af29f2333e82c513fceb223182cb92d3c4c7c9b959465", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706514168, "uuid": "81e8e781-72f8-4acb-9bee-c311f71f3be9", "value": "T141D39D80DBD3B4F1DC4B8E30A159712F8A712E14C828CFA4DFD45B63EA32B53D956A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706514168, "uuid": "bf69d004-fbe9-47f0-b3d0-f1711dbe112a", "value": "9c3d7cafdc4c7106df318bd28a1f5114", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706514168, "uuid": "626eedc3-7fe9-4e49-83b7-5d6259da1583", "value": "1536:zSyVAnFG4VYDywC8KzOkWh6q8CoMUWJ4YcH0tAPl/bUqMlb6kjMRXA9EX6I8cGnW:WTFpeilaOKb64UXFX6SsdTFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706514168, "uuid": "fa59748a-5e82-4d02-aba0-5254c4825cd7", "value": 134408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706514168, "uuid": "f5c4c303-41bb-497d-b7e0-b2cf60257a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706514168, "uuid": "b14d15f3-bc1c-45fd-a254-b71b45d7ccb2", "value": "dridex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67e064b-be67-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Glupteba)", "timestamp": 1706506395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706506395, "uuid": "f1a52181-bddf-49f7-a109-58b384c30fbf", "comment": "Malware payload (Glupteba)", "value": "990f54302eea86cc6e92a8feec45a371", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706506395, "uuid": "d3ef6c35-5c19-4794-903e-cd5c5dbc297f", "comment": "Malware payload (Glupteba)", "value": "036fc2001553cd4b3e6105febc6f6dcef40b5ba169816f4a32b48ae06f9bf930", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706506395, "uuid": "9b20063f-af56-4979-a9ee-3fbea5dd7bd7", "comment": "Malware payload (Glupteba)", "value": "47893a0407d1b4d9a5813eaf97d3b4e3ed7c71da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706506395, "uuid": "2502ba61-4b6c-4886-be8f-d587b0deb47c", "comment": "Malware payload (Glupteba)", "value": "1900199267428275be0079e143848ce93a18f615ee9c0ac2c77b641f7ddd7f1998253f35aa4473fc52ad1a1c4323c5f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706506395, "uuid": "e1e93bca-c420-4ea7-9ccc-4a376313f6c6", "value": "T19D26333175F5B131F693367094A1C3605F7B7C221631B6AF6AC42A7E4FA8AC1867831B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706506395, "uuid": "50893dd0-39e4-4012-918a-9e50abdba1cb", "value": "38455915690a9df33f4e75a4aef63d5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706506395, "uuid": "32069421-bc35-4d9f-b41d-d476bd609199", "value": "98304:JQgajPO7Mh/O8QCoerYHQJM1k2HxXUcEDezniJq7CM:JPaGMh/O6o2YP1koniJq7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706506395, "uuid": "6128be9a-3932-4b77-9795-bfe2f3d294c8", "value": 4449664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706506395, "uuid": "fbfd9410-ed8f-4f2e-8763-742073c16132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706506395, "uuid": "abac6ff4-2cdf-4924-ab03-3151b43b60f6", "value": "990f54302eea86cc6e92a8feec45a371", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3982831b-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706520278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520278, "uuid": "01fcb648-4538-4377-833c-216ee4d34ef3", "comment": "Malware payload (AgentTesla)", "value": "15b59ac7f8c0592041ac568dccffa553", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520278, "uuid": "0b35d52e-b0ae-4d65-b488-bc3cd42c6d89", "comment": "Malware payload (AgentTesla)", "value": "04709040eacfb086cb71024a846c381ba9aaaabc80580aa2a63057df7ec218f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520278, "uuid": "e59fb461-b829-470f-bc21-278d45de5282", "comment": "Malware payload (AgentTesla)", "value": "3f7bdcfd4275394ed5e7812a84e8fb8b9a942f97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520278, "uuid": "27ee243d-8dfc-4baa-b636-0ac8d9ca61f9", "comment": "Malware payload (AgentTesla)", "value": "9094f359633a702dac69458a0c6d5a98f81c32dc323864d58001d80164354feb9fab0ed9c31d2b297509071ffb280afa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520278, "uuid": "fa7a079a-28c8-40e2-95e9-45884d19bf84", "value": "T1FCF42325A75CC6AEC0ECE1BB2D5052648AF57C13341BEFC87ECA70DF183172658627A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520278, "uuid": "80402b3a-85f1-4540-b3fc-509e2dbdc426", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520278, "uuid": "12dcf80f-b382-46dc-89a9-dcfd4328e586", "value": "12288:iRmU3YVf8jXDkDVMqUmpF1ibHgQMhF+ISMBvCs9FEiRK2Vs4E3pm5R:iQJVHvp1ikyIJCsDEiR0hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520278, "uuid": "62cb5c59-a9cd-4dc5-8db1-69e0f6539303", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520278, "uuid": "4e19d034-4e7d-4a01-a7ed-12a337aae7e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520278, "uuid": "9813aacb-72a8-4bdd-a7ef-c9c263f65a9d", "value": "swift copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0d2944-bec6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706546913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706546913, "uuid": "433d7a07-eeeb-4720-a802-7684a1e64a42", "comment": "Malware payload", "value": "e23d462d0311b34d4a025a7e594e9ed7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706546913, "uuid": "e47becaf-e01a-4a00-a5e0-2614d462cf3d", "comment": "Malware payload", "value": "068f44c4be9fe6476e001c866876b9495f6ad03835807364ea7eb499037aa6a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706546913, "uuid": "eccba7d5-4cea-460a-90eb-af2cc5ca9373", "comment": "Malware payload", "value": "be59a4fc4dc769b2ebe64a80de8ca4b435ad16a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706546913, "uuid": "78e11a1f-783d-44cc-90ee-687163ae17c6", "comment": "Malware payload", "value": "39ce6130f460ba6a1dc366c03755d0897176bb1da42823f03c8a8abacf893b6e57244ebf2c902621a713be929ff4c54f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706546913, "uuid": "42435821-5b8d-4847-893b-db70692db457", "value": "T1E335239113F96FA6EA2A43FA3065414173B0AA6FBD71D73E0DC001DD4C61BB1E6A2B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706546913, "uuid": "98ba872b-e609-4d29-a268-0e9097281090", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706546913, "uuid": "bdd3dac9-43d2-443e-81e7-1b1a59d5f6d2", "value": "24576:wtF5TWrTZrtYbfcR2YfUpxrKl0XinWMCyFCd:wtFd8bYbfs2XpklwinFwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706546913, "uuid": "b82badd7-19eb-4174-9844-da4a24f37e45", "value": 1059704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706546913, "uuid": "ce15a37b-0ccb-4b01-befd-f873814d83e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706546913, "uuid": "1365c46b-fb45-4bb7-8909-0bfcfa3e6f53", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348a9d3c-be94-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706525424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525424, "uuid": "1edb2fcf-5aa8-4e0e-9e37-decf37b6d49e", "comment": "Malware payload", "value": "865f2b19ba67372ce092e8e9d64be809", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525424, "uuid": "e3d55020-143c-476f-a444-f3b46bcc0cc3", "comment": "Malware payload", "value": "06de5ca187ac6b0f0911553cf15b1177d122c1ee5dcdf17203174639e0c3d64b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525424, "uuid": "585e63b7-9c75-4479-aebd-6b1d57b6b08d", "comment": "Malware payload", "value": "5ca4c473318fedb6cf9026b22bf6c1b8451ee715", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525424, "uuid": "c593085b-a62c-4b00-9a5b-25bd7182919e", "comment": "Malware payload", "value": "ed519eaa02e5014f2aa74d29f6d98b74eda1f617837e16829ba89d57339c4fe9eae0e6330d2d7f9436aefdc8ef4ca4c6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525424, "uuid": "2eff611f-4a84-4a76-91cc-f1313fe1fb0f", "value": "T18892E5A3FD022FE5BE1F2B79A800B501C5F94506E2311110BEB5369DF03E5E89E68EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525424, "uuid": "9606c86f-29f6-4ed7-bb0a-5e1fed28d0f9", "value": "384:KNSBOQqQmqvXyr//EEGU+sTjT2e7Z+VRV2XzfFkucvOcTZk3S:e+zqa4L7ZoREjfvncF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706525424, "uuid": "b4d53779-8b31-40e7-897d-eff2a4093119", "value": 21136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706525424, "uuid": "082160e3-626b-4773-86e2-87277b583d83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525424, "uuid": "a0c42e37-ce04-4c98-9369-5d8b9ee58a3f", "value": "Invoice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89c7df0-be6b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706508089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508089, "uuid": "881b1fea-4ce1-45d8-8386-e81fb5253f97", "comment": "Malware payload (Mirai)", "value": "e98ad3c48f0887f2bd358e9657ff3df0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508089, "uuid": "e1347bd2-2a01-40ba-9e42-d07b80e03207", "comment": "Malware payload (Mirai)", "value": "077427aa2ff36cb13cfe36f20fda035b6281be39ebd32bc13b30944e5683c03e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508089, "uuid": "e3a33ef3-09cc-47e3-853f-0e2f08b72491", "comment": "Malware payload (Mirai)", "value": "975e31654e4c3867f8c27d6780189d3d85892fb3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508089, "uuid": "70088fe9-d5a0-4993-b67a-1455590012ab", "comment": "Malware payload (Mirai)", "value": "4a127f193bafbe7717e8f56968f7cdf47dc773d8004eb17c9e0aaa7729ee1f3f36769cb3cc1e3c22d918f3a05ad4faad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508089, "uuid": "e539b257-90da-4774-8e7d-e442d4a43ba9", "value": "T125A35DC0F683D4F6E84305B5617BAB339B33E079211AEA42D3B95D32AC51451DA1FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508089, "uuid": "39ac4889-8109-4dd2-8558-6c2fa8ed642e", "value": "3072:NF1EeqHJZfCoaIYjB+hyGVJ4OxiTjKYuj4:NPeTfCdjOc2Nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706508089, "uuid": "75ec1851-9010-4607-9af6-c1fcdda5b4f9", "value": 103144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706508089, "uuid": "ded08f64-ea63-4c47-99ba-fcd379d2d7a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508089, "uuid": "e4f2f58a-7067-4f6d-8406-2bacaef3ea8c", "value": "huhu.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7cf0434-be93-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706525268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525268, "uuid": "41dc12de-2235-44c4-bf63-b8fd0e363d2d", "comment": "Malware payload (AgentTesla)", "value": "3df0d75249e9dc3d1d59abfc722f4f2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525268, "uuid": "b2bebe11-716a-47da-9643-fbaee0922f3d", "comment": "Malware payload (AgentTesla)", "value": "07fad4e0b866b125b714d7badc8789e9d0f9dad7a27c9a5045ec7921c3d93d38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525268, "uuid": "e9ebf2ef-3eb4-4bf6-985c-a364284eb652", "comment": "Malware payload (AgentTesla)", "value": "afff402c620ba0339ba0bd485e5aff2a2361acd5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525268, "uuid": "59cf2680-ab0f-44a7-a9b1-2fc3b1f9a58f", "comment": "Malware payload (AgentTesla)", "value": "b4e94cf4dc195572fae7568ebeee73aa7c78e3d8f0158bc6d5de560346c79fa6d40ec03320dc65a28a99b3c9e85ff3f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525268, "uuid": "1b3db2ec-540d-46e1-9d18-362aa247734d", "value": "T181740211370CCA9CE2825BF968B6B48E901CFCB3B6D522C27B94B70F5071EAF9927515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525268, "uuid": "83e9a4e8-529f-42ee-96cb-1dc8445ee4ba", "value": "6144:YRGunvQ4YlLSmmeHZMhD6wM3XALQuEHRnvIX7nP7GW/WcyiAG+ern4NZAO:YR3vWQmmme6v3QLQuEZYCW/WliAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706525268, "uuid": "9bd00929-e168-47aa-851e-520db8ead54a", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706525268, "uuid": "b521098e-24d1-45f6-8fd3-a25cd2d00b8b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525268, "uuid": "e2e95a9b-8de7-4203-8799-581e0a5ecd2a", "value": "3051.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9dafa4-be78-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.InstallCore)", "timestamp": 1706513524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513524, "uuid": "0bede2f1-23b0-4bef-9088-0fa6af151594", "comment": "Malware payload (Adware.InstallCore)", "value": "70b3ffa7449043b8c2f5f3ce57fa1b94", "object_relation": "md5", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513524, "uuid": "d19fd6ec-86d5-492d-933f-b8013d87392d", "comment": "Malware payload (Adware.InstallCore)", "value": "09e181fe716b43afa24c7570de8c7a394c0c6314474c42298e3c263017a69491", "object_relation": "sha256", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513524, "uuid": "b895d707-dcce-481a-b978-6912ef6f1b1b", "comment": "Malware payload (Adware.InstallCore)", "value": "cc168ece55d3c8f67a1f36062da303930aad0b38", "object_relation": "sha1", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513524, "uuid": "9ee8eb8e-fb1b-4059-9d6d-256db07e84cc", "comment": "Malware payload (Adware.InstallCore)", "value": "2983eef6bcdf51767af22092cf06eb89a1d8f804bb91ebbfa7666985fe160d3dba5e9b567edecfcdfec0d354136bf06c", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513524, "uuid": "8d8191d8-5494-492b-b147-e821dfa9c588", "value": "T1DA8633A652809B71CA323AFD8D65FDDA4255AD73B13620F4262EBD4F4B7E147CC02A0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513524, "uuid": "a206682e-d8f8-4e27-bb3d-d30d77875437", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513524, "uuid": "4bcf2d82-3612-44f4-beda-48973d95374c", "value": "196608:pu9kEveGL1o4s9HlqmAsWC7MyofXOYPZ8pMUMJZOUfs:MKSeGzs9HlXWCnaqKbj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706513524, "uuid": "2a7fa63a-c87e-4bc4-bd71-22ac40fba598", "value": 8218799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706513524, "uuid": "b7727d75-4767-42f4-9eb7-3f0a9e7fe672", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513524, "uuid": "23bcecf0-b51e-4934-8758-dc56e2e12956", "value": "SecuriteInfo.com.FileRepPup.8301.19360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189a6b17-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706520223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520223, "uuid": "9a79ac43-8914-4ec2-9c76-8039e7e7f1c1", "comment": "Malware payload (Formbook)", "value": "30ce377a006b3d4afceab1294b4ebf7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520223, "uuid": "b3ef0742-d5d9-4379-a000-1e812fbadf4f", "comment": "Malware payload (Formbook)", "value": "09e67c731b687c19f2e9071c35c48114e79822459f61a9945ef06445e445bccb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520223, "uuid": "f9f853de-b0d9-4b38-9891-534ccfa46b81", "comment": "Malware payload (Formbook)", "value": "a5c532b2fed0cbfde1fabb2fa96e6e231320b0f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520223, "uuid": "1f2a4994-a8f0-4135-bd82-be6fa89579b5", "comment": "Malware payload (Formbook)", "value": "6dba8c06ab4571154817bfc571026b424ed8bac0cc999c55ec4062c5527516b724da022bd71947d445383ce9db852c97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520223, "uuid": "3853646b-bb2b-4fe3-9f09-284428806789", "value": "T1A34412798E3E8487C09CA8743AB6C45D0CC7232B3F8063D21957DABBD4B448BA3A571D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520223, "uuid": "4d638a04-6f43-452d-8721-138e872bffb2", "value": "6144:cLmbo0bzXHQp/ZHfKJrsnR9uaKQCSAP+PlpA/28P5C:4mbiArmRDKIi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520223, "uuid": "c3a5f8cb-35ec-4202-bafe-7432ae185036", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520223, "uuid": "2c7c104e-de29-4f0d-9e07-4b91ad92886a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520223, "uuid": "62370fd9-d666-47f8-a93d-bbacbcbdb5eb", "value": "09e67c731b687c19f2e9071c35c48114e79822459f61a9945ef06445e445bccb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddb7a3f-bef3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706566215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706566215, "uuid": "e88831e1-aca1-4e93-9044-9e28aa8d4a15", "comment": "Malware payload (Mirai)", "value": "639cd79d5b3b4a4c3721637e7d2b2f69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706566215, "uuid": "260dee7f-e3c3-436c-b5d2-38ff28386bae", "comment": "Malware payload (Mirai)", "value": "0b1954da9770fd2239b52266d7539f984ddd9f9a1338a082b1c900eb8ceaa68a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706566215, "uuid": "6b454780-f9be-4203-b63c-8a13ce11ff93", "comment": "Malware payload (Mirai)", "value": "910acb3f888f5c521687df9678948371c7d5de73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706566215, "uuid": "6fa31841-7aa2-430f-82ae-9342fbfb277a", "comment": "Malware payload (Mirai)", "value": "289b3ba8405a188f8ca3660d7c91a476bf88ff1918e5396c20c0bfb69eb668f368c1ee560c09edd8a80411e9650eb4e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706566215, "uuid": "2525e1e8-3b22-412f-ba52-dd465d65dedf", "value": "T17FC2E16285FACA17C8634379192C167361641C95E34DEE3D172AEADC53C84F22B7BC93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706566215, "uuid": "e8fb184f-f286-448c-b9fa-4905f6192692", "value": "384:MsQ9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5bwIB5/8x2BYFydHY0sNDZvzbSNHcS:u5+Kcrb9VDJef5Q2PdHuzb8HoEPbMmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706566215, "uuid": "cf744cc6-f4ae-41f9-9ff2-0305f02acc07", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706566215, "uuid": "29a886d4-c620-456e-8b1d-5dcc1c4f9b6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706566215, "uuid": "7f036d15-b26a-46af-ba99-4806d2b1f355", "value": "639cd79d5b3b4a4c3721637e7d2b2f69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c87ec28-be94-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706525437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525437, "uuid": "dd58465f-3002-464d-9c65-e081324c4a8a", "comment": "Malware payload (GuLoader)", "value": "bcd4f9e8ee836da77c8cc333939cc96c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525437, "uuid": "43585f9e-3b43-4063-8836-ee6a69cf3a87", "comment": "Malware payload (GuLoader)", "value": "0c969bb730cc0b3437cc87c621991b697b1e43e349fea8216ac80097196b7849", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525437, "uuid": "f4e804e9-39b6-4604-99d7-250e4299a5c3", "comment": "Malware payload (GuLoader)", "value": "ab0f7db49b64f28b5fc9b1b3eee83d2bbcdcadf3", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525437, "uuid": "e1780782-827e-4891-b386-1512c57ced89", "comment": "Malware payload (GuLoader)", "value": "5a41ef97dd72673bc43775e84f30bd0ff5e177aac7e2d541545319578498aa617b277f717474e4b46ffa770497212296", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525437, "uuid": "55cf5240-d539-4048-8f0f-184dfeea63f3", "value": "T15B92C461DD031FE6BF772BF59841B405C4388D02A3352020BEEF5699B01279D9E6B6EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525437, "uuid": "c7b836b9-4832-4a39-950e-9bf427191bcd", "value": "384:YeS2Qj0JQVoyPaFeAi/NCQLyx6TjFAVScoRhVnf5orgoZB3tA:Yeej0OVR5NGATh+SXjScWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706525437, "uuid": "55dbb743-91fe-43b4-8870-3c0304a89699", "value": 21121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706525437, "uuid": "61dfb7e0-2203-4646-9e16-0b789dccb698", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525437, "uuid": "21ab36c5-3ec1-4a0f-84e4-9c8fad6a4154", "value": "New_Order#567098743.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6759bb1b-be45-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706491579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706491579, "uuid": "d7f5a681-9382-486e-962b-6a9c19337743", "comment": "Malware payload (Formbook)", "value": "595505ef89501b00134ba4619194f092", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706491579, "uuid": "890e3416-4c39-4df8-a686-ede86dde8d1b", "comment": "Malware payload (Formbook)", "value": "0d01a9c7bf8858e1bc927a133b35114d58aa3d2a75cf61717377605def49e694", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706491579, "uuid": "6605aef0-658a-4c19-8851-6b26ecdf6214", "comment": "Malware payload (Formbook)", "value": "04da59958c2ffe78f18efdc1a457a53fc04aa7e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706491579, "uuid": "cbff1827-109e-48e9-a615-524085295124", "comment": "Malware payload (Formbook)", "value": "120f8128128653b3a3abde9529ba758a6e8f65b0f8ec2fb330c8c468e76458a16bca97e3153910f0821f5b9b21aea978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706491579, "uuid": "01208928-f0d4-4b74-8b73-8e690cde5386", "value": "T14D224A20AB86027BD5FE07BA4CA35244077692878C419B0E6ECE859E6D06FC41B86BF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706491579, "uuid": "9a89750d-4f3c-4a7e-ae66-19524495b0b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706491579, "uuid": "2b2979f0-3be6-4ccf-8b7e-d5af45efffe6", "value": "192:y00qztMeg+YSN0KSSPsqBHomIo1ezkzi05/6TAURX1:d5Mli0KMqBHomBezX0YdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706491579, "uuid": "11b7a9b9-209c-4243-9103-68cedeadc5f3", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706491579, "uuid": "32aa0d11-976b-4d43-9250-542d74ba8bda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706491579, "uuid": "af44b9a3-5b92-4556-9ada-41afc14de629", "value": "SecuriteInfo.com.Trojan.MSIL.Spy.26096.7884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eea3059-be94-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1706525414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525414, "uuid": "e801cef9-588f-47b9-8e29-0e278f6c75ca", "comment": "Malware payload (XWorm)", "value": "55af3a5fcf79204fc7c26a0f4aae0af7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525414, "uuid": "e1818186-6d5f-4c01-94f6-813f182c3a73", "comment": "Malware payload (XWorm)", "value": "0d10cd8727febf2bc775b12cc181e8316dce0be6170f8f7c27c0cfad1a81eb2e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525414, "uuid": "4c1fed27-da13-463b-b289-ac4ff9c51f1c", "comment": "Malware payload (XWorm)", "value": "61923bdeda836b6a33428c56ce1050aaaf4f3adf", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525414, "uuid": "7538730a-0b7f-4bf2-acd1-6c2fe177879d", "comment": "Malware payload (XWorm)", "value": "d2c898451a49c08065d9b09a23d327444a294653b7b5addea4f59d0e099b7f665635c1438119cb30b1806c9668d9f411", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525414, "uuid": "63a7a2b3-3440-4992-a70e-091dc226ed46", "value": "T1F892FA2035FA500DB2B3AFA11EE4FAEA4E5FFBB16A39916D104503075A53D80CEE1776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525414, "uuid": "72c29bb5-2749-4727-a8f7-5fc6ea76b7cc", "value": "384:HR9S6Fagmzoroig0rbr7grDSDv2JFrHDSzrtr+FIFWB:HRM6QgFru0rbrkrDQ2JFrHDYrtr+GsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706525414, "uuid": "d08e296b-fce5-4f7e-8eae-2452fa64cc39", "value": 21146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706525414, "uuid": "f5679ce2-4e6a-4c9a-af5c-4bbdbf68eb0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525414, "uuid": "49355dee-32c9-4995-8e0e-11e6a6f6bcb3", "value": "ref2891991222.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de3f50ed-beab-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DealPly)", "timestamp": 1706535587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535587, "uuid": "b8f62355-1837-4cb2-80ae-84363a86fabd", "comment": "Malware payload (DealPly)", "value": "98f4cb225c3c090fd4a4c5f3d83ccc31", "object_relation": "md5", "Tag": [ { "name": "dealply", "colour": "#9B20A7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535587, "uuid": "5531f158-18f5-4041-bfae-394e1795ce03", "comment": "Malware payload (DealPly)", "value": "0d5f07e55cc911c4c1a3a41387e761fcc0b160ef55db4cc39b50c4bef4979879", "object_relation": "sha256", "Tag": [ { "name": "dealply", "colour": "#9B20A7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535587, "uuid": "9e6fecdf-1113-4c94-b7b1-3e741e6133f1", "comment": "Malware payload (DealPly)", "value": "d685fcf4cd87ff756c1276679f4ca1c2747c5a44", "object_relation": "sha1", "Tag": [ { "name": "dealply", "colour": "#9B20A7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535587, "uuid": "0a9987e9-dfe9-4866-a0a1-a96f5b97fe10", "comment": "Malware payload (DealPly)", "value": "ff5ebee085e38ac6f55e0433a0181b0cc8e353b8f3e36b7cb63be0535d468f597e75100de7007b1fdf34b7e609695936", "object_relation": "sha3-384", "Tag": [ { "name": "dealply", "colour": "#9B20A7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535587, "uuid": "9bec95e0-9723-4011-a43d-59f2978cbb7a", "value": "T164253963A240F63AC1922679AD3797927E7E7E102D95E84A2EF03C4E6F351412CFD913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535587, "uuid": "991e8bb9-49c8-4071-9bf4-a0c04e8dba35", "value": "c3c0641fc10a280e2d68dc4e4ab71516", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535587, "uuid": "86bac1f8-073d-4c30-a31b-c2bfbf42bf60", "value": "24576:YtiMCCjXf0Xg9BXSaO8hQf85fq/hta6u:gxSd80po", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706535587, "uuid": "dee8d129-58d6-4c36-88a3-905d8278e67b", "value": 1017344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706535587, "uuid": "c550b23d-e908-4802-84f9-28a11733c85f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535587, "uuid": "b8d12832-bbcb-4072-8b75-98264650971b", "value": "SecuriteInfo.com.FileRepMalware.27804.23148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66620db-bed1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706551814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551814, "uuid": "e848a150-3024-4950-a991-7bc32a8b6bc1", "comment": "Malware payload (AgentTesla)", "value": "4172a55b9be4f1920018c0aa513f2998", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551814, "uuid": "e263e087-c78d-4c0c-aa31-dc7afa2bbd64", "comment": "Malware payload (AgentTesla)", "value": "0dd2c1dff009e4a75caee2529234fcc125d32327acaa268eef3b822a444b21a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551814, "uuid": "f2ed479d-12fc-481f-a083-4c932bfc47c8", "comment": "Malware payload (AgentTesla)", "value": "a76ece74f8d05c3b2dac4497a57d899f7f122da6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551814, "uuid": "ce461ea9-2874-4d11-88f3-ef2ae6c87f12", "comment": "Malware payload (AgentTesla)", "value": "6750193608f13307d0448bc81b062781f387a402d724bcb1785b30f1e8888eca2faf268de530e088cd89113a98fcbd3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551814, "uuid": "0a0de88b-e5c0-40e9-a86e-d1c482a4c069", "value": "T1C045BF12B395D076FFAB91735F5AF21042BE79298033852F12982D3979B1362127FB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551814, "uuid": "2e5bc1d5-d2e5-4a25-9cc2-7de977a5d6b6", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551814, "uuid": "ffd3e711-8950-48b5-99f2-b0252f28ab46", "value": "24576:RAHnh+eWsN3skA4RV1Hom2KXMmHa68pbDNewtkJYFeiWn5:oh+ZkldoPK8Ya9bFqJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706551814, "uuid": "4f3f568e-213f-45d6-becb-3c6df44d2db5", "value": 1207296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706551814, "uuid": "6ab37fc8-812d-475c-b86d-7142cd9a720d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551814, "uuid": "5a7f5d1c-8a86-40e9-9085-3e8edca405d8", "value": "rPO-4500628950_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3867cbc3-bec8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706547764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706547764, "uuid": "ba9f83e4-3772-4f93-9e55-93511da0b44c", "comment": "Malware payload (LummaStealer)", "value": "059660095ba38842e176cf29d8adc954", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706547764, "uuid": "6ce48cb7-15fd-41dc-8c2a-bdb754fca476", "comment": "Malware payload (LummaStealer)", "value": "0e0e02546f73e4914cd735dea83a94435e567a26d64c11b8a7fc6f0ef6fc4103", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706547764, "uuid": "a1f3223e-7217-4777-bd9b-31c653459170", "comment": "Malware payload (LummaStealer)", "value": "a330e477566fed2f46b19199853762fea089cec6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706547764, "uuid": "20674f5f-d7cf-4adb-8074-e8fb88ffcbb0", "comment": "Malware payload (LummaStealer)", "value": "37b3b3427ca467fa3f61235fd3ee32868aabfb482dfd7d3e8c212c63d1100476a7ee6d6fcd0c259fdf1fcc3e0f1fd123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706547764, "uuid": "50bfc4d4-4fc8-4262-8381-db88cfcfaad9", "value": "T15526C0237BD88E65D37F6230E5E5011983F4F8933325E34A7B9E62EC1FA27051E82695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706547764, "uuid": "4a7620a6-65d1-4838-a977-e2e416fdf70a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706547764, "uuid": "6304da79-e4b7-4a48-9f47-af055d146742", "value": "49152:zolGmH4YG9aEZv9zPpYpuPKlMVNPi0jv0eST9r30lJLEJEO1Q35cL2HqCM+Bdzvj:zolfH4Y9EypdMVNa+u0AyO1Q3uYqjMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706547764, "uuid": "257ff085-1813-425d-9309-d2bc285ea39f", "value": 4726272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706547764, "uuid": "66307573-3c0a-43c2-af37-4b9793d22ce5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706547764, "uuid": "a86fd679-6f42-41fb-9320-4e162fffdc04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40a0bde-beba-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706541932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706541932, "uuid": "444b6d32-1d4e-4ae9-9018-2a9e86143f63", "comment": "Malware payload", "value": "cb9359ac73c4bd0296ddef5916035aa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706541932, "uuid": "d77ce816-c739-4802-9378-b5e4aeb4e9a6", "comment": "Malware payload", "value": "100e57dedf001b2d34edb8d76e9a6defb5450155248a6769657525e7f97d265f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706541932, "uuid": "898c9e5f-8b49-447a-bb60-b3cb5cd91dbd", "comment": "Malware payload", "value": "4e122f72e99d32fc7d697a908ee1e35ca17099c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706541932, "uuid": "82af8f31-7882-4f6d-a9f3-7bf8b9ee7fdb", "comment": "Malware payload", "value": "0f2d553ce1222e8ab6433bfc4cd74600dd6508088bd25b852943d543107cea31b88f5a2182ddbe0d7d9c94c48044678c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706541932, "uuid": "c399f7fc-fcc3-42bf-9020-91d8205d9836", "value": "T1601633CF10FA1269CDBFD238FC6AAF10DE61152F24085662A5F156B1F130AB3E627791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706541932, "uuid": "3def3a0a-be6d-479d-9958-7c7005a31164", "value": "614cf01c58cdef511526f119ad1a15f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706541932, "uuid": "9513b3f7-925e-4bc9-9a58-3ab256a8ba3e", "value": "98304:0M+mweYZVJ7gg2ZTvQqHbk6MKMaVjWE9BDn6D9xqjyl/+jxSN7eS2xoy9h:IdXZzgZH/MKJjG/NWjxSES2O4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706541932, "uuid": "6c0cf09f-61ba-4ee9-9468-24ad32c500ad", "value": 4298752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706541932, "uuid": "83849601-1301-41dc-b9c8-235efa8f4a13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706541932, "uuid": "8cc0ed21-b106-4022-b011-23bfd1992e39", "value": "SecuriteInfo.com.Win64.PWSX-gen.12156.13433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08977cb5-befa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706569159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569159, "uuid": "28e1b1dd-ff96-4073-8e8b-c2d5b6629ea2", "comment": "Malware payload (Mirai)", "value": "7d6bc4eac106c106d3609572dc44069c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569159, "uuid": "8b337794-e34a-4e2b-85a7-04a21d7d4e54", "comment": "Malware payload (Mirai)", "value": "10375dedf3e6de256ffffb606806180dc326cedb1685bb364eee7f0aac58adb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569159, "uuid": "7952c3f6-3fd6-4a56-af79-09bd9c4ae374", "comment": "Malware payload (Mirai)", "value": "23d4a28e66f78991a9199cb846514b73795b13a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569159, "uuid": "863cfcb3-f800-4f9a-9b5c-2ed3f27b07ab", "comment": "Malware payload (Mirai)", "value": "0de614d7abb9d356411ff2680abfa0bf254080e6617ea2c08e0017569a4a62cf48182b7c99a905a2185830f7bde9c74d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569159, "uuid": "c7f80dc5-e83e-4af9-8a51-0589539fe44b", "value": "T100E32AD7F800DEFAF80AE33748530906B130BBD245825A376257797BED3A1991973E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569159, "uuid": "ed25d9c9-e62b-443b-8c92-bdbc65c43ead", "value": "3072:4s/bmCpIwwJaUrrsp7oAokRZVxjbiSLEcExmSUy08efq:NUrrS7UkRfLEyy0pfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706569159, "uuid": "b6732762-fac3-4d1d-bdd5-8af9604f1fc4", "value": 151648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706569159, "uuid": "fd75a65a-e6d5-43d1-8221-43344ab229c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569159, "uuid": "45af2d01-c0c4-468b-858b-3b9a6904dee4", "value": "7d6bc4eac106c106d3609572dc44069c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e312a646-beab-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706535595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535595, "uuid": "5c5006e3-ffa0-47cd-b0d7-59b976a9b9aa", "comment": "Malware payload", "value": "cfe2234667fe60a18bdee1eb6991b04f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535595, "uuid": "63b04cf4-d89b-4386-b580-9d807af6ca61", "comment": "Malware payload", "value": "12d8d43823d641ca3b2566e9e4c14fcf7af4616ba5a8471fe8bb55ad33b64bb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535595, "uuid": "75a2c605-78d4-4e83-aba3-e73aa7ae415c", "comment": "Malware payload", "value": "3554b9120122d626d95af3853a8aaf99184c8efa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535595, "uuid": "1d284e0f-5080-457d-b5bd-80d00558439a", "comment": "Malware payload", "value": "798ce9a2d0b8f6635eb51e657c557011ecb8801b3faf3eeb3c17980aacd07455c975a7dabbb1c5f3426d77220e841179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535595, "uuid": "b4d019ed-1e95-409c-9e30-09f82e915807", "value": "T11BC5291372D4F03AD0671B765837D7A0783BBEA02E15E84B2AB43D4C1E39A416CEA757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535595, "uuid": "d2ad3b95-c24f-4795-81c6-0d90ebb7f882", "value": "246ede19630a8a0b21ff7dc3d2d73136", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535595, "uuid": "3dc6d019-9822-4a90-87a2-cb11e288d33a", "value": "49152:swZoJSJt6VW26MTfecApdbmlm7/T6bww:XOVicA/bB75w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706535595, "uuid": "a307fe64-7d48-4c0d-a291-b9185d281306", "value": 2502144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706535595, "uuid": "541cc093-9840-44f4-927f-ed447fb81009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535595, "uuid": "f8659135-73a4-45b6-8140-d5badac4e345", "value": "SecuriteInfo.com.Variant.Jaik.179214.18407.28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656a46ba-beb0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706537532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537532, "uuid": "5b59a1d5-d7c8-4f26-afbd-16681a63ab00", "comment": "Malware payload (GuLoader)", "value": "5a01c0e8894ec157a0371a4a17d99c9c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537532, "uuid": "933c524b-8a54-4413-938a-641052d6fd47", "comment": "Malware payload (GuLoader)", "value": "14fb5f42256b8923ffb4753a9edaa3eb7fbaeb0223d6ad8285677956786e420c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537532, "uuid": "998cb764-8d25-4b30-b868-77b02e37e415", "comment": "Malware payload (GuLoader)", "value": "80cd37f584625dc193e1cfc19f0b21cd9dc9941b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537532, "uuid": "8b81c0bf-21f4-48d5-97ba-b8b51b4a8b97", "comment": "Malware payload (GuLoader)", "value": "1900161ddd7394d3b3436bb9000a5f0135488399090449671bd24d742d0216d3e710eef272bc3deea9dd80d265607a9d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537532, "uuid": "cfe2444d-5967-418a-9257-7109b1a22d15", "value": "T105B2F16D8651836355DA47C1948B427B3D688FE9EF57289F3B838BCDA748F048E00E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537532, "uuid": "04527629-f4fe-4b72-bcf1-9735ef91eabd", "value": "384:N4VjDBHEYJcdpIhLs1GLlf0jwyjJqT+B2CJ5NlKspKTsdq+cOQcJTKUpubrTCvOq:NsDuYJcEF6GLkwy9q67lKsYsdq+clcJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537532, "uuid": "8c013600-a01f-4c92-bc86-507e7596a718", "value": 24083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537532, "uuid": "e1b5db15-0c02-444a-a8b0-c09af4a1f56a", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537532, "uuid": "3657239c-6282-489e-8cc1-28a4fa9979e7", "value": "CERERE OFERTA BAT3774673747747637376636 29012024.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f6435e-be4d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706494923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494923, "uuid": "33c920ce-bad9-45c6-98d9-4e8304d83ad7", "comment": "Malware payload", "value": "6ca9e3086cab8ff469b71811729b848f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494923, "uuid": "cccf5508-8b5f-4abc-b8c9-d578aff7c740", "comment": "Malware payload", "value": "1547fcc1aa86746dd85ff3de1d95e2169d411e0a03a20188701de992e8224dc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494923, "uuid": "1ca5ad06-08cd-4f81-b5d6-ae2ff2dac980", "comment": "Malware payload", "value": "112e64dbdc0543fd8b50ce5687765ec79dedc7b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494923, "uuid": "2e23b59e-728c-4617-8e70-11e6698d64df", "comment": "Malware payload", "value": "60bd98abaa30be694c9181536b6129c584a5d39b74fb226d6479f609b14dd4faae70a3e3bcc9f3ed7371fed30e7bc595", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494923, "uuid": "1a6fc6af-7f85-4d47-ae76-bbecbd12e2f5", "value": "T134144A1178A8C1DAFE3D8732BCDA56E61D28BD7A5E50801B75E1BBDF0472342C923D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494923, "uuid": "493b77d7-172e-4e00-9ad9-daf2c27fb70b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494923, "uuid": "b9e97173-50b7-43f9-8e16-7c49a364c05b", "value": "1536:Hu4xtpuhgDc+skyGz2V7G9b38VRO+3nt22jNVxWXU+5i9XqTPA:O4xruhgDc+skyA9YVjZVxh+E9ePA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706494923, "uuid": "b975db4c-47b0-42e1-8d67-c24c8d552cee", "value": 197432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706494923, "uuid": "1fc77edf-cc72-40c1-8269-75eb1f5158c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494923, "uuid": "1e248882-8862-4bbd-b7d1-d198ef5c9525", "value": "SecuriteInfo.com.Trojan.GenericKD.71283814.24052.657", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83226c44-be78-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.InstallCore)", "timestamp": 1706513530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513530, "uuid": "2af1f57a-29d6-4796-bd4d-dd8c2f4acb68", "comment": "Malware payload (Adware.InstallCore)", "value": "be1a8f2cd19bf83c8a03c68c06b60588", "object_relation": "md5", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513530, "uuid": "e9afc657-8c5b-4376-b2a9-94752a702980", "comment": "Malware payload (Adware.InstallCore)", "value": "15b7c77320ca30a690e5257b2b15e73a5d2c052bb8589fd236ff7a3626926f51", "object_relation": "sha256", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513530, "uuid": "069643bc-6555-43b3-8102-f5d86f51354f", "comment": "Malware payload (Adware.InstallCore)", "value": "a932e2688f2b180240e2ae65fdd278771f43a2f3", "object_relation": "sha1", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513530, "uuid": "4c08a53a-9a7f-4282-8051-fe5446d9015f", "comment": "Malware payload (Adware.InstallCore)", "value": "8647947f42c00882cce0aee9e5d6ef19d89967df68e4ffb97c2ca970cf04ac404a217455a0bbd75f57e268b60541ab46", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513530, "uuid": "9f0b1a32-b7b6-4ba1-b58b-83f6404fbae2", "value": "T16146336074D4B174F41186B458DEAE114D0B3976BD3834AFBB86D72EDE3A1831A336E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513530, "uuid": "846acf75-ec16-4952-a473-79f7df02cc23", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513530, "uuid": "151966ba-15ca-4f46-ae6f-af8d9573e6b0", "value": "98304:X5lvtX+mlUpekYavoY/dN6DHoQxmexqphD5jxU29LgU9/gtfgX3:fvkmKphv/dN6zko0DvUwgZgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706513530, "uuid": "ca839d36-debc-4acb-9793-015bc097b937", "value": 5574066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706513530, "uuid": "c063fdcb-7757-4f5e-a760-00d8edf7fc37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513530, "uuid": "41fd1dbf-0dd0-4ccc-b560-d45b705578e1", "value": "SecuriteInfo.com.Trojan.DownLoader22.38217.32663.22130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aeab9bf-bed0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706551338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551338, "uuid": "a5d4b0c5-c7c2-4214-842a-662105c76c27", "comment": "Malware payload", "value": "d83dd17a84ae519e4f90175b6d88ca2f", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551338, "uuid": "fd02b053-94b6-46b3-8bab-21b600ec763d", "comment": "Malware payload", "value": "16288a89615deaeabce20ef3166edd04c40edbedb6cdd6ee1798031766876d65", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551338, "uuid": "58a36688-98a0-4b62-92d2-9096fb73bbea", "comment": "Malware payload", "value": "1230bc2ddc9d0a1e94dbfbcafd1e8bb558e10fc0", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551338, "uuid": "e44c0a91-b9b0-4d8b-8c05-b88e577283db", "comment": "Malware payload", "value": "b47bb94a2bac109f5aa96bc5ed1a9fab9e4e36040c2657056e21b45b9b3d52c861d463c52a758337842135890d3dd6c3", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551338, "uuid": "cc00350d-d7bb-4468-a55a-5739f867abdd", "value": "T18D050144A2EF830BD5704BB2559051406B33B31A20E3D3E93D8CA1CDDBABB975D98F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551338, "uuid": "ca01dbeb-eb99-4b57-82fe-eccaf443ef27", "value": "12288:yooIFFHgeg/ccMVxfaSLk7C9G5VSNc2FBPZ+T56BshZgrBMYPNCjlr9GW:jXFxDxfFDU5wPBhyg7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706551338, "uuid": "590002eb-3883-4842-ae90-fc3a46fd0654", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706551338, "uuid": "ffcacf56-0fd4-4557-a5f9-f03ec33cd2b9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551338, "uuid": "bf7f0147-8eb9-49f4-ae0a-c2a1610227ab", "value": "nNostro ordine .img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32dda020-be99-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706527568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527568, "uuid": "68215a55-4f69-4bf8-ba22-09248be42126", "comment": "Malware payload (AgentTesla)", "value": "19161547cb1c2d2a21f69d62892b9411", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527568, "uuid": "28942b07-d81d-4f55-bc3e-544984c4917b", "comment": "Malware payload (AgentTesla)", "value": "166b56c5680d1a1d6af658167147ca5d44d1cd2df5772cae26d3d6051f8dbca7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527568, "uuid": "9f2816ef-a87b-473d-945a-081544c076dc", "comment": "Malware payload (AgentTesla)", "value": "9999dcc93dab8e3373646b68536664ae7096bd4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527568, "uuid": "3e3a3420-f592-40be-a238-aa183036eb8a", "comment": "Malware payload (AgentTesla)", "value": "20c1bdf734e6e2753c0bc1d03bf8ef5532a16d030ad4c5abe706089dd40f11e32cb62a7fc8b5c13181e06c8c274d5826", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527568, "uuid": "20be3c0d-20cf-45d8-9981-89283e344fc0", "value": "T183E4234A9F23E9ECEF8BBF17DD1702C986D938568427C05FEB3A568432F359B1619840", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527568, "uuid": "2f7ceae3-f0cf-4c4b-8bb4-00ff1bea0c46", "value": "12288:ExnWUjSJeLg7XmKNBXwjTfaCoH6iSoJSAXw23AQE2PxinXYZ+ZzQUu6osD0ZmQ/h:eC0OVNBuTfaC4eAXPA3nI8zFu6oxYQgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706527568, "uuid": "698f8002-1485-4794-bc51-8afbf3b4a6e0", "value": 716990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706527568, "uuid": "7885f07e-b323-45fa-bd7b-0b386545071e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527568, "uuid": "7c760eb0-5e39-4e61-989f-04c050d6fdb8", "value": "Sy-Nel Order.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b33dd54-be85-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706519127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706519127, "uuid": "c5763ebb-c206-4c20-a2f4-3be9b0157049", "comment": "Malware payload (GuLoader)", "value": "e48bc8768075f9bfd2b7782e0ef22a82", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706519127, "uuid": "637fc22c-336b-42a4-a126-5c4fd872d7b9", "comment": "Malware payload (GuLoader)", "value": "1672fa12f2ac4602f4bc5facae41cde1fb97440538fa375568721ee601bb271e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706519127, "uuid": "dfd0124e-d8a4-43ed-a492-0c398d606be7", "comment": "Malware payload (GuLoader)", "value": "ef8769e22f29cb56355b09d56e27ac67f6d400c3", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706519127, "uuid": "de918371-4603-4686-aaa2-0d32e339ba92", "comment": "Malware payload (GuLoader)", "value": "4e972ce4ffdceb917d6912f0156f2bd0710287fe994d3df2f996cc95b74edabb90cc1270f66a05002e44dce0c654e09f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706519127, "uuid": "eaa2cfe4-1845-4425-b77a-661c2de77be0", "value": "T1D832BF0CF9995C8429EF61810E812C7C4F7ED7E9B05822028B19D556C93DFDBAE86F54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706519127, "uuid": "84839f69-e021-47f6-b004-f3a1339cdc0f", "value": "192:Fi1Vohv3wLJ9BNWVo5EQJiVAKqTvLf1g+GzJK7ghB4c9ynkBLO1BP0n:A1cALVNWVo5LXvLC+F7gTiks1B8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706519127, "uuid": "3d634014-91b8-48d4-a7c7-32ecb3387bde", "value": 11028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706519127, "uuid": "11826bc1-33a3-4c79-81a8-a82926e27031", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706519127, "uuid": "aa6aac8c-af52-4592-ab78-1fbc632c0f23", "value": "New_Order#567098743.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96013a14-beaf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706537184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537184, "uuid": "f2a30d3f-863f-485e-9f0d-b0de19ca8257", "comment": "Malware payload (AgentTesla)", "value": "324ca945731684e473f9ba237eb7bcd9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537184, "uuid": "85803ccd-0a58-48de-8b42-dfb4280b7445", "comment": "Malware payload (AgentTesla)", "value": "173f352caf429971b671dd49c04aaf7d61c6d04fe11e9ef6e7976f395a9b844b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537184, "uuid": "45be71c1-28cb-4405-b1a0-990f57318aec", "comment": "Malware payload (AgentTesla)", "value": "be6ca9092fecbe0e8c67e33d6c3bd60fbc1a194e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537184, "uuid": "861af0c4-a6bc-44da-849b-c47ee114b096", "comment": "Malware payload (AgentTesla)", "value": "879fa8f0269b299b0fdc56ee18e290b30d2328011c73a5cacfefa412edcc72899109a18a6dbd50b622a0c7c2446d8182", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537184, "uuid": "5cb27867-41ac-4770-be26-90438707c859", "value": "T1D7658D13B7899061FEAA8A73D70BB267063B2D754123801F63D43E7979B4873163E627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537184, "uuid": "71f26e1a-94c2-4da3-947f-39866b7eb431", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537184, "uuid": "15a5b957-9961-4412-9ce3-e1c8a710fd26", "value": "24576:PAHnh+eWsN3skA4RV1Hom2KXMmHaKtbC6z6yk9muz3c5MwhuRJ5:yh+ZkldoPK8YaKtbC6z6l9mubOMKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537184, "uuid": "1e06351e-fe9e-4ce2-aef6-44204e5e2225", "value": 1467904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537184, "uuid": "acd1409d-90ac-4ef7-8e65-6c0b42fc0f2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537184, "uuid": "faeda199-9847-4e8b-8759-21b0c88df703", "value": "Chitan\u021b\u0103 bancar\u0103 - #113243.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533e66c0-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706536213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536213, "uuid": "a36c5b16-4f13-4b1c-a1c4-4dafe66f575d", "comment": "Malware payload (Formbook)", "value": "f48c5ba86d6e4730e865778f3bacf464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536213, "uuid": "d1737c18-9571-4da6-ba64-625de7e9eb05", "comment": "Malware payload (Formbook)", "value": "18d9d56dd256b083be9ca5ac93f347f2ebf3b94da8836aea62aca87cf3e98c37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536213, "uuid": "e632cf05-b9b2-4969-93e6-5893d669550a", "comment": "Malware payload (Formbook)", "value": "dc15a3211dd2b72f02fc1d2dcbd989be87676faf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536213, "uuid": "c5e2814b-164e-46f4-bf31-b621abbe1ac6", "comment": "Malware payload (Formbook)", "value": "434539679be86be8df02e35c6ce4108fbe72957512c97e9eb60cd1e25594f03683944b2047fb76239d7901db300de4f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536213, "uuid": "4ad52858-5e4a-4f63-8a5f-f886f206a92c", "value": "T17DF4121A22BC6B16C0779BFD60B462454FF4F0126442EB9C6ED474EE6AF2BD08F5058B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536213, "uuid": "6c411b99-aa50-4dba-99ed-4b8d94836248", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536213, "uuid": "073e64cf-600e-4d03-bed5-25d242e6a2dc", "value": "12288:Xa15MIoIFFHgeg/cRA4Pd5MHuMHlh7aURI+sCvPESd0Puo1I8MMvVF/+QhrZLm5M:LIXFxRTeHuqjRI+sCvPh6Pw8fdoQW523", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536213, "uuid": "ff422549-ad17-412a-bfe8-7a09be5935bc", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536213, "uuid": "0fe05dcf-088d-48e1-85f4-69836ff83caf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536213, "uuid": "bc3afa03-41fd-42a1-8421-f47c1be19f96", "value": "order 23.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cdc3b5a-bec3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706545624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706545624, "uuid": "32daa900-04ec-4a6b-b51e-a380a3b662ef", "comment": "Malware payload", "value": "7d401cf63d2d3b7faf241597aa304da6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706545624, "uuid": "078f6f86-9838-4368-aa87-a33fda2a635f", "comment": "Malware payload", "value": "19aceb2fba23c1cdd7451020026c37be2790f50c7ebd7d6ac8a1c536c0866683", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706545624, "uuid": "13986a82-15c0-493c-9871-a309a5e7a745", "comment": "Malware payload", "value": "59796bff9a3d4840260d2c1c8db20ec95d35d840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706545624, "uuid": "42035b94-e710-4084-bf68-57d9c8126483", "comment": "Malware payload", "value": "d85254bb8eadca9a66240b6f6319ddd73ecd3f0604486e166de1ad75f1df72c9b8eb7a44c80151d655082016c5b3f6ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706545624, "uuid": "9557fe6f-f0f5-4d52-88ef-901364a17617", "value": "T10F469C243CFB505DA173FF966FECB9EADD9EF6622509646B104103078B12E80EE5293D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706545624, "uuid": "5866b6ab-208f-4840-96d5-d722018899cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706545624, "uuid": "ddc19266-2af2-44d6-b0a8-c7cae5919218", "value": "49152:+vxwik2jqiC8Mv4ESW9VRRLHH5qzK2eJM/pZPfd4uq8vxGlHUvIBWYZUtcMfJqH9:cxw8Lst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706545624, "uuid": "4fa6f307-30c4-4793-8f23-31e46080fdfa", "value": 5396872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706545624, "uuid": "c4d0bc80-286d-47ab-bbb4-fbbf21f919fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706545624, "uuid": "d20653e9-ba9c-4a56-ad47-589432107ba2", "value": "SecuriteInfo.com.Variant.Zusy.534733.10706.2650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040c2c32-be89-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1706520618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520618, "uuid": "37b38fb6-4387-457a-8cc2-fd714bde0336", "comment": "Malware payload (AZORult)", "value": "e4954852a9da83a21a6b0d13c49821c0", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520618, "uuid": "5ad7e499-36e2-4825-bd51-9f6873b22a1f", "comment": "Malware payload (AZORult)", "value": "1a05ef7aeb289c3e0b3fc55b720fb82f13777a9c9ff0bffeef57c1f684c34aaa", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520618, "uuid": "c6374ef1-1655-428c-86bf-3dc084f1a406", "comment": "Malware payload (AZORult)", "value": "714f3d91bc40f9709b6d1353a8e40d48c1d20453", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520618, "uuid": "c88893bd-3b79-4b55-bef1-b01ac23659d7", "comment": "Malware payload (AZORult)", "value": "2397dcee024007dd6556218dc915b3ee64618ae652919290b8d555f0dc6318c953d23125f0a9367d692cb2bc05128bb8", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520618, "uuid": "56f40563-fc56-4b09-9315-65ec38b35690", "value": "T1CAD47B31B79BAC96C4190CF2515E03EF04D0E7AF165497C3E391ADAB7F2A581862B8D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520618, "uuid": "32f0b5d2-837b-4ef1-a0eb-66beea955b06", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520618, "uuid": "655a1790-249d-41a3-b344-4db0a9b68e65", "value": "12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLLZn+t:AQy6ONsqLLZzbxzTrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520618, "uuid": "81116030-7af7-440b-b17e-36c5f6be4d64", "value": 624260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520618, "uuid": "796df298-5df3-4af9-87b3-934758e65495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520618, "uuid": "99c39656-3aa1-445b-a384-ea9384e8fe44", "value": "Doc-290001800234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ba8928-be9a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706528142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528142, "uuid": "a64fd90c-9e86-491e-a6bd-048eb7df564f", "comment": "Malware payload", "value": "747228fc9554f7edfe08accec74718e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528142, "uuid": "abfaea0c-3175-415c-a39b-6966964c4758", "comment": "Malware payload", "value": "1ca17c33839a624e3198a959454b9030c93d6db8c6a0a8d1b331465bdab4c6b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528142, "uuid": "fd4a29fd-322b-4aa1-b391-ce9cfe454b0e", "comment": "Malware payload", "value": "86d67ff41acaa9b14b29f0100c8416130694e023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528142, "uuid": "63c6d560-c791-41ac-91da-be16f1a215e5", "comment": "Malware payload", "value": "ec2e06bae9f0bd6312421f9f34d9f205b4ff3d1f11e89ea1b74658f1bad90d13f755de3f0d1efa96e87791a9d8c6990b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528142, "uuid": "196ce12d-b73e-4198-a1da-3ee5b1def311", "value": "T151852326B2A1AB06CC99A7B420B214D44372B7815E55DE2EFCDD93DF0F113898E46B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528142, "uuid": "e2f11438-98c8-441f-a774-a886fcc60172", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528142, "uuid": "d736f483-2d66-4d96-a794-4e667630111b", "value": "49152:76IkBpaqBHhNgP/lUe9v8LmAtKr7KvcZwLFnCt52:KzaqBBNqXv8LmCKr7ocstC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706528142, "uuid": "3f5b1ed8-640f-4cb9-9541-d9639fa9e199", "value": 1871872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706528142, "uuid": "6709d0b7-c4ba-426b-95f2-ed68d3fdeedc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528142, "uuid": "c26f9b61-4085-4bc2-b956-f261332f56d7", "value": "SecuriteInfo.com.Win32.DropperX-gen.12109.15104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fc7989-be92-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1706524750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706524750, "uuid": "18748308-1446-4711-8f52-4b3b3cd1aeaf", "comment": "Malware payload (CoinMiner)", "value": "bf0106f2a7756ab75de4993ad4db40cd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706524750, "uuid": "5357a639-3594-4f89-9288-f8923e1a0ce9", "comment": "Malware payload (CoinMiner)", "value": "1dac794ec27a60b9fd57d2b31c4e8f76c50b21d2bc550bdf96bbee76337696f6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706524750, "uuid": "b2a861b9-0547-41e7-9398-28ebc6b2ce54", "comment": "Malware payload (CoinMiner)", "value": "b540616edf6d836d094838baac7b5f4607b94ced", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706524750, "uuid": "c2dd306f-c132-489b-83a9-4cb6a6e5711e", "comment": "Malware payload (CoinMiner)", "value": "e58f75287bf5e7ffbc633274d678445387dedba559894e51711f23cb691ac3a9055758fa338589c5344797aa192cbb8d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706524750, "uuid": "2debf1d3-736d-487f-bf52-d33cddb1e0d2", "value": "T16EC533227BCAC875E59616350D117B7289F8F438072ECEC3EA1C1A061DB86D12D7D9EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706524750, "uuid": "bd429972-0887-4f22-968b-bd49bcb35360", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706524750, "uuid": "04d80c8d-a339-441e-a412-ba0322aa81f8", "value": "49152:LU54E0kNb1P7MTl/yqUbV3wfR2GM2QLFLgCugZrygQm62CxExUm+TxX:LU54E0kB1PGlKbmxMvLFLyg1ygQoU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706524750, "uuid": "f6a6990d-d14e-4729-9063-6abb8521276a", "value": 2659136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706524750, "uuid": "275777e4-ecfc-4914-a097-af5513fab825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706524750, "uuid": "0f16dc11-66b5-42db-a133-4b5cd3af92e6", "value": "bf0106f2a7756ab75de4993ad4db40cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4682d7-bed3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706552527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552527, "uuid": "76f6fdd4-7093-4390-81b4-d4f7c6a6d022", "comment": "Malware payload (RemcosRAT)", "value": "bd4cea782203e3d56e06e6dec20986ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552527, "uuid": "eafbbb9e-fdc4-45f0-aac3-9b3e1822cc28", "comment": "Malware payload (RemcosRAT)", "value": "1f4cbcb4d0867fce3b7d959d4747051a5c4c6f8545e6ed5e318f7821afed61af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552527, "uuid": "208db190-e655-47a9-a5f5-0b0b7d1fad95", "comment": "Malware payload (RemcosRAT)", "value": "6ae2d53ac61c2b21d0bb4bcbdb84a3082c7385b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552527, "uuid": "6b1d918d-4c2d-4d57-838d-1b5b08482550", "comment": "Malware payload (RemcosRAT)", "value": "13bf1842780a3010c47701e22816bdb2ee3d56bec3d5357599b959a0fcbecb8601c3dc3fdf182d3ec112258e6f52ef0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552527, "uuid": "db4835ef-d849-4b90-95a3-56d4ca9dbba0", "value": "T1E6B49E01BAD1C072D57524300D3AF776EAB8BD2028364A7B73D61D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552527, "uuid": "e00af118-b221-4328-8fe8-fb00561f2f2e", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552527, "uuid": "292034c3-e255-447a-9652-1279d7623435", "value": "6144:8XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNZ5Gv:8X7tPMK8ctGe4Dzl4h2QnuPs/ZsQcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706552527, "uuid": "be799d73-e26f-4d42-8df0-d46177f3d40f", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706552527, "uuid": "81447d2c-002f-43fa-aa6c-43f709592472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552527, "uuid": "e12aa1dc-c68e-4224-8356-e907fec1c780", "value": "Exploit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d0dcf6-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1706520225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520225, "uuid": "9603adb1-8dc8-4da7-88fa-0cc8a429c351", "comment": "Malware payload (DarkCloud)", "value": "8e2e1fe21a90c9f87436aa013145b8ad", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520225, "uuid": "79f7f1dc-ca3f-4e7f-a194-07aa782fc2ee", "comment": "Malware payload (DarkCloud)", "value": "207f0df1c81520fd3f430cfb4a6893e27996d8645602f9056e9ff55952a4957d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520225, "uuid": "4af05e7f-df75-4709-af27-4b7ad0188383", "comment": "Malware payload (DarkCloud)", "value": "354df3e0cd3717761f8792fb4e9fd6527b64e933", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520225, "uuid": "bd45a62c-418a-45af-88a1-399bfc354b96", "comment": "Malware payload (DarkCloud)", "value": "31146179e5dbd7f378b50d4ea516a412e111646a9268e56c49ca36e82012976a4393f8164f1a97b26aec95e0651300e0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520225, "uuid": "128f68d3-7374-438a-9945-414653918b9c", "value": "T11C944B3BE711252EF093C570AAE5925B68152D7A2288AC6BFB815F0931711D3F8F871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520225, "uuid": "5715954b-038d-4542-a252-e8d030ad3309", "value": "226f58b327f4cdcc7811c48d59aec0b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520225, "uuid": "bfcfdc25-8290-4d13-96ef-5db1cb49f3fe", "value": "12288:dZsVxH05ZKUdcXUN71oyZZYo1+jYKkJj6GmZU:dZ6Hqt1oSZYoyYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520225, "uuid": "b65ada59-81f0-44b8-8341-358c9a072e28", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520225, "uuid": "23861057-966d-4497-a338-1a1a7fe7c619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520225, "uuid": "a1eb1d0c-0c2c-4a18-8d16-0f771c535e80", "value": "207f0df1c81520fd3f430cfb4a6893e27996d8645602f9056e9ff55952a4957d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dddff9d9-bef5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706567369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567369, "uuid": "c1ecef23-d303-4360-b0b9-f5a22e15fa33", "comment": "Malware payload (Mirai)", "value": "802b8553329e021ead203085253ec84c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567369, "uuid": "71e2f336-ad6d-48a0-a6c5-76e68da4f81b", "comment": "Malware payload (Mirai)", "value": "20e3a4e8766cb76684494abb4ca2085d124e418b1814b329a3d7092feab92faa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567369, "uuid": "2341a639-1b9c-453b-9bc4-a9c3314aec49", "comment": "Malware payload (Mirai)", "value": "4603b79f0b6d74a588c616886f6e5d3379cbf1e2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567369, "uuid": "4f7aea9a-bfeb-428f-9c99-60b10f7d67f3", "comment": "Malware payload (Mirai)", "value": "5f8ce4d269bbf7e7f2a3c44b1380125a505840daf21f1315cdd6e6f7127a0c4880cddcf2a18be0e5dfecdf0e66c704f1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567369, "uuid": "6b114e6e-c93f-4fb1-ab7b-a25746e7bcb6", "value": "T1E6042A46EA414B13C4D227B9FADF42453333A79497EB73069528AFB43F8279E4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567369, "uuid": "f43f431a-3f90-4bd2-9b52-c4d24c0abd6a", "value": "3072:3LFRsYjgcfXBRi3IamogXwfOoFYsMeB6hL3XzcosM/RHfNRsiI:3LFRNbfXXiIaBgXwfOKxBQL3DhsM/RF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706567369, "uuid": "8bef3c9c-6007-4afa-afab-c301ddc3aa3b", "value": 181498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706567369, "uuid": "2228538c-02a0-4a44-979d-8cbcc313cdb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567369, "uuid": "784434df-4e14-422c-9fdc-8bce8de19f25", "value": "most-arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7277aee-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706536407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536407, "uuid": "be01675c-7336-4e31-ac53-7f3e36a83c0c", "comment": "Malware payload (AgentTesla)", "value": "6c186cca38176db364cc378abf2d9c76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536407, "uuid": "4eccd9ee-9116-4b2c-9798-b01151dce782", "comment": "Malware payload (AgentTesla)", "value": "20e505e45d023aa2aaa74d1afb765b33a21e6b09de26a54760cee2c4f5ce1453", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536407, "uuid": "e7d0eac1-6513-41ff-870c-f01b3c4db2b9", "comment": "Malware payload (AgentTesla)", "value": "bf5473ab706ef061aef6d9a44d086f2205f835f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536407, "uuid": "ac383caa-2d21-4499-b71e-9b0099689d8f", "comment": "Malware payload (AgentTesla)", "value": "ed92fe39e76f99acda1cc19e2d29bf627d68d4f3fca514916e727b8240d1041ce0deb80020808a1188f4f08119874e3d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536407, "uuid": "bc32f85a-719c-4549-8ac0-47f7402924af", "value": "T156155DD1F19088DAE96B46F27D2BA43024A77E5D54A4810C5A9DBB1B76F3342309FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536407, "uuid": "948a1de0-abf5-4651-8780-e05edf9d4b24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536407, "uuid": "860a94eb-e6b5-4a7f-82fe-fdc43baaa771", "value": "12288:tVzo+arzkzEzOZ9BSO3jEpPrV4fL/CLCA72REQBacwLOplitiyEGuH:v2cwE9sOcVS+PwEQ4HLOzCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536407, "uuid": "f716ab92-62f7-4f0c-a2e4-d119f122d955", "value": 953344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536407, "uuid": "bbac2f54-7165-4f5c-a492-0f20ea2644d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536407, "uuid": "65da9af7-3587-42b5-b85e-0d09af817048", "value": "94030340118_060024604.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29787fe8-bea2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706531418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706531418, "uuid": "baf572fc-fa97-4a85-8cde-da74da0c7ee6", "comment": "Malware payload (DCRat)", "value": "1c7953a8c655a0757f074cc8b8315c3f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706531418, "uuid": "efb0ef97-0d8e-4d51-97fb-5ca2f247cad8", "comment": "Malware payload (DCRat)", "value": "21aed8462506d9f38c45cea33783a3d532f73c97a1ee1b4f35470d3cf4db699a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706531418, "uuid": "0368f967-4f21-4e67-8487-fc08be69b119", "comment": "Malware payload (DCRat)", "value": "189535d89e78e82d402f35312046823746193958", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706531418, "uuid": "bd58cf69-a50a-46bc-8470-4c0af6d5c50a", "comment": "Malware payload (DCRat)", "value": "5828eeb44c0e1919af3c487037ea15268dbcd22a9b2d9579526aa96bb9caefaee68febf667c4c0f5e039ef0b6b5be0f7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706531418, "uuid": "f88bd0d0-95b6-430c-9a64-2cddad569a8f", "value": "T125863325BE626E64C2B90FF0A2C7CBB81DD2CD050212351B7AD47F1FF9725727A94268", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706531418, "uuid": "316cd363-8eb1-4d03-b665-6856724c4ec6", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706531418, "uuid": "5be7a454-ef68-4171-9cde-847539808949", "value": "98304:Nna2rK09B9htrGcnZDLy5k5kPGoEV83/w5AA6nSkrSFS0maJCz0J6Fz:NnoM3jrJNKuoEV83/w5H6n2FzdIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706531418, "uuid": "c3489104-92e1-4a89-b724-b91a7fa3082f", "value": 8040448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706531418, "uuid": "755b7f09-9ae5-4971-a32a-b88f54652af6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706531418, "uuid": "9e734a85-80d5-4e49-9ef7-710e16bebc44", "value": "1C7953A8C655A0757F074CC8B8315C3F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad4a01e-beaf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706537111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537111, "uuid": "966c61e8-53b3-4c9f-97f7-0dfca29f6330", "comment": "Malware payload (AgentTesla)", "value": "95b155ae6087b1a1a6b6f680c029e447", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537111, "uuid": "b7d2e2fe-0d7b-42a0-abf6-5cd9766867a0", "comment": "Malware payload (AgentTesla)", "value": "21c842b3980ad1df3af813d4b0dc3200e1a82ba95bcc86e6961ce35a935cec01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537111, "uuid": "1beda73e-317d-4182-a5ff-62888fdce90b", "comment": "Malware payload (AgentTesla)", "value": "ac6a139e67281ce1affd80526e4fbc757abacc84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537111, "uuid": "c8488581-15df-4f1e-8f13-8f560faea542", "comment": "Malware payload (AgentTesla)", "value": "893d665081b480b2bc89195db02c6572247ace2b81d81e6bb1ab1da9ee2e88b9afce8a937a9a2b7fdc83f119a0d9fb46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537111, "uuid": "2c47b83b-6643-4e72-ac64-454fb9e212c1", "value": "T11BF4121136A8AB53DCBE9BFD60A011446FF4B4267151FB8D4E8431FE1EB37E18A50A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537111, "uuid": "9d8e82e6-1c8a-4777-a1de-b8db9b577299", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537111, "uuid": "c0011a65-1937-42db-8223-a97286274189", "value": "12288:Za1hIoIFFHgeg/cBix8x2VpLVRWdyMSfhtF+Zgt4wAv82BlXpPYQAgFmSq6eJW/:aIXFxp4LVRWwXfh+2t4JU2BNpPjAgcJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537111, "uuid": "91940a6f-483f-41df-bc17-0641c203b27e", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537111, "uuid": "6d112bab-471b-41d0-b980-818a3501ad05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537111, "uuid": "0079f829-ee79-4ebf-853b-e6df3504de2c", "value": "DHL Contract Rates Revision effective February 1st, 2024.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2a5266-beb0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1706537464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537464, "uuid": "3303d270-304a-4ed6-b760-59d2e703a42d", "comment": "Malware payload (NetSupport)", "value": "db4d0ecc5810b6f5ca329c5f4b06b255", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537464, "uuid": "46f4bb06-789d-42d5-95ff-188dcc660124", "comment": "Malware payload (NetSupport)", "value": "222fef366804cf3419855737cdf36e42e9105a43384750e9585aaf464bf4e259", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537464, "uuid": "552fc194-e48a-4f14-825f-63202a4cf1f5", "comment": "Malware payload (NetSupport)", "value": "1cba18eaac4cd45c4ffb553d2eabc59ad53925d9", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537464, "uuid": "518361c2-3219-41bc-8800-c8714c06d490", "comment": "Malware payload (NetSupport)", "value": "83a40d6862166313246ed5b47143c64a10c2b1684e184f90342a023edb449fcdabadb1a3093e6f49d14deaf1a8ad796f", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537464, "uuid": "1a76346c-96e0-4deb-a182-8ee9b99b9e6f", "value": "T138D533526393F7A6C0E2F67BA09DAC161E7CA07C94F63A730C7EA9D2D636451C46F402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537464, "uuid": "5fce9a8f-7ce0-4170-9c43-a509783a2d8d", "value": "49152:3lAQumelDlEDThXBJOhHLw6J6h2SFFGf0RBNTQfYc9jh23eWeB3/YSBm7WIqR/gh:3l7/FXamhRFY89YYc9jh23redpmQRC1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537464, "uuid": "bf093986-9297-40a2-8a3f-dec30717d897", "value": 2971143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537464, "uuid": "5badd80a-d748-4bcb-b408-4324a9f4b192", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537464, "uuid": "96323d0f-03d8-4d4a-a081-0e54659ccf9f", "value": "lol.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07983656-be90-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706523630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706523630, "uuid": "03ecbdf9-fd8a-42c6-9aa5-272a39199beb", "comment": "Malware payload", "value": "0ebff14bdde4a23a91fe583d8acc533e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706523630, "uuid": "adb52584-7815-4463-a71e-2167fc23559e", "comment": "Malware payload", "value": "2280cc2dc98dcbb12d08b6364a277a39a3964a60856c95656225811ff4d7b4fe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706523630, "uuid": "6394ccd7-6afd-4d74-897c-e3d0b4aab40e", "comment": "Malware payload", "value": "8db2ad87dda5780f6b8f848b7200a633ee214a65", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706523630, "uuid": "be323836-670d-451e-966e-f76d8b2b154a", "comment": "Malware payload", "value": "5498af936be65e52d8e2780ba41ef7833f9ef8e47dc45023ac9dc382f8d0b86d8deff5b4b6443d7d3631bec3a449c09c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706523630, "uuid": "92f444a1-a81a-4e6e-9d88-75e9b1354006", "value": "T110039F05B2D1CD1BE5E609304DCBDBDA37287C19AE16D24B33847B2FBC796B08A12752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706523630, "uuid": "cb4ba5fe-2ba8-4dfd-a67d-8fde3bad43f5", "value": "384:wU3diSvhmLXG4ff4i+OYYRZRQ7H/gpFpIPGhT50j+NVtgv:Nrh14noQZROH/qFpiGf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706523630, "uuid": "57fd8be8-d8ae-4eb4-8098-796c7668dc8d", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706523630, "uuid": "0e5fd5cf-4a0e-4174-aa51-b653c41466d2", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706523630, "uuid": "b33325aa-a35e-4757-9800-174705964051", "value": "0ebff14bdde4a23a91fe583d8acc533e.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a972ccd5-bed0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706551390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551390, "uuid": "e6becaa1-4b76-4d0d-ae08-23880c8e128f", "comment": "Malware payload (AgentTesla)", "value": "946a68c265fd02f8ddcff6b342a8169d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551390, "uuid": "2d7503df-3ea8-4bae-bb0b-a4e410555cb3", "comment": "Malware payload (AgentTesla)", "value": "2288a6cd829317786fbf8c7cbbc225457b84cd39ad59010d33dc2669199dedd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551390, "uuid": "957635e4-6c11-4ea7-b251-cf355c4c1445", "comment": "Malware payload (AgentTesla)", "value": "47ce19f30630ea128afe09ff797378e70ac64ccb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551390, "uuid": "26166b61-f766-4d69-b1c7-999dd460ae1b", "comment": "Malware payload (AgentTesla)", "value": "9e769616faeac78ce934ac9104bb707d904d400fafc102ecd2a04c090e503935971a91eb45685d94745fe5d0ad901c83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551390, "uuid": "30c62201-c587-4746-8c8c-fd601e0f8cfd", "value": "T135F41266327C5703D8BA9BFD302052401BF475262561DFD90F9432E979A3BE18B60EEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551390, "uuid": "46307d82-68be-459b-8312-89817a115960", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551390, "uuid": "cd328744-17fa-4432-85da-84bc05820319", "value": "12288:wa1YnIoIFFHgeg/c95zL+NQMsYk5LSD+hQ2x0+ef7axmBtcCIiiu7tBcG:knIXFx95JNYk5L+h7aQcTgzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706551390, "uuid": "d2e222f0-b05b-4a1e-88f5-211b92ced331", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706551390, "uuid": "698b3819-d493-4b5b-af63-8e5cc0764d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551390, "uuid": "e3c0bce1-5e09-46bb-867a-1ce691ab9a46", "value": "rYEN\u0130S\u0130PAR\u0130\u015eSoysalpeugeotRFQ27014202GREECE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ddec69-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706536237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536237, "uuid": "9a5c916d-25a2-4f92-8462-0e6ece34537c", "comment": "Malware payload (AgentTesla)", "value": "e73fe4130716b7aeaedf3c89edd2a5a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536237, "uuid": "39fc3f5b-8800-4cbc-8ec6-1742a7f66bba", "comment": "Malware payload (AgentTesla)", "value": "2357488a52b209f9969123287d029dcf7722f2df9bceeda9582da6af0b17abba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536237, "uuid": "a196ab47-a276-4074-9cff-1d241adf22fc", "comment": "Malware payload (AgentTesla)", "value": "e3bb7d4c19f0d66012fcd34bd74c0b510d192f80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536237, "uuid": "67a09bc3-7287-47b0-9f22-63c3cdca9740", "comment": "Malware payload (AgentTesla)", "value": "da88bc032ab8dca14bb309d80440e8c7b2a7e76af7200678b4cb2dadb227dc240eacded5c46357c59c38587e2a914908", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536237, "uuid": "b8ea1e21-5f17-4cff-9c41-138b4037025a", "value": "T1CAE4126A3768AA23DEBA05F80567128857F8943A1B43F3C54DE052EB19F77D25B132C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536237, "uuid": "34150bda-a8fd-42fe-a206-9431f7d7f8c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536237, "uuid": "7f73e2d1-eac2-45a5-973d-575d41fbc3aa", "value": "12288:slTKGZrhBGHsHZ4GAd2FzTqBe6pzpIJds98udvjFCtOWg:WYuZ4GAMFOeG1MLkrFh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536237, "uuid": "f9f72887-625f-4547-b4c6-3a225b6b24cf", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536237, "uuid": "73b4a8f5-6dd5-494d-a75e-986f40bd323b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536237, "uuid": "37a30d42-bcbb-4601-9596-f81bfdce9e28", "value": "PO# BAG-012924-1.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9fd8e2-bed4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706552984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552984, "uuid": "6d9deff5-50fc-4b09-9e2b-4e624a801746", "comment": "Malware payload (LummaStealer)", "value": "2869f5935b26562c91dff5b6d10bf478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552984, "uuid": "ef8e9f16-71b1-43c0-96be-36df1ae5aee9", "comment": "Malware payload (LummaStealer)", "value": "2363bb391fc6c6c13989163ae927152c98418f900aac7ff176b2f265b214495c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552984, "uuid": "f6122213-24e6-4840-bbed-72602ba74347", "comment": "Malware payload (LummaStealer)", "value": "6b5518cb0406f8a22d6dc8d2de564cd930550957", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552984, "uuid": "9bc6f387-2397-4fa8-a6c5-47eebb788053", "comment": "Malware payload (LummaStealer)", "value": "260b7cd49b9f1e997bbe00b73f540eae52ef3b23cbda98ccb0c350cecbe3bed9efaed8b629080491c5586559d4b4eff2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552984, "uuid": "fb636094-ff9f-4614-9475-af4bfb3d76a9", "value": "T118E49E6B8B3DC423DEFBDC79D92492AEE42354726C5C404D3A8D0D8D7A22D664E8E11F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552984, "uuid": "c59ea942-8d65-4041-b121-903fb7c2617b", "value": "2b7b16ea6305513a3787fed6f5a40b28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552984, "uuid": "91b71bc6-f7b5-427e-94c3-432c9ce73784", "value": "12288:DYGFS9zLkgAg2ehwdupgmKHse4xe+10eOci+:DmzyegxMe4xe+1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706552984, "uuid": "9f75d42a-4d6b-4588-9dd4-62005e127c43", "value": 674457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706552984, "uuid": "76618247-6080-4740-9256-adc32030ed8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552984, "uuid": "a3695ed1-852e-47b8-83ba-0532cbb46972", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe32713d-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1706520608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520608, "uuid": "814e289c-29c9-47da-9a7e-4738678b79aa", "comment": "Malware payload (AZORult)", "value": "b9aa2aa7ab32cfa5f92a1c8190307071", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520608, "uuid": "e2bd3a51-0fb1-4ff5-9489-cb3bf74dd399", "comment": "Malware payload (AZORult)", "value": "23f2132a3a6dec85b56217864476a9e48ffe4de5c1bebe4a80d66481c59fa9e6", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520608, "uuid": "ccef6173-7804-44cd-a143-dda02029029b", "comment": "Malware payload (AZORult)", "value": "f278a969379674bc9994a8e3cef74cec438f9fb4", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520608, "uuid": "90032824-da90-4fc5-9d5a-ef65a32468ac", "comment": "Malware payload (AZORult)", "value": "5712b75bde053bb52d0d1b61cc5202c06d5c4b9d28c724661b1110c1ae313aba72aa8e9925f3e4de6d8a968fc2233f80", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520608, "uuid": "338ff6f0-25c8-4a2f-90e2-2fc4b7d4d56b", "value": "T158642310A34D16D683EF02D2CC89DA0451A20DFBE80CD9ED7B26E59825C67F7F61E8E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520608, "uuid": "968996a0-fb8e-49b6-8bdc-5ea5fcb849ce", "value": "6144:0Zcsc8grHtArbXJQXctMecvKnM/aiB6zGWkSfVPPIvXzbyXH:0Z74HtcbaxdSM/NBARVPPIbb0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520608, "uuid": "d3b9c974-42a3-4863-88ec-6a54a01ada5f", "value": 309601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520608, "uuid": "920c432e-3583-4370-9000-154d2f487bec", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520608, "uuid": "6a96073b-2476-4b14-ab39-5dfdef12017b", "value": "Doc-290001800234.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe93b456-bee0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706558404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706558404, "uuid": "866df717-ffa4-4d36-bc07-9511702f3734", "comment": "Malware payload", "value": "bed91de0665582bde78327dae442af84", "object_relation": "md5", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706558404, "uuid": "252855a8-e77b-4446-81a3-be0ae739b466", "comment": "Malware payload", "value": "243af9afbead02eccaa3ab6f711983194560e66429f017cf657e579a61a109a5", "object_relation": "sha256", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706558404, "uuid": "636c34cd-04cd-49d5-9ce6-3567179b9b9d", "comment": "Malware payload", "value": "a448f589edfb60a70115dc06086f0ae4a46c3b62", "object_relation": "sha1", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706558404, "uuid": "3ace745d-8fd3-4b04-83c7-9ef5ebb58fe9", "comment": "Malware payload", "value": "11bff03bc9732abce1f71773c944f63e01982a77edb272e26fa5ea1ade7464208756f4d9bc9e505092f06e2750d9c2b3", "object_relation": "sha3-384", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706558404, "uuid": "b1e729e9-791c-4735-b9f0-79572ba07535", "value": "T197E733CEF515D9ABE812ABF3A67D9FD061CE2B821380DF171FD8CBE14D509006552AAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706558404, "uuid": "e0576371-d444-471c-b390-f17115130759", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706558404, "uuid": "e275502c-98fe-4626-9269-8c07ff408bb3", "value": "1572864:fm6UZYmtMXztvJxHPW2nuEeXd/gfmDSBMc/aeX3Rfl2C60Eyk:u6U9tWBvJxHPWZQmDSBMc/aexfl2C60+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706558404, "uuid": "ac319a63-3142-4305-acc6-de28f5383424", "value": 65689055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706558404, "uuid": "33b3df1c-23ec-4513-afe2-c2fccae64ded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706558404, "uuid": "f3ae8d9e-2e0d-4087-bfce-3a6b2a5da1d1", "value": "UnityLibraryManager.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a044a9-beab-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1706535515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535515, "uuid": "fc66e01b-3fc8-4d22-acb7-bc420180cb16", "comment": "Malware payload (DarkTortilla)", "value": "9adf2d6d12c05ef21343d63b7605e642", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535515, "uuid": "e69d7dbb-dd0a-49b2-8f90-c19404ec0012", "comment": "Malware payload (DarkTortilla)", "value": "254b7f75eca7f5e0c8dc764bd236e8e2ec8e6e8d08a77a7bb610dc5070ec7cc3", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535515, "uuid": "bd45d1b6-4a3b-4d60-b834-347457328ecd", "comment": "Malware payload (DarkTortilla)", "value": "bf738ae10dcc0bff8c792de06543882a16e5e35f", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535515, "uuid": "69ce5c92-0fc2-4430-a20c-2638ae8d98fc", "comment": "Malware payload (DarkTortilla)", "value": "a45aa653a3c105ff7229fee0c756511dab7c08266f4163ff841b98047f1b9aacd9da36c74f837af02ac23e08c42e5d04", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535515, "uuid": "28f49579-3ccd-4ee7-81a8-80fc5748f5ac", "value": "T179A5127323E99F21D03DBB7C7161555007F2E856C336EA1F7CA810EA6A71EC2A667213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535515, "uuid": "d3f9bdf0-464a-4d81-9ea1-0a0b16ebb33a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535515, "uuid": "5f49be74-a167-42b0-a2e2-3b849dd911a9", "value": "49152:zC/bc/tENtpdl3aZhN/7MiEbN9c45BkI8ldxS:zC/bc/iNJl3yhJ7Mx/n5BkLxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706535515, "uuid": "15cf7bd1-7f0a-41de-8104-81e4fbdcc21e", "value": 2137088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706535515, "uuid": "53e8cd27-3330-4b58-9799-1b9f734efc09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535515, "uuid": "c3b80aca-3698-408d-981f-e16dee18fa8f", "value": "invoices pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3145ebce-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706520264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520264, "uuid": "822cea2a-affe-47cb-a788-0d644c61a6a3", "comment": "Malware payload (AgentTesla)", "value": "c8fa794257d95c1760ff8fc7b5acca20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520264, "uuid": "ec0504fb-6110-47fa-b4fd-72cebb6b8010", "comment": "Malware payload (AgentTesla)", "value": "2742c2cc169aa58abe64a0b3786c4ad004f60369056eac7a5acccc1d3ff67c0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520264, "uuid": "01c4db64-68b5-49e2-a5f5-ff0791c5a2db", "comment": "Malware payload (AgentTesla)", "value": "88ca3b5bd651002eea9e1d16d5b81c0517224f8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520264, "uuid": "e0bd913a-0a9e-4816-87b8-67c06811b110", "comment": "Malware payload (AgentTesla)", "value": "6fcaa60234fcc6c0d5111f337a750c0f5533df6939a2ef6df32097d0c6d32e7fa6e1bfbb0acdaeb51eabdd789fc49501", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520264, "uuid": "b9e9ebfb-56b6-4eea-994b-f79dd3cc6c80", "value": "T113C40114B7F8415AEAF74F341476A1101B3AF5EE6E138B1F0518A17F2C63B1583A2B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520264, "uuid": "b6ac9f3f-2dc9-4d0a-b5a0-e55965660ce1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520264, "uuid": "172fc5dc-dcc4-4c41-8c6c-c1b7ec583005", "value": "12288:nc5k/lSrWclJLuhYK9Q9Kte5sVpvY3pyR43KdEhhh4P5sle:nc5kHqJuSK+9KeWGle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520264, "uuid": "e25312ab-fa64-459e-8bf4-a841efa4e4a0", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520264, "uuid": "1bea89d6-6745-4081-9f6e-ac5eeafa9f3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520264, "uuid": "0b6d599f-e050-4890-bc75-a7e73ee4dfb8", "value": "P31-G01 Rev.jpg .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63b76e3-be55-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706498556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706498556, "uuid": "e2957d03-1b9d-4e2e-a934-ca66d59fbfa5", "comment": "Malware payload (RiseProStealer)", "value": "c69257754756a39feb6866d4182de5ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706498556, "uuid": "692b7824-b7ae-415f-8453-5a3b588adf83", "comment": "Malware payload (RiseProStealer)", "value": "28743b7096beacaf8a67056ec70274af4b84fc5410f22ce4e9086eba7be5e665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706498556, "uuid": "f0b047cc-c6b7-46ac-a668-dbe1c1a03a10", "comment": "Malware payload (RiseProStealer)", "value": "166ce2d73c9d910413d03f4e4230dd4b9e73f9dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706498556, "uuid": "b647df02-d0da-41b7-a3a1-ae394d1ef275", "comment": "Malware payload (RiseProStealer)", "value": "422c790553fbae50b9168f454a9c5c47dad2b90f2dccb156d8483c50ab21858864cef145be1d3ed5673d9588d289cf7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706498556, "uuid": "40876347-c6aa-46b3-9781-4ff538846d9c", "value": "T17CB533F993F14202D79F437DA2B3528019279D23A050693E2521F5BEEF7C1BE524ADCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706498556, "uuid": "45882e2c-7980-4924-99c4-78b83fce9be3", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706498556, "uuid": "3871d73d-af48-444c-a702-0ccb9f3c2e19", "value": "49152:maSEP2yVfKG32h2Ougih+mvVW7FI460FSR2Cs:j92ydw2/h5g7ulR2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706498556, "uuid": "3313459e-3ae8-484e-bfbd-713a30e7728a", "value": 2299904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706498556, "uuid": "b5582eb4-7be9-4f98-bf8a-042ec64e3f40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706498556, "uuid": "acd85dab-b51b-4364-98ed-c261dcc5575e", "value": "SecuriteInfo.com.Win32.TrojanX-gen.1402.17438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48c59ca-be9a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1706528269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528269, "uuid": "e808f382-14c2-41a1-a6db-d6a8c6ba019f", "comment": "Malware payload (BlankGrabber)", "value": "02aa5047f900ef092c34766b9c1f5851", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528269, "uuid": "fcf6fe19-3870-4901-9188-be51725267f5", "comment": "Malware payload (BlankGrabber)", "value": "292c5930930e796948bc1ab575610dc9406757bb4277fe6a7d68f3718f10a1e1", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528269, "uuid": "341068a4-8d13-4e2b-86b1-4dd303cf53fe", "comment": "Malware payload (BlankGrabber)", "value": "3ed88ee312a8159dc19ef4c48db72c9983f391bc", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528269, "uuid": "705bff57-ea80-4b33-b6f6-eb63dbdc3db5", "comment": "Malware payload (BlankGrabber)", "value": "83c368d3002667d84a35030fb2359663a37de63f2e20a2e47da688a618293919cb61c6628261f4a7459bbd14e247cd19", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528269, "uuid": "8726183b-c229-48df-b7b2-2f8ca33b0e17", "value": "T1FA76339A6BA11AF0E4B78239C0838153C776B52607A8CA8F17F452A15F533D2DC3FB56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528269, "uuid": "28e6df4c-54c4-4372-b3c7-b887d631a526", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528269, "uuid": "6ca89bf4-a8ad-4229-a7f6-722888a36ff5", "value": "98304:wRJTzdbM+Q2y+aq0YjOjFgFQlwq4Mjk+dBZtu9xTtwz/aer6/BbNEJ1nL2hBnLnA:wn1f0uOjmFQR4MVGFtwLPfnL2hVUJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706528269, "uuid": "feb8e273-f6bd-4e4e-b662-43d3426b172f", "value": 7147012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706528269, "uuid": "9e519871-ac7d-4ea6-a0ef-b8da91138d29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528269, "uuid": "04b1e50d-fdc6-49c2-86a2-66920e6ca64b", "value": "sparkExecutor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39a81dd-beaf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706537287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537287, "uuid": "80d1e49c-a67c-4ba7-a438-9c8fcdedec54", "comment": "Malware payload", "value": "10af82086385c6a2514d222753184317", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537287, "uuid": "5b0777af-ff90-4e3c-8ec7-1eecf0d00bc5", "comment": "Malware payload", "value": "295aef7c1199c1f1ed7d487694e977ec858c5819140ed09808e175fcc49472f0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537287, "uuid": "a4e7e383-fd35-4991-a84b-776afacfb255", "comment": "Malware payload", "value": "df565f479665be322b27cb32cbd0eb513d0290ba", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537287, "uuid": "a203c793-ba5b-48c2-aca5-57f8e55da0dc", "comment": "Malware payload", "value": "8791e21d1491fd678d3cfaa6e5e8b579bb3469a0594017b972296edb768ab02044905c40294c42abdcd1cbc3f5c070e1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537287, "uuid": "35caac69-7835-4e7d-b4ca-7f85b3dcb6e3", "value": "T11EE2D063D5B01C7AEF6541B7E1F22B83D20D7807A73A3809DF32B628CCA658E4D655D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537287, "uuid": "de4d778e-302c-4974-a8f4-1cd6d1113180", "value": "768:A4bewmuFze6j+omfsRYKiAMx9Xg0mpgo426Za:El+66ZCYYek9XmZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537287, "uuid": "5ef0feaf-b147-40cc-8fcf-87d511156807", "value": 31374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537287, "uuid": "9841b507-af88-44d6-9fd3-5adfe3279bb1", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537287, "uuid": "56f33262-1f2f-46ef-9e81-9fbb7a378e52", "value": "\u041e\u043f\u043b\u0430\u0442\u0430 29.01.24.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ead964-bef5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706567359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567359, "uuid": "fd28d700-00c1-4620-8e95-7311bf97613b", "comment": "Malware payload (Mirai)", "value": "7fb22343356bb47a0bdd1cc4988a5eed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567359, "uuid": "d7f5b440-26c3-4d16-ab2e-a16458e5d473", "comment": "Malware payload (Mirai)", "value": "2bba8170dd585c26a7343b599a769b28d331f5ffdaa41db90dbd728954cfd477", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567359, "uuid": "7dd1c41c-83b4-43dc-ba16-3724d389a86c", "comment": "Malware payload (Mirai)", "value": "4f4f51dfe5f1dbe2fdb8e8928b3253b8be20bb22", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567359, "uuid": "4e963584-3b2d-4313-abf5-1ee01d5f9bd6", "comment": "Malware payload (Mirai)", "value": "fb37d95b24bc696aed416406e7f71684f577d9b0370dd55be6a962f6153787e01284b51121ccb34c9462e49291a56bdf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567359, "uuid": "1c18c05a-9add-4e4d-9854-4c2307d100f3", "value": "T1A9D30945F8515F23C6C612BBFB5E428D3B2A17A8D3EE720399255F20378B95B0E37542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567359, "uuid": "829c2db2-85a2-4e69-9c7a-15030feca22a", "value": "1536:9P7KL8K6/O16ZOV/zJeFPLACJ0C4VupJ2TLqau2ptmDEvdl7QwywvBAA7MOplEso:9P7+zhYFPLz4ig3qau/ApFDwJaU6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706567359, "uuid": "abecf5e6-a928-4255-9d65-ccfe2f89bd9b", "value": 133856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706567359, "uuid": "252535f0-d03b-4cfc-af09-5b3e79fa6341", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567359, "uuid": "728a1496-68e3-4ae2-aa5e-2eb19992a9b3", "value": "most-arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f57e5e6-beb4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PythonStealer)", "timestamp": 1706539347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539347, "uuid": "1859da8c-55f0-48cd-a21a-8a226777c653", "comment": "Malware payload (PythonStealer)", "value": "6e0c2cc2b89a9d054ebe5df5656c7113", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539347, "uuid": "f4910560-eb2c-4279-8b51-f7328f2df3a6", "comment": "Malware payload (PythonStealer)", "value": "2c0f3446ad21f75151101c09c2c0a136705e34aa70601d983f58cde68a16d5ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539347, "uuid": "ac0b6d09-325c-413c-81cf-cc939d16fe8a", "comment": "Malware payload (PythonStealer)", "value": "2f8ad19362b321130c94ec180869ac68fa8d7a12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539347, "uuid": "45908493-6d7d-4def-990f-3ba871e8b322", "comment": "Malware payload (PythonStealer)", "value": "e2409caac6f0bdf15bcfed0e91fb0ac3bb37e30ce0972d845a3dc6001c6418456101724fe9d137ae3b4940280f78767e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539347, "uuid": "9eac4e9d-4c24-441d-a40a-fc2f4a9ab7ec", "value": "T1FFB633ADD5160C66DCA7E1F4A38224F23B7F3DB13B41849A92E9D9B01563F901B34F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539347, "uuid": "6ba08133-c041-453d-997b-fa921d92719f", "value": "a7b0793ae6dd3f16ef244d19e4de0c24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539347, "uuid": "6e101ee0-9536-4248-b734-dfd89798a506", "value": "196608:YqcMiSikjE70ve4FI5N0GHXufp3X/azz:YBMiSikg7mJFu50va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706539347, "uuid": "5dfe6e7b-f451-4622-a0d9-af3ad4d3eb08", "value": 11202048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706539347, "uuid": "303690db-4222-4f03-bb9a-48e7e5fe76f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539347, "uuid": "8ca142e9-0909-4d44-b8c3-2c20af9128e2", "value": "SecuriteInfo.com.Trojan.Siggen24.48788.26471.29016", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec30e3f7-be87-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706520148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520148, "uuid": "f9dd4dbd-108f-4013-8bac-01a5896ca14f", "comment": "Malware payload", "value": "82c693fe0e3c666ff0e542d90064943b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520148, "uuid": "07407e36-7062-48f4-85d0-95a81235bf16", "comment": "Malware payload", "value": "2c695f7cf8d13406e5a7ffa521a1bcd5be9d3f095182edda0bb6550976a5cf00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520148, "uuid": "f6a97b85-6ad4-4715-8f06-a3e8744df153", "comment": "Malware payload", "value": "9d828bd0e0fe58cc93c5a276291ff50efc8f4001", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520148, "uuid": "e5e40538-8cd4-44ae-90f1-5e1465691198", "comment": "Malware payload", "value": "d10d040eb2aa39327e4893154b0b894faed63aac31c92d67ad73440c52306f24fdf36b079a9c37c269bbe1795e9314cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520148, "uuid": "d739cb3c-14c0-422a-94de-133a9ebd73c2", "value": "T1A2D423A09BDC0022F7BE9EFC18E366DA1632B367D50B8B4D64552C0A9379787C5B1633", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520148, "uuid": "4b6cf627-6e73-4183-884b-4fe85a9b35f0", "value": "12288:kZdfrXg+JwuKt/S/60G3SpaFKnXNFcTFNJ:kfw+Jwz/S/6cMkKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520148, "uuid": "347b742b-e934-4504-84a9-f1a4fb61478c", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520148, "uuid": "d853c2a5-d6a6-44cf-84e6-2a57c0a954ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520148, "uuid": "ab2c9f18-1172-4964-8eeb-139a11aa5abc", "value": "SecuriteInfo.com.Trojan.GenericKD.71032217.25306.31344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6333d0bf-beaf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706537098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537098, "uuid": "36f11b14-1086-47f9-910e-3fdd69925be7", "comment": "Malware payload (Formbook)", "value": "ab80066a7944873a8470133cc2449aaf", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537098, "uuid": "7341441c-2ed4-4d98-817c-2e06756ed4e5", "comment": "Malware payload (Formbook)", "value": "2d9aa18c34940edf126de6ccfcba6bc40b6b8cb7728c458c791d50d19c1e0001", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537098, "uuid": "f86fc816-90b2-4858-8dc0-d7bf0790d28d", "comment": "Malware payload (Formbook)", "value": "eb426d39e7a718f35707305ceceef8ba71cb1f11", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537098, "uuid": "6361aa16-4e7d-4242-80c9-b2a4d4b83228", "comment": "Malware payload (Formbook)", "value": "c8b1c4b91470adbca65b3b392116518bfa80b5f64f4ee682e00ba8395580ab4bb176544422fa8b212fb9c66aedebb8a6", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537098, "uuid": "3b024921-be7d-4896-9854-5d22778f8cc9", "value": "T19DF4124033ED9B12CABB8BF4593054605BBA76173576E34D4ED6A0C91CB3F8006A5F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537098, "uuid": "291b4d2c-f620-455f-a598-cbb6a36a0399", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537098, "uuid": "1017b93f-de61-4671-a7b9-5e687b8b8d1c", "value": "12288:syTHAoIFFHgeg/cdD3AxT7fH4dAIk0gPlLYRDwXYF5fugSaWRxALk/lPsOyis:BTHAXFxRijH4sTqwoFJxSaZLk9P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537098, "uuid": "2229ed6a-5e47-4163-a561-df59dda25974", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537098, "uuid": "46100b75-a6d1-4ca1-a5be-c219f58c5899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537098, "uuid": "7bd1df7a-fd2a-491a-961c-ab379d83f0ee", "value": "DHL_AWB#6078538091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cedcc8-bec0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706544459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544459, "uuid": "45c18e35-7cee-4ac9-9be3-2bbec6548a60", "comment": "Malware payload", "value": "92df4fed3c92f414527be714440772d6", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544459, "uuid": "ed5a59a5-a3a8-49b4-bc54-518571fc53cf", "comment": "Malware payload", "value": "2e1bcf78fc03408afbd8f0eee3607b40780cc0362145c0ca9c2e063f7d33fd40", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544459, "uuid": "c045dba7-2dd4-41d3-b983-312d9eadaa03", "comment": "Malware payload", "value": "5dd3ef94eb39f8b2f567ebfcc7806a4d332381cb", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544459, "uuid": "faf81cb8-5f79-4731-8323-158a6b57a4dc", "comment": "Malware payload", "value": "ec42d9819b1b6422cb3c47eeba1b5faa5754926eb89a47b0e367d43112c3d41284fc398ea945ceec4e3d25dd8d9794f7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706544459, "uuid": "929bbb4d-d5af-4dfd-9a3c-59724662b1f6", "value": "T1B68533FAD3D3BC2064947EB1CA51AEE751C5A001A6FA34361E294DC2706C5BAC87F5CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706544459, "uuid": "75f4ed45-0360-428c-9c8c-1258d52b15ab", "value": "49152:fpLb0Su/b92dsv3EHXFqWFvy83BQ8+E/D/eczvdczG:RH5HNnI8H/bzvia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706544459, "uuid": "9db94682-4d39-46f0-8328-51c1c4acf2bb", "value": 1808242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706544459, "uuid": "9e135bd8-9631-4e06-9300-2caeedde7599", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706544459, "uuid": "4ec00635-32e2-49d3-9469-e0462bbf6aca", "value": "reincarnation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25e6164-befa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706569470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569470, "uuid": "e4e77db9-4908-4c70-817b-66bc680c7b4b", "comment": "Malware payload (Mirai)", "value": "52cafc0a5ae886c5106e047e86df65f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569470, "uuid": "f75d5115-0784-4e83-a330-c2f357462596", "comment": "Malware payload (Mirai)", "value": "2f04a4b3b186f63139747fa4c5ba4ab652ed548551965d7bdb7effd0f1e3cbca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569470, "uuid": "1006e11f-a343-4fe0-8508-601fa5368e99", "comment": "Malware payload (Mirai)", "value": "bd6dd0e2e1d06a7e56f131e7a7da075f2fb93e5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569470, "uuid": "85f011a5-7ef9-4aaf-9996-9f4484d76e69", "comment": "Malware payload (Mirai)", "value": "12fb864e5e2cafbe0d6fb9f708279b25ce6b324abad68052e58c9003cde3c623f080e56940c4bed890a5e05166150327", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569470, "uuid": "674611f7-2b12-421c-9afe-4164ddf20f80", "value": "T1BD538D75D12DAEA8C0424AB4A9598E704F13A0C046732EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569470, "uuid": "8a3582ba-1266-4cdb-aa93-8c303eae9188", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706569470, "uuid": "b96e7054-400a-4da2-920c-23f67f736190", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706569470, "uuid": "6baa495d-a9ec-46bc-98fc-e2218bf0aa39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569470, "uuid": "c2eb0676-77c8-456e-8529-fee3f33e1bdc", "value": "52cafc0a5ae886c5106e047e86df65f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50556090-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706536208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536208, "uuid": "93f31a99-2797-4a8f-89df-d9a62825d06b", "comment": "Malware payload (AgentTesla)", "value": "7327b43dc2254329e09f10f4037b3a3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536208, "uuid": "0bc3a12b-bdf7-41aa-b3e2-7600af7ee0cc", "comment": "Malware payload (AgentTesla)", "value": "2f7e27dbae819c002e7107aece0b637c5a6e3580f24ac66d2c2bd2ccbd59fbe1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536208, "uuid": "8c190db0-36c5-41ad-aa48-4d7ea3490b8b", "comment": "Malware payload (AgentTesla)", "value": "acd321f38c9f5681c59adcaef25817032dfaa4f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536208, "uuid": "2911d2e0-3141-470d-9a67-dfa99ba2c4b7", "comment": "Malware payload (AgentTesla)", "value": "f95b672b6ead37e7b3b96157ee34acc74a828b72a54163a0897818d2149912babd8953ebcf863e35c498add68741c525", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536208, "uuid": "51c143b3-89ed-4017-8877-362e8afcb58b", "value": "T105F4120136605F02D8AF5BF8246171468FF8B1A77941F7A81FE132EA1E277D18B11ADB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536208, "uuid": "9f738833-fcb0-46e1-b4e4-40831c91990b", "value": "12288:ZaFTdTKGZruy0DZ/2hN4R2UV4pjO25htcBxjmPyO3Wy1mGoDJDQMuiC1:Y/x0DZiN4RrVSy3mPPVoNDzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536208, "uuid": "6f96e63b-bace-44e4-b386-41c631da7139", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536208, "uuid": "37b621c2-339f-45ae-babb-4eb6c450a401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536208, "uuid": "f4b2a28d-f6ee-4840-a079-57c3d7aa3491", "value": "PO#21209632.00-21209633.00-21209634.00-21209635.00.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682cb242-be45-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706491580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706491580, "uuid": "bc010ada-b650-4038-99a2-225d011d45ca", "comment": "Malware payload (RiseProStealer)", "value": "cab8183a94bb10ab3d1bffefa7db38e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706491580, "uuid": "82eac977-d32f-49e5-8ba4-b1a39196e377", "comment": "Malware payload (RiseProStealer)", "value": "2f7f23610e8e0633ef0b03d602a02734bdcadab3fdc8c15d0f6d93a0a454fa6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706491580, "uuid": "2bfffd0a-8b3f-4e83-b840-bd4f5fc5f33b", "comment": "Malware payload (RiseProStealer)", "value": "f052bbbea194be15593e1ddf7cb0d59020597ba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706491580, "uuid": "8951f183-b50a-41d6-b998-89a2dff90504", "comment": "Malware payload (RiseProStealer)", "value": "187aea777fd0d34ca8184c978ee5e95be46da878ff3aa665b8420874a506aa1bae34304e190a933d7130eb8cc688be69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706491580, "uuid": "f82646ef-6d5a-4fa9-b1b0-d22f86ad61d8", "value": "T1F6B533F13578241CF9CB17FA1151A18969E37C57A92635DAA7D3F3C183BE2B3A861C10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706491580, "uuid": "2e563d6e-f5c9-422f-9403-ccc1d46a5826", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706491580, "uuid": "1cdef2f5-bb81-4dd8-98fa-48a5251d79fc", "value": "49152:RWVVfCzVSFZ6IN68gEy8tyKxZSiNcaDkyiCVaoAS3QPJVVv:cw79/EyuYBlyiCc5PJVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706491580, "uuid": "70c6d570-7174-40ec-a864-7ad5fc22d98c", "value": 2298880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706491580, "uuid": "9dfc4455-6233-4429-b180-869fdbf58112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706491580, "uuid": "36c5dade-0927-4bcb-9f3c-581e778e564e", "value": "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a6f2a1-be9a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706528138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528138, "uuid": "cbe31d23-7e4d-4ed5-ae00-c18c68341265", "comment": "Malware payload", "value": "5f07d19221557e8b8d8eb0401e4c9fd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528138, "uuid": "855ba71b-1ce6-441e-8947-f146fe59a946", "comment": "Malware payload", "value": "2ff2ef1775a5313ea9857729d4eae76cfe062aa9a1356c54351485b3bee737c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528138, "uuid": "64b53975-3cbc-4831-8454-a1f2f11dad1b", "comment": "Malware payload", "value": "7e73a13c23629781272e365e490e096ea3d23dda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528138, "uuid": "92bb5351-d6b0-476c-a4cc-576c2a1be44b", "comment": "Malware payload", "value": "5a8de909275f128af6bfb51ea99c183bfaacdff9d62bbb6ca14dab49939da5cae7b4c048bba8645a024b45a868ce2230", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528138, "uuid": "61c5f20e-e591-4ef8-afb5-3d82b0073772", "value": "T1605601F4EC2CC6CAF77665762604C24806F09C016209BA67765074B6D5FA3C189BEFAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528138, "uuid": "b922d34a-6823-4982-9134-bc6c00408ece", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528138, "uuid": "3bc4842d-174c-465d-9aba-4e446f000c90", "value": "98304:PeT7Xpyw/umk2ry9SWhiuu0/Q1r7lfU4Reix4lmP22Bi2j/d5:PeTTpywGmBDWhPP/mrBfU4wiCT2B7R5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706528138, "uuid": "d7d3f17e-6827-47eb-b6a6-0699c63de49a", "value": 6410000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706528138, "uuid": "b3f9b218-8b7a-42a1-894e-f93d0a3cfdab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528138, "uuid": "30dbb1a4-941d-4bfd-93f3-363975b3895c", "value": "SecuriteInfo.com.PUA.MSIL.Exceldna.8544.25434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197c2f2b-bebe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706543417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706543417, "uuid": "226d5fa8-5f96-4476-8897-9d0c3806ed89", "comment": "Malware payload (DCRat)", "value": "766c3ef7ce39a3100d2d70f7d2850fbf", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706543417, "uuid": "cbc0fe25-3da7-422d-a2d5-e7d7515fd3dc", "comment": "Malware payload (DCRat)", "value": "3052de74bcdc2e2028ee5bd91e8ad654aa166d38a2715f3ac6e5a5501c1e14e8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706543417, "uuid": "08ad009e-97ee-4883-80bb-2ea019806caf", "comment": "Malware payload (DCRat)", "value": "74f70854ac506195e1a8f51a2ee0e9651becb4ec", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706543417, "uuid": "19e1cc00-b314-4b1c-9b37-6c475d039a10", "comment": "Malware payload (DCRat)", "value": "d3562b9d3714343c5c4756128b97784470526566bf3a6d61797105e2ba8567ab54335f6c7d04d9aefc0134134bbbb8a1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706543417, "uuid": "04ec308f-0e75-4cdc-b659-d13b1339aae8", "value": "T10995BF2B65926E33C2657F3584E7102F82B0D6227527EF4B7A2F50E16C0A238CE565F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706543417, "uuid": "94af168c-1ec7-40e0-990a-d933b76ecb63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706543417, "uuid": "f63946d1-e56b-4080-bb87-6e1872108463", "value": "24576:GnbLsr3tUHGNeubPxQhoFiAjeklLkJ21m2gP2y22y3gzT/kFCQPYGftxMBQ:Gb4r3hgSQmiAKklLkkm2gUrErI1liB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706543417, "uuid": "56e08ff0-c9e6-4794-97dd-eb0531306caf", "value": 2021888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706543417, "uuid": "de4d8d41-f9f5-4398-be96-b9e7fcd74ed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706543417, "uuid": "38c3aaba-b302-43ef-bce8-50513216628f", "value": "766C3EF7CE39A3100D2D70F7D2850FBF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d397675b-bebd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706543300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706543300, "uuid": "3da6f4af-3437-4e24-a741-3b68c8bce080", "comment": "Malware payload (AgentTesla)", "value": "0b26f7b7a37aec280212b187c006f3b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706543300, "uuid": "43a79189-7c38-4d01-acf1-98b78d667343", "comment": "Malware payload (AgentTesla)", "value": "30a3aefa3d3f44de2ed5effb8d7607c676b05d4c761b42f5151bd9fa0de5f959", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706543300, "uuid": "a6d15138-3134-4b1d-a31a-d8145be271e6", "comment": "Malware payload (AgentTesla)", "value": "dcd0e19aa5a0d7f7bb1b8bfcd89f4e31ea6c50b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706543300, "uuid": "fef65e2f-24b9-4d2e-afad-07b5e16f55b1", "comment": "Malware payload (AgentTesla)", "value": "e823675af6cb88dc125b6f832cf97b30c3d3ff851e8229423f7d932cbc74b9b05cfbac58c574392a0f3499a7642de995", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706543300, "uuid": "d6adc760-a99e-49a0-b08e-1a008e57700f", "value": "T199B4128127AC43FDE9A11372BC7676542739FE259046A31F35F813AD4BEBB088463B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706543300, "uuid": "f4c0b118-9dc5-4537-917b-c318d82816fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706543300, "uuid": "8d18ff1d-bb7c-43e4-ae25-df05e49b8054", "value": "12288:Cr0clz8bBo+ll1nb3uHVQWVirswEs0luX/svG/8kXEK7ks5m/w:Cr0VllRS1QUUvEsFvsu8kXEK7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706543300, "uuid": "b84790cd-4ce9-4f40-b856-cfcae2c4b58e", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706543300, "uuid": "5544cd76-3ce5-4cc2-90cd-db043139f027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706543300, "uuid": "4b76f185-c2b0-4184-91cc-165c2cfc6674", "value": "0b26f7b7a37aec280212b187c006f3b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73cffd5f-be7f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706516510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516510, "uuid": "432e3f44-4f0f-4178-9773-609571ae4dbd", "comment": "Malware payload (GuLoader)", "value": "e9511c52af792b25be4cc022154a8753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516510, "uuid": "419813aa-399f-4e2f-885d-68edcc638aa0", "comment": "Malware payload (GuLoader)", "value": "30aecb1d0bb7c6f8de3f21937ff121ccfee96e0454a1e9a156fefbf8accc8770", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516510, "uuid": "a1fce6b5-5dcc-4e2b-8511-0f9f324d9ef7", "comment": "Malware payload (GuLoader)", "value": "9fb6b7306286ba00d05b045c37035da39026e5ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516510, "uuid": "80266887-2819-41a8-bac3-096eaccbd0e3", "comment": "Malware payload (GuLoader)", "value": "79e43e77eb72556c5aae87fdb5c043458a58bcfe86259902a684963a437ee939ed45b37b848250793d3a92b0f826efa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516510, "uuid": "9b8dd254-a329-40e2-a40e-083a2560b695", "value": "T136F53308A5141109E005C2B3E7173F794F1933B59ACB6FE11FA6796BF87725BA0CC91A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516510, "uuid": "99299786-eb1c-40f6-9433-dc85fa45dab7", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516510, "uuid": "105b41dd-70a5-464e-8ce7-93c152560142", "value": "98304:8i++qX8iuivYw7Kx0tJI7dKeZIC5JkvEC:/cNuyYw7RtJI7ZZh5Jkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706516510, "uuid": "baccaf98-d516-468e-97af-43dff1075a3b", "value": 3427847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706516510, "uuid": "d5092626-f9cb-4b37-b450-925ef4a49860", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516510, "uuid": "3c3ee814-8301-4390-86ba-7bc5aede6aef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd89461b-beab-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706535586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535586, "uuid": "cd3ba0e6-8a52-43bb-b219-5db581146862", "comment": "Malware payload", "value": "929e6b4b859b28e1a38d4aab828f166a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535586, "uuid": "1d13f0ed-b4d6-4dfe-84bb-13389e8a1cf2", "comment": "Malware payload", "value": "30ee903f8ac7c1f729394e27c8ffb5ce4b3ab231941cce606b6891b9dd2db86e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535586, "uuid": "e8e9e83c-5865-4333-992f-c4b0358aa07b", "comment": "Malware payload", "value": "48a5118f364ce7d5d44cec95644d304f7e6c8e96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535586, "uuid": "ae30e21c-a9f9-49e3-b5ec-35dbd2cf11b6", "comment": "Malware payload", "value": "aec2aeae06e0b3c559f7c205dae6aca0dd1b506928f0865d477d76d94b506a1fb6d68c4a0a09c60e26846c34832b41ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535586, "uuid": "1ef13622-af0f-4798-9e49-6192e223e841", "value": "T1CBC58E16A2A2F039C27506314D66DB907C7A7E225E12D88B3FF43E4E4F36942D9ED907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535586, "uuid": "903813ee-df14-4144-8bfa-6387b0cfa0ac", "value": "b274f061892da951f273dad11e320f43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535586, "uuid": "8f8e3144-82f6-41a7-a46b-db76cf2fc9d7", "value": "49152:mximBS0kMZsdtDiz0hlzBt0aCQa8nKrnCZb7mnIQ:Ei9243zBSnQzbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706535586, "uuid": "a4cbf1b8-2621-4d1d-a187-94ae6a8f2774", "value": 2585088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706535586, "uuid": "210d4f70-6a5c-4fd3-b7ad-22d035a7c65a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535586, "uuid": "98b057f3-30e8-491c-8db9-9c14a132cd3e", "value": "SecuriteInfo.com.Variant.Jaik.179214.12287.7253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f805809-beae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706536636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536636, "uuid": "e3ea22e2-05bd-4317-b810-10796fef0ee9", "comment": "Malware payload (Formbook)", "value": "bc67c9e1cb0baa00d58578b2a265e188", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536636, "uuid": "fad6c15c-2bdd-4a17-99a1-f3184c17e73b", "comment": "Malware payload (Formbook)", "value": "31048e7a67338b361b72ec9cf70fc916ef5d6896571c5e75f5e5d050d55dd0e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536636, "uuid": "3501affa-c3b6-4e6a-9c15-da7d0dd5fc03", "comment": "Malware payload (Formbook)", "value": "367f81ab9444fbb2508f2c43bb957ea5a826c689", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536636, "uuid": "c746d39d-0123-46d4-877c-2e10ca950460", "comment": "Malware payload (Formbook)", "value": "068d94e018a535a6b66aa0ab61be23da5340fa61570cd4453564295a9048be7f47495f78882ace774249a5289fb8ac0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536636, "uuid": "a009e83e-c312-480f-a57d-918ee725668f", "value": "T15B256ED1B150CC9AEC5F06F1BD2AA53025A7BE9D94A4810C569DBB1B36F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536636, "uuid": "c1ed467a-d0da-4df2-a111-e93a087269b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536636, "uuid": "ae2aa371-b9a6-4f40-ba46-a3291e7be841", "value": "24576:ZwoIc0OkVYkIawkqH+IG/Wtywj7UxpgCOdw:nIkIIgWUiwxp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536636, "uuid": "902fc380-ee56-4846-a59b-67d0ca771bf4", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536636, "uuid": "daf525d7-79ed-4a9c-adcf-e2086173cf2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536636, "uuid": "6c860514-91dc-49b4-8b83-6430a39999b7", "value": "FATURA VE BELGELER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1af23f9-be93-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706525258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525258, "uuid": "41206462-a2f3-4cbc-8c71-59345a7f7d03", "comment": "Malware payload", "value": "79c52a31714cbcd287e7e588b9340b79", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525258, "uuid": "9c211068-84f4-4ef1-a0a8-6c70d8d6f676", "comment": "Malware payload", "value": "32cecfcd69ac5ca3719f18c3a3a2284d73b65e719badc048f1d6706b4264b20a", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525258, "uuid": "bf2793c1-9ba4-447d-bbc9-43799fcea3d5", "comment": "Malware payload", "value": "ed86fe107e0dc44d00f2c0f3058deae249cbc7bd", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525258, "uuid": "f83c892b-0dca-4f2c-b933-922787062de5", "comment": "Malware payload", "value": "8010c12067445c78b415eb03aa823799b599fe867a88e1d67def9227cdf8f2117f972765cf2ca1d6fa49972247571586", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525258, "uuid": "d99e9cee-6b93-461d-9818-a846645733aa", "value": "T14DC5F180F746CE25F679C635495347A01F24FCC4DE839B03F1843729BEB2A609E666AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525258, "uuid": "2a710fb8-22bc-47dc-8261-8a9a4ab8f0d1", "value": "49152:NCK1KA1fJGupXb73q5PWxAiKMkggj8Cl/QusKGdjkv:71KOJpq59bpjXYKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706525258, "uuid": "f7a99301-bb65-461c-a50b-d0cf751ebcbb", "value": 2649600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706525258, "uuid": "73609797-c388-4500-bc9b-027ee8f04f34", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525258, "uuid": "633ba64e-c8ec-4509-85af-6339d1f86ba5", "value": "FW4MC11 - ROMPER - SS24.XLS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212f794e-beb0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706537417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537417, "uuid": "95ad25bd-9fd1-4ff7-bd6c-2e6fbd0f9786", "comment": "Malware payload (RiseProStealer)", "value": "6706de7e4f9583a526c10f39220f689a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537417, "uuid": "d18efa86-aabc-445f-9cc8-918ed4fe7df4", "comment": "Malware payload (RiseProStealer)", "value": "32ed6add2a37c09d5e9cc7fbd38dee2f12dff20bbcd6bc8fe77ef31f031ba4c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537417, "uuid": "ba4684cd-3407-4407-9631-d9011befe5b9", "comment": "Malware payload (RiseProStealer)", "value": "cefc8a912cadb9633e99e42c88b5c031d253e437", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537417, "uuid": "4501074c-47fa-4ca3-9262-1cddf19bf98d", "comment": "Malware payload (RiseProStealer)", "value": "a6b680b1497fdcf007a53114d37066505f88e22b846d7ee157a24bf9301a6cdbad5c556f46ebf64663c1c0326e8b0c75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537417, "uuid": "815ad3dd-5c8b-4974-b638-563c8cf99b73", "value": "T1F146D04173E88F56E3BF13BAD2B102104BF6FC971B22F31E1A4495AE1992741ED563A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537417, "uuid": "94ae02fe-cd2e-4bea-9f22-9382b0262aa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537417, "uuid": "8d8726fb-e146-419b-9a7c-813b90431a22", "value": "98304:xpmJJ5GydYTmtNary0t59wEkC7U23eXI6JEZndFLlULHex7BzQA:xpmJJ5GyEPtrHkSS4KMdYLS7CA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537417, "uuid": "872a2012-a1d7-4b45-9731-b1fcd55bdf60", "value": 5739808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537417, "uuid": "42c6ac75-5911-4199-af6a-3b3e349f23ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537417, "uuid": "64f3f6eb-549b-40a1-bbe9-04a9e21a3d13", "value": "6706DE7E4F9583A526C10F39220F689A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daaa4d5a-befd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706570799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706570799, "uuid": "d3beab59-1b74-47a0-aff7-e80ace24c59f", "comment": "Malware payload", "value": "7844c0c39d820d373569bbc1c8dfa8ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706570799, "uuid": "dfe9f918-2a23-4c79-bef3-9118c8feeff8", "comment": "Malware payload", "value": "330730d65548d621d46ed9db939c434bc54cada516472ebef0a00422a5ed5819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706570799, "uuid": "5c19bec2-fe45-4ff6-a9d9-5f72dafb0cbb", "comment": "Malware payload", "value": "ee4fc26e3ec51ce2fc260583cdc94c40b1af3dae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706570799, "uuid": "663fde15-01ec-4265-a4b2-f4f59c33d1dd", "comment": "Malware payload", "value": "a44d91de3d55fbdf0d961b3dd50515053693c95a95e0b4a988a25b4bc97443311068e6d76e556bfe0e35918add0742e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706570799, "uuid": "fecd1860-e9dd-4027-8708-3e0aa3cb1781", "value": "T15D32EA056BF48356E1BF0B346DB256400632FA56C872DE6F28D8A18E1C26BD64D13BF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706570799, "uuid": "fc48ef87-a916-40a7-ba36-53e8f05a152e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706570799, "uuid": "0369e6cc-bbb6-4ba6-b855-cd818fd38165", "value": "192:+QqgQO5ljADF6JyBb+b1WP6YNzT2LSKVje0LPY3cZw:8g/5lMDF6J+2WP6GzT2LNVlPYsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706570799, "uuid": "a630e0e9-7b5e-4d4c-b402-05a87a549b7c", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706570799, "uuid": "015bd365-0a57-407b-9368-c8515a0c11bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706570799, "uuid": "969833ed-7f49-45f8-928b-9fc80e1dfbf5", "value": "Stage2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282df840-bec7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1706547307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706547307, "uuid": "9bcace65-f523-4c7e-a5de-206b8094cba7", "comment": "Malware payload (NanoCore)", "value": "d0c61fb5fb2118a060b04e5fa0898a6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706547307, "uuid": "be6970f4-4fae-409a-9a0b-b18e46d0750c", "comment": "Malware payload (NanoCore)", "value": "333d68c6bff4c107f9f4b95c51c5471aa56c03469d8d155bd949902ada3af5fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706547307, "uuid": "cf984fd6-acc6-4bac-b6aa-1c60a31ccdce", "comment": "Malware payload (NanoCore)", "value": "e49522f2a57de43ce0eb06251721e93611ac363d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706547307, "uuid": "c9b21ae2-59ad-4c0a-81e9-a499c718ab12", "comment": "Malware payload (NanoCore)", "value": "d804c70684d6ca2aab4c263c3c21378c95ae7cc7ece75fd33fe46610c63b5bff8a567ca3e267db1b262b55988b70d159", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706547307, "uuid": "12774d53-2c65-49cb-9afc-dcdc12acd647", "value": "T1FA451202BAD1A8B2D073083259646B21A97D7D302FB1CEDF57D0592DDEA16C1DB31BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706547307, "uuid": "7d58dd5b-892e-4d56-a003-61050c7b3042", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706547307, "uuid": "c17a3e6c-719c-4483-92f5-b76e1eea2667", "value": "24576:UTbBv5rUh+5Vq7VBflWVBGa6mXcqIAXiDFWmhHpah:mB1nq9WqLAXicQHgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706547307, "uuid": "8ec9d065-3153-4703-ae86-9d04a04ddbfe", "value": 1164285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706547307, "uuid": "3630a086-2637-4266-9097-01114310b29b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706547307, "uuid": "2631d034-f36d-42ad-b024-ee7b0a2b4d5d", "value": "D0C61FB5FB2118A060B04E5FA0898A6F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29907726-bede-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706557188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557188, "uuid": "7a5888fb-0bd9-4d56-94ff-0253ca484f88", "comment": "Malware payload", "value": "80b218edcae732d98c18968030cec1b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557188, "uuid": "f4cbe8ab-e8cf-4680-a5dd-67315e19a171", "comment": "Malware payload", "value": "33e4906fe17ea8da6778ecab490931d0d587cdd80502fddb924f35a515d20e0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557188, "uuid": "4fc17454-a48b-461c-bd40-99ebd218bfa9", "comment": "Malware payload", "value": "c8081904f9ff98cd8623cce4e69038cd1bccefcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557188, "uuid": "4da62bec-fbe2-4dbc-ac75-60afdcabb8d4", "comment": "Malware payload", "value": "236b3d7ab18e5deecbebbfe132f6a13a642de09296ef3826d6309ecffedbaaf9ed1076e97b17c423d3420eb8bd244d34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706557188, "uuid": "eedb8906-51ea-407b-8288-8678bba94243", "value": "T18CE7338AF517946BE81397F3AE7D4BE160C93BD2A340DB5727E8CBE68940F4050127AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706557188, "uuid": "f2c99619-2010-4eb2-9d53-add4e746ac9b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706557188, "uuid": "26a2b7d7-3c6a-4197-89a0-3b6d21ac353a", "value": "1572864:Sm6McLyM5bnEHPW2nuEeXd/gfmDSBMc/aeX3Rfl2C60E8k:R6M3MEHPWZQmDSBMc/aexfl2C60E8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706557188, "uuid": "ea52ab46-004b-44e7-a407-c38c3d673c3d", "value": 65852734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706557188, "uuid": "f2826c56-c17c-41ed-ba0f-a2493f4dc73a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706557188, "uuid": "6c534828-df34-46d5-97dc-fc799e6c8d5e", "value": "UnityLibraryManager.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fdc482-be78-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706513533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513533, "uuid": "d1a25e6e-49d6-4a66-b590-a687654256df", "comment": "Malware payload", "value": "ee00c27a06ec5479a4cad15ce7088144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513533, "uuid": "cbc6dad9-b91d-454e-8676-1e842246ec8e", "comment": "Malware payload", "value": "33fa311f9b6ded8ab602ad2a2a95f2a11214b2b9c1d191caca3dbfe1224076c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513533, "uuid": "1701e77e-f5a4-45f1-8658-8d42ed0ac3d0", "comment": "Malware payload", "value": "30e84ae1c6285a3d310a9050b7f8d3d346721b16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513533, "uuid": "5a31cbd5-9599-455c-ba85-2c7d36c5a3e7", "comment": "Malware payload", "value": "b105e92778d22a5e037a94ffdb1207bb7bc6974f7e6cde666f703cb424a773c984dc7e1cc875720476af5fa35c247dbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513533, "uuid": "3efac9f4-1885-4b78-aa9b-a669893c0606", "value": "T16907333FF228263EC56A1B7644B3929089FB7B61752A8C1E47F0090DCF665711F3B629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513533, "uuid": "327b4d2f-3c45-428a-9d4f-820b4fa91f97", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513533, "uuid": "dd6f9766-ce11-4607-b101-8e1e14c52771", "value": "393216:jhuunLRW/fkCoEwz3amquQHnGSpzMLsbX:jYunLQ/sCoEoamfQHJpms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706513533, "uuid": "d3ae813b-1db2-49fb-9328-73be7f5d1407", "value": 17594272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706513533, "uuid": "a1461064-6982-46d3-85c1-d858b5017ae6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513533, "uuid": "9ba0a526-f2c5-439a-8b0e-1f876cd23ea1", "value": "SecuriteInfo.com.FileRepPup.28413.13376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e78d86-be72-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1706510821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706510821, "uuid": "c858a91e-74f7-4152-9723-ab865bb6df71", "comment": "Malware payload (PureLogStealer)", "value": "161fc2dd3efc7cd6cbf0a33e7b636b2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706510821, "uuid": "c650471c-3726-4c76-9677-872908d0416d", "comment": "Malware payload (PureLogStealer)", "value": "3522c4380138f81dce5085c66b158b6069238c6737ece7be4b433c29fcfcc39b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706510821, "uuid": "e3271063-b632-4c55-8626-cc7a0e7dd8ef", "comment": "Malware payload (PureLogStealer)", "value": "56ed855331633a8cd4ac8426fb10a39acc7455fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706510821, "uuid": "3265bfee-ebbd-496a-9180-9b1a9076576e", "comment": "Malware payload (PureLogStealer)", "value": "70351b8ad9fa72ce390f0799703e4781d1504435eef15862493b0c0875e770d826c502e6a879e592f60d4386bfee5895", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706510821, "uuid": "f5c30a0e-019d-429b-9a55-e2e1ba490d57", "value": "T14E142A13B79AD9E2C2E95375D9E394201370D89267A3E7093C4E73DA4243BEBAD0174B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706510821, "uuid": "95076464-0776-4bb1-b42c-cb7fe5bbe37a", "value": "3072:YzokBhUM1nbsyPnRNlGROIdsJoIEKIrmUUVO8bPr+FH+70oGanV2:YzokLUMlFMPmoIEKblCFHY0oGg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706510821, "uuid": "85498f6c-a86f-4913-96fb-99f781a75ecf", "value": 202912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706510821, "uuid": "d6ec4a32-47d6-4d74-ad05-cead55ad0203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706510821, "uuid": "3395aaed-1e87-48ed-ac6a-8ac0c960b78f", "value": "CopyofSwift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22db9df-be9c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706529070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706529070, "uuid": "3d310568-ab22-4b0c-ad15-74ca23bea577", "comment": "Malware payload (AgentTesla)", "value": "9aa18dfd88b3500c94e84a7595efac3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706529070, "uuid": "0fffd387-2b9a-4fe3-a8c6-9dc1e8fdc8b5", "comment": "Malware payload (AgentTesla)", "value": "355dd906fa6b99dc3cc713e432823b87b4db60faae1d25473539a7d30be59f47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706529070, "uuid": "b9a398e3-78d4-4181-b470-420a6b1a5fa3", "comment": "Malware payload (AgentTesla)", "value": "fc049c8e2444bb06d6f85aa00816592e8b177de6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706529070, "uuid": "4a4d4741-2797-4141-b785-9e6cbd5fa143", "comment": "Malware payload (AgentTesla)", "value": "906a6d0eaf51b272c1af572aadb8b3b80bff69120f192da1fd95a1d009303e819e3d100b3094e6ab90f48fdeb96179db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706529070, "uuid": "8ef38fd3-2ca4-4a06-9ccf-75ce81a59370", "value": "T1B8741210BADE7E2BDA789AF866A7641203F04E127861E5CF6CD628CE0CDDF504653D27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706529070, "uuid": "731773fd-d6fd-4f25-bfba-e85c9827aa50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706529070, "uuid": "5c02b554-70db-4024-802d-cbfb66d616cd", "value": "6144:PGFAZdZGnaGibalvtK2jDfcCMSq6NpAqJq5yGycmwMa:AKZGnaG2a/FnkCfNpAqk55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706529070, "uuid": "e81cd49b-15ce-4709-a281-43dc9b2c5280", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706529070, "uuid": "089eef0c-3599-4c58-be5d-13cc91a4916e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706529070, "uuid": "415bdfd2-fcd4-4b76-ba3d-192ae4926eea", "value": "9aa18dfd88b3500c94e84a7595efac3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b598d3e0-beab-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706535519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535519, "uuid": "dd5e3131-e134-4f1a-bae6-b4df6cb447bc", "comment": "Malware payload (RemcosRAT)", "value": "466e28b83c8b193002d570137d0d9835", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535519, "uuid": "9551124f-8af5-4d0a-9c86-2308cb42b074", "comment": "Malware payload (RemcosRAT)", "value": "35c37cc2c0981efcc8e8519e30bf96385a8ead85f4b1f01236507a00ca1c7d66", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535519, "uuid": "bc6266da-bc3c-40af-bbcc-ddaa45698d56", "comment": "Malware payload (RemcosRAT)", "value": "3701296abdf73a87936d8af48707f32099689c01", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535519, "uuid": "65b3fe53-c975-480d-9f06-103eb633b634", "comment": "Malware payload (RemcosRAT)", "value": "010362eecbfa84cd2d2faa78341a26446107eb426b38d8c77827188ae431949981f08aa8a49aa3d7ef9547a822a3a0ea", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535519, "uuid": "6b9844bc-cde4-4728-a102-1c588026cf4a", "value": "T1AF9423A2F645A7BA67822E19186A697EF9F304774D61C0E0984F5F15D08B2F7CD00D3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535519, "uuid": "c978dc99-b43d-4c2f-8d68-2fae6a036d62", "value": "12288:XQ2d4jqdxJ3pjcCyfvfmPYsBv4EdeUAboDTd7:A2ajq/J5jH+grBILqp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706535519, "uuid": "08023b37-67d8-4902-9933-790f2e3a32c2", "value": 427442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706535519, "uuid": "b10a070f-8d9e-4473-8ed8-103d4382e25f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535519, "uuid": "d5dd9725-4d9a-4086-8d17-2c0afa959daa", "value": "ORDER#4510093083_PO_NEW_MATERIAL_JAN_20242.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "602cbb37-beaf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706537093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537093, "uuid": "8023f337-607e-4312-9b75-56f84ad55baa", "comment": "Malware payload (GuLoader)", "value": "95beead82533c654a3fc4575b4c777e9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537093, "uuid": "9a43593a-8702-42a1-ba83-0edb78cfe646", "comment": "Malware payload (GuLoader)", "value": "35eec5e5dda33e2c7ea807619a3813a9e0562dc97fd5038e57eb519d86b5e572", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537093, "uuid": "98dedace-84ab-4976-b7a7-184edb32aea2", "comment": "Malware payload (GuLoader)", "value": "8569c820d6ec3cb57482a417ab31be76bc4e70ec", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537093, "uuid": "5c59d8a7-d49a-4b36-971a-3297d10b9181", "comment": "Malware payload (GuLoader)", "value": "e921e6b1d5cf6ddf9cc7be440be0236644e18b2ae466df7c6d78ad7c4a3cb78616a22c1a24b97e890d84ef970a28d79f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537093, "uuid": "180d5917-e30f-40db-b1cf-b0d5bec0c37b", "value": "T168D46B31B79BACA6C4190CF2515E03EF04D0E7AF165457C3E391ADAB7F2A581862B8D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537093, "uuid": "6a40ebcc-3f15-4490-886c-7ee54eae241f", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537093, "uuid": "4f64c20e-c8eb-47cb-9c0d-5bebfe8cd5d2", "value": "12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLCLDZZ:AQy6ONsqLCLNhTr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537093, "uuid": "ca20263b-3b5c-4ad4-9fd5-93c358b20c84", "value": 644080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537093, "uuid": "e242680a-de6e-4506-a7bb-b5f3ee07ca59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537093, "uuid": "dce460e5-fccc-459f-8f1e-5bac70a7514d", "value": "DHL AWB #32536063331.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e7dc32-be80-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706516913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516913, "uuid": "96590d20-017d-4e64-ad53-a2b71bce4943", "comment": "Malware payload", "value": "6bbe05cd611c00f2028fd3926293d17b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516913, "uuid": "8e44c826-8979-4479-a049-2d8a4476bd7b", "comment": "Malware payload", "value": "364aa99eb17c51abc154bdb82abba55f7a481034261e9449111030d12985fa09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516913, "uuid": "994e4b29-9554-4fdb-9d0d-f2a7afe68caf", "comment": "Malware payload", "value": "1f34b1c9d88e5d8c3debeb14d26b7262e810e25d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516913, "uuid": "e633d1e3-ea9e-44f7-9a59-950a8f719932", "comment": "Malware payload", "value": "ed8b50a34cb7e8771b282c716a100a5b16273d84f6215116a6ff0e9a96f320f369e91b1351580d46ce25c4cf512deb18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516913, "uuid": "a3d3ae26-d398-4087-a1a7-e5ae49e67a22", "value": "T16AB58B42E7B581D1D4B7D53842A2B717B9B1B8188331A7DB93945B6A5F233E09E3F380", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516913, "uuid": "e67361f2-214f-4ed7-a55c-16b6867f61e7", "value": "8595956baaae468b03bee6e9f24e3b1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516913, "uuid": "7b6014c2-129b-4678-8d5e-81124fe883fb", "value": "24576:WqdOsTyYgDnTSTbJSByTvNOtGv8I45XmilZeTFaiMZyCV1ED/T2hn23:WiOsTyYgnfBy8V5XbehZz7Mnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706516913, "uuid": "20dd4d67-612a-4aca-b1f8-c8801aa6ebda", "value": 2381672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706516913, "uuid": "3557beda-1a21-4bb5-aad9-a8efe48b0b1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516913, "uuid": "0afae266-ec25-4867-99de-7ef1bfccb912", "value": "SecuriteInfo.com.Win64.MalwareX-gen.32116.16432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc02b63-beaf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (STRRAT)", "timestamp": 1706537114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537114, "uuid": "a0470ed5-debd-4bf7-a4a3-72a61e45a88d", "comment": "Malware payload (STRRAT)", "value": "b392a451dff067e48252f7c428ff898d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537114, "uuid": "32cbda2c-e9cc-4582-a745-dcd14e59fea7", "comment": "Malware payload (STRRAT)", "value": "36553d3db326bfc9e01e4df5ca4246eb551f79600a6f56f8450928848c34ec39", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537114, "uuid": "877b5b51-7a21-4991-8fbb-ebe02b298ede", "comment": "Malware payload (STRRAT)", "value": "859e61b54b3172932dcf041d05bcba15a8ee020d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537114, "uuid": "2726fb3a-b277-4a6c-a03a-72fa39878cc5", "comment": "Malware payload (STRRAT)", "value": "fddad98611afb334eb40eae1a19b980c1fc9a38e12dd4996d5be697e3bc0a8e3e740c54c3194a4ee3b414883cad56e26", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537114, "uuid": "bd452112-df12-4052-b203-d789a20e064a", "value": "T13CC3E02F798E85B4E44B90324051A97ABB0C82C8F54675DF69FC09A91E30E6D1F42FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537114, "uuid": "dcd6c2bc-08d0-415a-b7e5-369312075531", "value": "3072:77rWrx8/1/KjK4Yr7bd4CuZbe1/9Mrlvp93A04KJS9:Xr2W1/sKTne6KrJpXS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537114, "uuid": "252f4e63-7be9-47ab-944c-504442c61148", "value": 129076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537114, "uuid": "342255e5-5067-4e9a-b258-8fe2f2b92132", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537114, "uuid": "f395e40a-b99a-4247-ab7e-9f8dfbe8d8b3", "value": "ORDER # NDP243002.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c487655-beae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706536657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536657, "uuid": "8c80e732-b7ef-46c3-a542-78a9dc852c3f", "comment": "Malware payload (Formbook)", "value": "bdd1ef602f41ff2513bd2ffb948a6cc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536657, "uuid": "f3304c16-b3cc-422c-9a05-0b596eb99967", "comment": "Malware payload (Formbook)", "value": "36b97c1bf2b8369f8f47b717eb7797a4b6c1ae94abb0e3768be6be1f8928041f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536657, "uuid": "03085656-845d-41ed-8466-9681e618fe1d", "comment": "Malware payload (Formbook)", "value": "aa2c782ad8b71cd4fdf8474d43ef4724ea96cc3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536657, "uuid": "abee82c6-c72b-4dce-ad5a-a368c9f8b344", "comment": "Malware payload (Formbook)", "value": "4fb703fd540ea3c35eafe727fe52bf03a35868648c001c763385b99c161b8809ce250780d5ed69bd5df912a1780fa3fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536657, "uuid": "eb6535ae-2ee4-4a20-97c4-235998e86a14", "value": "T19C94F1E2B247CC9EE81707F20D7A967140AA5E5C8465940F21E93F3B7373393B892D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536657, "uuid": "67258cdf-cf6e-40b1-b666-31d724b2ff2a", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536657, "uuid": "396756ca-6727-46c1-8349-1994cc5c3e4d", "value": "6144:wBlL/HEAmg+3OesbTsQop6QeX9mrKDD2QPiHMAcCmA/q6IGuvIsRo0xPEjaV1Zn:ClEAmD3O0QXrDP2iwyTwsW0F5V1Zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536657, "uuid": "8dbf5bbf-a18a-40f3-baf1-d29f2d423ccf", "value": 439856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536657, "uuid": "ed14c68a-6654-4aef-bd8e-ce49a5450420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536657, "uuid": "f1aa45c4-85e2-4739-8ff3-c8f4be265117", "value": "4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740f77cb-be3e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706488593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706488593, "uuid": "1e877818-5b25-42e7-b010-68428ae5e6ff", "comment": "Malware payload", "value": "f9a138fbf23f1a4f111e799106624da4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706488593, "uuid": "81639257-0a61-4450-ab45-327e805915e8", "comment": "Malware payload", "value": "37a26093fcd0866365048f98a5f1c1ded9cad94fe23b7ef6a1ffe3ab59d392b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706488593, "uuid": "ca25ddc9-80f4-4bd1-81b9-9966a08a86de", "comment": "Malware payload", "value": "04c3e9edb9d991e973bb46c4ac570d16e3f3e264", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706488593, "uuid": "f0f55cd4-8218-45b8-952f-998db4d11573", "comment": "Malware payload", "value": "c82d9fe413eb0daca73ae810caae559132cf4b85af26fe452a600fee61a087b36699a181c8d8b4077d13efd6f1edd018", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706488593, "uuid": "bbbf87fa-e2bb-49dd-b82e-1565632d9bdd", "value": "T122325E43BBD10D61EFF60AB42837A941CA7EBE240E38CB1657D484290DBDA50D91476F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706488593, "uuid": "de5451e3-422c-4044-b663-6084ef540381", "value": "92e4cfde12927b14e42394c9277f7920", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706488593, "uuid": "aecf31e5-75b4-49ae-90d0-9e3199f2180e", "value": "192:4RWNztVzQ3YZA0Xnam9ezsdrJdsKRnsn2FzSFXeCE8/5RqO+Lu5pz68VSNoG4CNc:qW5z3q0Xh9ezCrJdsKRns2FOF/lxRqbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706488593, "uuid": "000f2969-1a94-4d86-aaa9-494f7a8cc129", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706488593, "uuid": "6bc4da0d-1271-488f-af97-8249edfcf287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706488593, "uuid": "9c7093bf-ba9f-485a-8394-53e4388f1907", "value": "SecuriteInfo.com.W32.SecRisk-ProcessPatcher-Sml-.11245.2521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23438a9-bef5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706567376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567376, "uuid": "9aa74bf7-50a1-40ff-9a2e-5060a134ed08", "comment": "Malware payload (Mirai)", "value": "7c56ed58039057925047424654793dfd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567376, "uuid": "1587af0f-bbfc-4f6e-88a0-50fb5d0dc392", "comment": "Malware payload (Mirai)", "value": "39f4985f07d47a8d1636c16b19f1da08bee703b3b93528e3e25874a4b26084f4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567376, "uuid": "c99fbe9c-f41a-4cb7-9f1b-54a624d4ee52", "comment": "Malware payload (Mirai)", "value": "a42c79a979bfeb6db3bc10217921b11bc3754caf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567376, "uuid": "ed6dc13d-4a8f-4528-b46f-b7d5c401a400", "comment": "Malware payload (Mirai)", "value": "c11d068f0df818d8ba9c14ab2cadad07d68dd3b3ffaca31a8bb0f0de665df55fa7df56ef33b847272d8fa3254e734bff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567376, "uuid": "67dcd3fd-17b3-43b5-8b9e-c1a15a87bfc0", "value": "T1E104A75E6E228F7EF668873147B74E24976C23D627E1D644E1ACC2105F2029E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567376, "uuid": "742786a1-a85b-4b09-ab69-30aaa0589227", "value": "3072:C9HH+Gt6oIPdjtXr5w1nx2BVeHoGP7HJW0v6uVa:C9HHTtLIFRXKYIIGrJvvPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706567376, "uuid": "cffd9c84-1c82-4b13-9f25-f71595aea9c0", "value": 177916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706567376, "uuid": "9ef12200-a2c6-45ee-adb6-0574f5cc1677", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567376, "uuid": "ae83425e-7a0f-4a0d-bc33-f61388f96507", "value": "most-mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d995d883-be6b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706508091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508091, "uuid": "a0c87f0e-1270-4e77-99ee-7b85638d0d46", "comment": "Malware payload (Mirai)", "value": "75cab5a9c644eaae1b53794f5bef0e01", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508091, "uuid": "1a620f34-bbcf-41cd-8299-1b03f660fb1d", "comment": "Malware payload (Mirai)", "value": "3a4bba3da6bc15f936391363febbfd79c031e72c6e22c53e551f63675e54c08d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508091, "uuid": "3faad6be-b993-4ba8-bd63-e4e89a726615", "comment": "Malware payload (Mirai)", "value": "237f359b3e7f907b137ba7c25eb6e1757894edcf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508091, "uuid": "8ebe1371-07e3-436e-9028-9b999f73d96f", "comment": "Malware payload (Mirai)", "value": "7ca01496968bde318bfff5f06e40be6cc9ad0612487cf2daeb877a0a182f6be8972abd0eed997550ea0048ce90c00a87", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508091, "uuid": "8925130d-0f9b-4c82-bfdf-40c67a6415de", "value": "T1D6142A45EA414B13C0D627BAF6DF42463333AB5493EB73069928AFB43F8679E4E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508091, "uuid": "0a154839-38e1-40f7-80fd-d75750737445", "value": "3072:xeWu5FHPG90erNPyIDaN++9/fPMEVds9xGZL+6NoSM/RtBsl:YWUNerVxDaN++9/fU190ZLraSM/R+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706508091, "uuid": "bd19d00e-141a-4928-82fd-531a9f6aa897", "value": 196698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706508091, "uuid": "c30fdfc0-b8f5-4363-b4d2-801e14acd01f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508091, "uuid": "f579258c-a996-4946-9733-fa5a06447f31", "value": "huhu.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d87f064-be99-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1706527532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527532, "uuid": "b3163df1-1200-4e93-8b76-a6eb1efa7f16", "comment": "Malware payload (SnakeKeylogger)", "value": "dd3e652890c62f2c7fd322afdc0c56c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527532, "uuid": "ad6728eb-5495-401a-8ec1-0add92fbab3b", "comment": "Malware payload (SnakeKeylogger)", "value": "3c455d7a0d61e4c11af1e4a6822bcc9c9f229bfe3e5c99e98977451c05f22ff2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527532, "uuid": "fb6ad12b-4540-41ea-b313-5934ec648cb2", "comment": "Malware payload (SnakeKeylogger)", "value": "e1461c2b260a76b1c1252c676a308891ded74363", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527532, "uuid": "1360ad2b-f099-4714-b16d-3fdd2e6493c6", "comment": "Malware payload (SnakeKeylogger)", "value": "da8b0080b9f7618989805d4af6df3cb44276e155f36074dfc9dc570dd3c769549d15013feb0149b317cc7111fc7bec66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527532, "uuid": "4d5bf859-1e6b-4c2f-b812-62045e256c9a", "value": "T158D4121636B8AB12C9BE47FF64B026041FF175266942E39E9E9074EE7B313D087506E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527532, "uuid": "5798f6be-c030-4400-ae9b-ffa0b8d132ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527532, "uuid": "03c5f392-61a2-45ce-8295-ba25ce6d9484", "value": "12288:Fa19QIoIFFHgeg/c9Zb7UcjyR5kRBNaQnsGh/ZPzh9hKcU3Z9HKvasD+0:wQIXFxHUtekM/ZPzCsD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706527532, "uuid": "9c222509-cf68-43d6-819a-59e843d3f9dc", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706527532, "uuid": "1bf513d7-c436-4b90-88ef-178138aab941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527532, "uuid": "d9870d1b-fc7c-44a3-a214-076f2bba86ea", "value": "Ziraat Bankas\u0131 Swift Mesaj\u0131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4b3aa4-be71-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1706510619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706510619, "uuid": "86338370-a1df-4718-ba33-5af195ec9bdd", "comment": "Malware payload (DBatLoader)", "value": "84a42bd16cb952e474b0de5b7a0bb386", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706510619, "uuid": "903ec006-57d6-4a24-8f50-ba3235af36e2", "comment": "Malware payload (DBatLoader)", "value": "3ec3cc578329e28a13628df7f002992ebe2cbd87f65f0b14739389e0bf07d785", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706510619, "uuid": "1054b50c-636d-44ac-b108-e927aba3ebf5", "comment": "Malware payload (DBatLoader)", "value": "7591ea2dc73ed0a84431ecddaa168b124e00604f", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706510619, "uuid": "ae4a2bd4-ddaa-4be6-acab-d7efd56d4502", "comment": "Malware payload (DBatLoader)", "value": "b4e8719182c3be6c6cf1a7fea9ec462e911499ff68802e94c255a521a124b94522c426e54e1fbf8bc87b6e900f1aed0b", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706510619, "uuid": "95efe09b-77b9-4046-8bb2-1aefb684f23d", "value": "T1C59502FBE2040476C4364536C64AF36F9891BE693F2930425AFE3CCC75BA647F46A126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706510619, "uuid": "d5d3008b-472a-4ebe-a59c-9b7d7d84356e", "value": "5f7fe181812d5942ca24024d00d9c41d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706510619, "uuid": "1fccaf94-be4b-4566-815a-20db0f4aa43d", "value": "49152:FIOAjnxf2hp4XLkrhKOekUvUeudcvHLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL0:FI92hp4XQrhhekUvfud8LLLLLLLLLLL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706510619, "uuid": "8e774052-a516-48d5-9192-cfd72ae6ab0b", "value": 1879040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706510619, "uuid": "2a9cccc4-1795-4a78-9001-6072bbc91c95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706510619, "uuid": "ba6538fa-4f80-44a8-b374-9ef46c4ad3e6", "value": "FHJ-098760000800.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a5f7ac-be6b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706508088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508088, "uuid": "0e8cd819-1f5e-435e-aa04-54ab828d2c0f", "comment": "Malware payload (Mirai)", "value": "75776d707e0f9458d2a3f9083445eb99", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508088, "uuid": "24cf11dc-80fc-4e44-95dd-be2d581560b0", "comment": "Malware payload (Mirai)", "value": "3eda4f84fbed0859138e0c2de60af1e9997f8d7f687d999baa205d511a3558f3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508088, "uuid": "2fede75c-1910-4600-b29f-660f3c0ebe37", "comment": "Malware payload (Mirai)", "value": "337f5cc148850832a6b868fb8b1f2d1618bed86b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508088, "uuid": "5c1c1719-412a-4fe6-9b2a-3d865a8126d4", "comment": "Malware payload (Mirai)", "value": "c5c358073fa29a56529cf3ec0f0c9c9b6fadd5ca358b7f65a575f64b86db6d5269fd51e7c9b938eb3d79c21586c1eaf3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508088, "uuid": "6bd843eb-2c7f-4da6-bb96-043ac5d5a5e5", "value": "T11414C61AAF610FFBDCABCD3706E90B0129CCA54722A53B363674D528F54A54B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508088, "uuid": "340097a9-6b83-4437-a708-906cffffb5b1", "value": "3072:JzJuV7T25TpF2umCgKZoHSIkksz1bJyxzj:JcVOTpFUCgK+HS/hRYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706508088, "uuid": "0aa67378-3b43-40db-9af5-7879c834db82", "value": 194424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706508088, "uuid": "ca39f011-9ec2-4dec-9728-a06b5adc3ea0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508088, "uuid": "4b4fb8cc-02a7-4f03-8e3b-82c2e5cd1a57", "value": "huhu.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6816df40-beaf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706537106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537106, "uuid": "8ddfcc73-731c-46af-b1e3-0a31a2fd736f", "comment": "Malware payload (AgentTesla)", "value": "cfe13351c193be5c4b121831d6e3287f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537106, "uuid": "5eccf5fb-1351-403d-be44-96952086b105", "comment": "Malware payload (AgentTesla)", "value": "3ee6eac3f79fe9a20977759a92319e10b0f3833b081bd72215e623f8b9424443", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537106, "uuid": "d0361be0-7247-4433-8e2c-e42376867e31", "comment": "Malware payload (AgentTesla)", "value": "51392ebe4ef5bad690d8fe0b8369fa1dc2099703", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537106, "uuid": "0809632c-85e8-4882-ae6d-dd05b716275f", "comment": "Malware payload (AgentTesla)", "value": "0f14bd6214aa1e99009ed3904f7c6f5d0b5cfd3323729964c12aac2d1757faa13c6eb494d15ebadd0deb3cd3596ba469", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537106, "uuid": "2425a11b-641c-48c8-8a39-ca726cc3109f", "value": "T170F4121232BC8B13D8BAD7FA916021465FF8751B6222F3C91F9531EA2D733D086547AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537106, "uuid": "20ad5c7f-3343-4f0d-b666-571e38496f31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537106, "uuid": "5f758a44-00b0-449a-8bf1-0599359b86b0", "value": "12288:Xa1eIoIFFHgeg/cAniF5tWhjq1TAoN6hHYfNAzLs5efe6cpxbEo9hQOjnQiUcjOv:jIXFxtnt4qhAoN6BuAs0e6cpxbd9hDQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537106, "uuid": "d7bbc205-e5f4-44fc-9969-bb888023dfd3", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537106, "uuid": "919164fe-4627-4e09-8f83-dcd5ad0b2665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537106, "uuid": "8799766a-95d8-4b1a-956c-7ba18ea9baa7", "value": "DHL Express__21148791029.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b687fdf-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706520227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520227, "uuid": "944d265a-39cf-4478-b8e5-3ef30315555b", "comment": "Malware payload", "value": "a2452f482b3198bef4e337d400ebf6ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520227, "uuid": "d1a09008-8af4-4715-9d4f-a83b219ea2e8", "comment": "Malware payload", "value": "419d52d4a63cc59eb99c38f94128f78c2d98b9dfd39946f6d6185dab8d87478d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520227, "uuid": "7cca3038-035d-4c6e-933d-c4da1d384c66", "comment": "Malware payload", "value": "6c8c7e31489d278aa39e9370c71847b3498252ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520227, "uuid": "dae14dbe-8545-48d4-a3a6-406497436598", "comment": "Malware payload", "value": "8edee7b091e4c290f0ac4d609722c76f09a13635c05f8766768af4b2455d2e1d32fd5772c2c6bd7820e92f6e8c71021b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520227, "uuid": "75600e82-1ef7-4020-a647-8edb808d698f", "value": "T17684B531B79BAC96C4290CF2515E03EF04D0E7AF165457C3E391ADAB7F2A581862B8D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520227, "uuid": "47493a3f-08a2-4c98-9ae2-48cc441302fd", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520227, "uuid": "5ba5e1a1-b3f1-4ea9-9c63-e880326fd5fe", "value": "12288:lkonLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVL:fQy6ONsqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520227, "uuid": "ad09090a-4871-4610-848d-145fc7f0445f", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520227, "uuid": "95b808f2-b4c0-4f7b-b7a7-04c32a9df7c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520227, "uuid": "625b0e77-331c-4919-82c0-cf58367a0531", "value": "419d52d4a63cc59eb99c38f94128f78c2d98b9dfd39946f6d6185dab8d87478d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a14d319-be67-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706506052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706506052, "uuid": "310bb37f-e494-4ebc-9fce-d4911cb0d22c", "comment": "Malware payload", "value": "c5ec3a0dc0f4975e0d8ab0143a18b3c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706506052, "uuid": "29968798-11f9-43a8-82e1-8cb32eb873a1", "comment": "Malware payload", "value": "4225acb870330c279f3f948c7c947158e9677cb4dfc883b8f0df2721413d1b61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706506052, "uuid": "08aad7c4-68c1-4648-a64a-2fa9d2e9889e", "comment": "Malware payload", "value": "643490adcb20ae6c7cf9b8a15513584ef0d2f19d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706506052, "uuid": "752fcf4b-7947-424b-883e-2072376402e6", "comment": "Malware payload", "value": "efce498328197168f17106f1baa2472c7c9224706197ee7555289402b317466bb7c85e06d311db85c29d60a968556840", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706506052, "uuid": "29a681e5-f3d5-42ec-a9d4-ba1726addc8d", "value": "T102D65C13B288902BD5771E3B4927CAD4683AB7602E15EC5B3BB40F4C6F79B817926347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706506052, "uuid": "954ce511-532a-4850-a784-926772047cfc", "value": "2c05b528f9b6a0e28f4ba4b3aaf2b678", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706506052, "uuid": "931af85c-b451-46a2-970a-1a15ea740626", "value": "393216:hXgvgMiAae7FRlee9lgpJpR2ipDBQNi1/:9gjR5gpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706506052, "uuid": "330bcb48-ce22-4f5a-8c6a-ef7c10113182", "value": 12695552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706506052, "uuid": "bb65655c-fadb-4e23-94f0-1624dd456465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706506052, "uuid": "fcd74bfe-c914-4757-a9a4-c57a090016a5", "value": "SecuriteInfo.com.Win32.SpywareX-gen.16835.10823", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5926b9c-beab-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706535599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535599, "uuid": "2b0ad685-871c-44ee-ab0c-33e3065b43e8", "comment": "Malware payload", "value": "a330a78c2694aff16dc3e9ea5919a0cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535599, "uuid": "121dd49b-f5eb-42f8-aa7d-3abd0f72b592", "comment": "Malware payload", "value": "438611dd97562dca9d43b8de1f1bf4f91d5c2275da065251c021b23517494c65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535599, "uuid": "5f82c8e6-7318-4a66-beda-c56b87a31f2b", "comment": "Malware payload", "value": "b41b88e484b5beecb3be26a8845b1e8e90d8d3c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535599, "uuid": "e6264e5d-990b-466e-a09f-bc7639a90cad", "comment": "Malware payload", "value": "f455d34666bca8e4589aa0a616fc20fa8d5ab2d39abfb5393fc592c40fca115686f053f741214aed2ec78b91aa754024", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535599, "uuid": "e9bf686d-40c7-44cf-9e17-eb18fbe37d10", "value": "T12475238BC4E39F67C19823B3C8EF1F7C33184E26900447E79995F8227AE27096D5A95D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535599, "uuid": "7da8e9a2-bdf2-483f-babc-b18ed8a21f22", "value": "24576:x1Wne28JBpiYW4NfJTALJQU1DPzu2IwRHsZj3esG:JntHXNfyLJQU1qqqj3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706535599, "uuid": "664b54f2-c139-488c-acc1-185ff755618f", "value": 1560576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706535599, "uuid": "d57bedd4-65d0-4d0b-9686-d6e8799ebcb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535599, "uuid": "85641576-4666-43be-a5b4-0cd516089281", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.16014.8444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6da3a38-be96-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kaiji)", "timestamp": 1706526528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526528, "uuid": "7f7833d1-018c-4dae-8240-c26e61b90098", "comment": "Malware payload (Kaiji)", "value": "13d8e1613319df144b6c984a44897120", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526528, "uuid": "53883f49-c304-4321-9352-bae213123de5", "comment": "Malware payload (Kaiji)", "value": "4411f3a96d48a7530c58e8ee3aadd0ada30a9f309e5f6521330fc124027c3b86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526528, "uuid": "6867cf7d-6ec3-475d-97dd-31e4c89bc2ba", "comment": "Malware payload (Kaiji)", "value": "fb751f69340314f5f980a7824c5b802985c0f1b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526528, "uuid": "05f42be7-eb66-4aca-8766-a829499c1d27", "comment": "Malware payload (Kaiji)", "value": "5e743acbcff1bb8175332734d437384983f92fc015a298175be70cd00e880a8f2acf8a49c4a7da3242de2ee9a76e1a77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706526528, "uuid": "d1c5afdd-18bf-4b31-a0ce-3d37991f01ad", "value": "T180362B87B8924682C0E4367ABDBD81D533731EB9AB9B12676D04FE3C3ABE1950D35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706526528, "uuid": "60b0bcb2-d5e9-4815-9190-cba5a900f5b4", "value": "24576:NBevLbv7wrmhhgVyOPL7K7iUWeVdSAavqEGlFurQDmXdHnnm2bcyY7YBKVKVmo91:HrrlTmA7koH9CiKey6ahG3InkTAsVI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706526528, "uuid": "3c75109d-b165-401d-9994-fdf184d8390f", "value": 5308416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706526528, "uuid": "d683fa83-560f-4739-9c69-d399d2408de0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706526528, "uuid": "e0631f5f-fea7-44c7-973d-74971e95d04a", "value": "13d8e1613319df144b6c984a44897120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35ccb5f-be98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1706527435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527435, "uuid": "17b365ac-b416-4fc6-8161-4944341f2d1b", "comment": "Malware payload (AZORult)", "value": "5891e8cf649c7edf3ec0e3522edd6125", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527435, "uuid": "69a278ad-db37-41bf-a2bc-b66244a10fa1", "comment": "Malware payload (AZORult)", "value": "44869d2f000551b66c624970e7c0e735d9d79f65427e91d432ffb2794f1a5f81", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527435, "uuid": "02fa90e9-ff1d-43d7-bb6a-d0bcf570b51c", "comment": "Malware payload (AZORult)", "value": "773d655cb025729c6de05bad4ab96ea8ff547ad5", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527435, "uuid": "4011a385-c667-4259-a367-b3f831f59f0d", "comment": "Malware payload (AZORult)", "value": "805153c4662417237a1fbc4cb9b44e522414b508f00f690ed98a842fdc30143e985cef72293a21903e5450ef8dcf3fde", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527435, "uuid": "45ca35c6-bdf9-4021-a5f5-b2d65dec9189", "value": "T1D4D47C31B79BACA6C4290CF2515E03EF04D0E7AF165457C3E391ADAB7F2A581852B8D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527435, "uuid": "89dfe90f-8838-401c-83a6-8f807bd002c9", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527435, "uuid": "d11f5ee3-d79b-4225-ae62-55334d746c2e", "value": "12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLiDbsf:AQy6ONsqLiDbchn5Trp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706527435, "uuid": "eaed3609-bd2a-4670-90fe-78591924d4c9", "value": 637796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706527435, "uuid": "bc095b43-1be3-4c3d-8290-18f5818f6bb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527435, "uuid": "c8c7e9c2-643e-4f15-98e6-c0e5774c5fd7", "value": "Ziraat Bankasi Swift Mesaji.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a41fb80-beaf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706537083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537083, "uuid": "94aa2ca1-d413-492c-90ae-543e1b6d0e2f", "comment": "Malware payload (Formbook)", "value": "190e27e773f6dcde77a395fc954415f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537083, "uuid": "c894b629-d6d7-4be4-ab24-41292b7ea327", "comment": "Malware payload (Formbook)", "value": "4497dccad8dd71580d730e2443277a37adeff3c32c3536d02dea3aed09fb3a76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537083, "uuid": "f111a30e-e4ab-4135-88cc-61664013ac40", "comment": "Malware payload (Formbook)", "value": "1528d5dc126c55e0fddf8fd4bf651775943a2aac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537083, "uuid": "35474497-f071-47ed-87d1-8467c162d45d", "comment": "Malware payload (Formbook)", "value": "9a468541da4965e405808ab4b2465f40349d1ed7dfdeb331038ca580278ad7544098c86697360c802582270f88d014c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537083, "uuid": "953dee3a-361d-4e90-be9c-ddb226352bab", "value": "T18BF4120133FCAB0ADEB797F52A50906053B5361B39A7E35D5DC6A0CE1932F8046A1F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537083, "uuid": "eeae783a-5766-4a97-b151-7ac083d4372e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537083, "uuid": "f52e3da7-6250-45be-9736-612f90950f82", "value": "12288:7AoIFFHgeg/cZ38R+ZUk0Jp2hy7n6OWwJzaw7F4nl0/K6RC+mtnPI8AHDqqkRnn0:7AXFxZMRzkqM9+mpl0/DY+mFINDkRw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537083, "uuid": "deb27232-32e0-46c4-af15-7cb1f1cc492f", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537083, "uuid": "36308843-8fc0-4cbb-b1f9-558ef5a77d59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537083, "uuid": "96d661dc-eef7-4421-a8c1-15fe0c42cd00", "value": "MEPA\u015e E-Ar\u015fiv Fatura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26dfb551-bed4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1706552888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552888, "uuid": "1d707bd6-8851-4d66-8366-9ace52de983d", "comment": "Malware payload (Stealc)", "value": "d48e3a507c5bd1b62834f7f0439a47e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552888, "uuid": "a5e4fe97-4562-4628-8d1a-8aaeb159ab30", "comment": "Malware payload (Stealc)", "value": "45161dec34555043f0ee1e39fe34f7a8b1608c883216add47fe8bb5c82c9c246", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552888, "uuid": "5f16762e-f3b7-4c3d-92a3-60e2736549f7", "comment": "Malware payload (Stealc)", "value": "ac8be3bafb530cc218d8ef51933226620fea4ae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552888, "uuid": "fcc41bba-6746-4787-a08f-64f6668fd844", "comment": "Malware payload (Stealc)", "value": "a54e1b6e7f567f7ba340941978cce1b64ab555c66544132ee9499f457f0eb18d7a4cb681fe16f4ec9058b2db80374bbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552888, "uuid": "14a30fee-0234-40ef-99f8-5df2be1f19a5", "value": "T1C1B4CF10B6E1C035E2BB553D4E24F7A40A3FB8A1A538D58F3AD51A7D1E646C08721BEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552888, "uuid": "14b70570-5b6c-4899-aafa-ae86237ab70c", "value": "5ea237ad2870b37476eaf67f17a194fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552888, "uuid": "f86c5a12-98a5-44d0-84d2-6a7434942466", "value": "12288:qlUHLP/DVE9SomH/MDOpxassp86N9kXj43:qYX5+SrHkYaskRzkk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706552888, "uuid": "186c3585-6d24-4412-a59c-7074f0a44d6f", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706552888, "uuid": "c1f68949-975b-4ca9-886c-ce0c5a447848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552888, "uuid": "787ced5a-27b0-49cc-ba96-62e5f55a9204", "value": "SecuriteInfo.com.Win32.PWSX-gen.23950.2214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d245c6e7-be98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706527406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527406, "uuid": "e18cc782-47c4-4c87-8961-743f219cef8d", "comment": "Malware payload (RemcosRAT)", "value": "78c3175f9fc71e4ddf9471cb5e0427d4", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527406, "uuid": "e4922a5b-def8-44c2-8009-a2110f81051f", "comment": "Malware payload (RemcosRAT)", "value": "455081f6fed14906ac4cbd035d37910a2d06776371f064e8dd94700f120ed6fd", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527406, "uuid": "cbff46cc-3f63-4612-8dfa-6aff32602710", "comment": "Malware payload (RemcosRAT)", "value": "129552bd693f24091b6dffdc1177399885e39dc0", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527406, "uuid": "4efb16ea-0f9d-4ad1-b190-72cade0a3ff9", "comment": "Malware payload (RemcosRAT)", "value": "414f009cc0731c57840c6d9a4729629c8a8998e3a4f97e49e213d7b3fa13eb29a0ef34fabb4dc12a1296e06fe7e77fa6", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527406, "uuid": "1118f113-2aad-4120-b76f-b1a78a77114f", "value": "T1383512A2339C9F48D86A4BF92875911003F22E1955A1E30E1DD53EEF37F33922951E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527406, "uuid": "850c4c62-9410-48cd-959a-be1e9cd87d8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527406, "uuid": "38bf78d3-66d4-4528-bef4-79821caa74f2", "value": "24576:pIXFxRp96GfwCajfXfeJ/0jfe1+MXXDWooxg:6FLjFajfXGYfe5H72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706527406, "uuid": "75820c49-c993-48f3-a693-543c7ca62ccd", "value": 1060864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706527406, "uuid": "b70fe458-30b6-4cb3-a3e3-41274486c5bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527406, "uuid": "5cfb6cb8-a677-45a9-8045-8eb1c0e20286", "value": "DHL - OnDemand Doc.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b0468c-be80-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706516914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516914, "uuid": "fb11abbe-2def-47ad-bf51-04a8ab70dddc", "comment": "Malware payload", "value": "4ed719824c33774260c062c9ca930085", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516914, "uuid": "1a26ffd2-c26f-4ae2-92b3-2b4c0e3e9a74", "comment": "Malware payload", "value": "45a611dcaddeb0f06f69f3b63308acfe3adf81574eb6bf502414bf618eac95b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516914, "uuid": "786b8c9a-f4ce-441b-bde6-934a0e7188ee", "comment": "Malware payload", "value": "4f0e1bde50993ca20cf4ee1adffaa3d77ab10b3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516914, "uuid": "6acd4063-60a7-499a-b613-6e166c5ca081", "comment": "Malware payload", "value": "db09be593b7c8fd59981be064f943de2740e28ded38f5665fd56a18839e2cde264bd1275a79588df6c43e8883bac0f92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516914, "uuid": "6133cd09-1572-42d8-82af-5a16579d4346", "value": "T170A523D8D774BE85E3DD087524673A481961CE00F59E0DB322B1317BACBA2CA9B61C5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516914, "uuid": "0827550d-4e53-41d5-8ac7-7a8661e6bc20", "value": "e58379e7506b93e2ab3e7566780faf50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516914, "uuid": "936a4b01-f2bf-45f4-a5d0-108364313994", "value": "49152:zZACqj/ZdpOYfNTj+Il+NIUctf5jxKtcqj/a0DLroIvoT:lACiUYfcIptf1Qcci0X8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706516914, "uuid": "2d9edc74-006a-4538-b2b0-c86fb3321eb3", "value": 2160344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706516914, "uuid": "2b1e2d49-e54d-4026-b259-998f31954422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516914, "uuid": "80a69472-4fc5-42bf-b024-94adb02632d8", "value": "SecuriteInfo.com.W32.uTorrent.A.gen.Eldorado.30680.8608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2961b2-be6e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706509330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509330, "uuid": "701f9f48-a5bd-4172-81b4-10d1ea001a85", "comment": "Malware payload (Mirai)", "value": "121d164f283e4b9161c7dbf442fc2f38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509330, "uuid": "0bffb94e-cc27-4a87-8988-8a63e4167450", "comment": "Malware payload (Mirai)", "value": "45cc81a94e6c024b72da5b70491025f5878df730a7283e376aa5e2e80a4fad71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509330, "uuid": "da15c7f3-b0bf-4486-9e54-dded958a5e02", "comment": "Malware payload (Mirai)", "value": "b041427ef23bd562f7ec0b281939e4310fde0a3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509330, "uuid": "411f0425-949e-430a-986e-37fae97e36e2", "comment": "Malware payload (Mirai)", "value": "f26e1e4843fabb9447347273cd3aab6215d6fb21c62c04df4ad73bc23a9d198be641d978a436eeb22aea0f923734c756", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509330, "uuid": "5ee77a57-9237-440d-a6c4-21be5c6d458c", "value": "T177E33A06B71C0A07D1A32EF03A3F2BD193AF9AC121E4F640655FAB8A92B1D375545ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509330, "uuid": "79d26fbe-66eb-4382-ad7e-f8dc87db418c", "value": "1536:vm3IOqtM6HicdNH+dK01Wv+xpevPRK9QND5X40JrANvAsWhMC+GZ8qPIe4Xm0OA+:vFWN4v+xg3mIX1rbsbXfxQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706509330, "uuid": "7b41b3e6-e677-4f54-ba72-b54757770bc4", "value": 146300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706509330, "uuid": "7a6470c5-2a75-4e4b-a3ee-b65ad8e21aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509330, "uuid": "375d8ba1-75e5-48d3-bc31-bf35125ca8b7", "value": "121d164f283e4b9161c7dbf442fc2f38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db4636d-be5e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706502192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706502192, "uuid": "e7c08c1b-8037-4b60-8a6b-84037578ab89", "comment": "Malware payload (RiseProStealer)", "value": "ac9b17442d02872676d187fdbb8dd90c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706502192, "uuid": "56b070b0-0319-4b43-b19e-44c301578140", "comment": "Malware payload (RiseProStealer)", "value": "4627c39174d9e902993cadc68aaa3a9feb7addabc77277eee6d88cd989b5472f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706502192, "uuid": "d36331a2-c20a-4d3a-9b4b-60ec8c67c559", "comment": "Malware payload (RiseProStealer)", "value": "f279ade6f3455bae76f213403e150798a3e4e298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706502192, "uuid": "a194b3f6-e7e9-4aaa-941d-b85ba8365bdd", "comment": "Malware payload (RiseProStealer)", "value": "b6829405bac7ccee66bd8644d8d39b80fd0b7543e2757579e8eb2d1dc3fad9f58d5bad6ac3ae99b6172edb8042ca830e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706502192, "uuid": "c0f2c45b-952a-4837-a23e-7b0aed0f5baf", "value": "T1CAB533D64C761412F6EF67F4918D020929E7AC03851B2B1E7683F4958BBD7349738E2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706502192, "uuid": "a1715975-83d9-414b-81db-5367dde8d353", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706502192, "uuid": "375da32f-3b7b-48c0-b08b-105cad179030", "value": "49152:kXAhoqT2uiyiyfn518p4KjuspDrNk66j+fKviVKR:kXAVT2uGyApRfk66y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706502192, "uuid": "1686377d-1d81-40ac-b1f0-a20459586801", "value": 2334208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706502192, "uuid": "936c7a47-67d7-4015-8707-0285468ec902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706502192, "uuid": "9ae9e645-6983-4707-94dd-9fd1ed381055", "value": "SecuriteInfo.com.Win32.TrojanX-gen.27404.26840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922c0082-be8a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1706521286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706521286, "uuid": "7455cf8b-7d64-45bd-a7ce-fd9103dad0de", "comment": "Malware payload (Smoke Loader)", "value": "766801c28e2bba5d4587ee22941b6528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706521286, "uuid": "d098c848-1914-4c38-b30a-b13021d69247", "comment": "Malware payload (Smoke Loader)", "value": "4841be428d00d29ab878fda23850d948bc2d12eefb31621c0272e301d95bbc7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706521286, "uuid": "fb7a5350-7aee-4490-94cf-6394c38bc0d2", "comment": "Malware payload (Smoke Loader)", "value": "b718a320f4482e397719552f098a67b883c88b28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706521286, "uuid": "8b9d6c6b-ac5a-48c5-872a-9040e170ac06", "comment": "Malware payload (Smoke Loader)", "value": "80ab724088061df6d85e49690d7c2b274ec428cc26330609915dbee3968d9df31ad19db72d576493fb84f9e53b6f80de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706521286, "uuid": "7471e5c1-5bc5-4647-9d99-991bfdbcf86a", "value": "T1FC748D5037ECC4F1E2B719358935C7A50B3BB8726E31A68F7AD16A3A5E347C1862131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706521286, "uuid": "0c258ef6-81ba-41fc-9239-0e4c7cfaf96e", "value": "cd132b2f89f79b212f0c4061c0a4f036", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706521286, "uuid": "e3433bae-40c1-4f2a-8718-0768780e504b", "value": "6144:Rg0i18FzH1EdOesCdFGSRacbvJNLW9Y3fXkAF:Op18FzH+dOevRaclNDfUAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706521286, "uuid": "ae3b66ff-6188-431c-bdea-e8010fb7ed0e", "value": 352864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706521286, "uuid": "d7d63ca1-4fa3-4f5d-b4f8-7a8d115b0452", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706521286, "uuid": "8ebc65f9-f06c-454f-a00a-9f2bfb3b04f0", "value": "\u0414\u041e\u0413\u041e\u0412I\u0420_\u041f\u041e\u0421\u0422\u0410\u0412\u041a\u0410_11224_\u0412i\u0434_12_01_2024p.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3baa95a-beab-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706535596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535596, "uuid": "c5700376-5700-4733-ba9e-ffc24e77051f", "comment": "Malware payload", "value": "dc4314d15f583b2110c18f411d84c61b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535596, "uuid": "ab1f82d2-fdce-4033-9842-8cbb22f9a87e", "comment": "Malware payload", "value": "48998b2501726700feb7eff639eb931f6da8b213d37ec986bd5a2cee60634b10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535596, "uuid": "b6f9d078-98df-4e33-a5bd-8916a611615f", "comment": "Malware payload", "value": "7bc6d97e4f9ebd4e8969b99b9f2fadb8fe9e81c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535596, "uuid": "bc00a51c-fdb4-4cea-95d8-770da991fb08", "comment": "Malware payload", "value": "351ec47906fb2b5c2e3f1f8d2f7fcde784a68f14e5da8b4964b7b827d3e28d6fcf86c395ea47b02f1c35e36103900edc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535596, "uuid": "dd3bbdbd-cec8-45d8-b74f-cef2cf489cec", "value": "T15C03380977A0E2B5FEF6C570241BB1A4AABD64B23B054C8DC319DB16E5F5952E3E0307", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535596, "uuid": "1a68c0d6-bd8c-4928-bad2-9ed8b2198dab", "value": "384:zPkU4p5lGAlPoxFkUsNUsa/zlgRT7KZiNAU4bwQwPEWoe:zPkpnGsPoxFFsKsQzlHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706535596, "uuid": "8a67ca28-9b6e-4a2d-99cc-3f7dbd22579f", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706535596, "uuid": "be894668-7dfb-4fda-8b65-a293378daeb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535596, "uuid": "d04bd519-cf5e-41a6-9982-9f5560d2e65a", "value": "SecuriteInfo.com.W32.Refroso.AGEA.tr.7443.31075", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f19994c-be5a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1706500557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706500557, "uuid": "8448b8b7-9429-41b8-a31d-9bc3c3e907fd", "comment": "Malware payload (Amadey)", "value": "58d5a4054fb2b552c02250a2ba355421", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706500557, "uuid": "fcf94152-e779-4625-b828-5c93f276ed20", "comment": "Malware payload (Amadey)", "value": "49b524dbe9797e4a8905bca4b74da0f7aac977b07a5f72c66e7f3d22597a86e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706500557, "uuid": "d63e4573-b45d-4764-858d-682a407c4862", "comment": "Malware payload (Amadey)", "value": "cad1c48f5cff5d6bdabedaf9a3ff1961ee650a71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706500557, "uuid": "38baba33-5bcf-4dd1-bffc-0606d3efc1c5", "comment": "Malware payload (Amadey)", "value": "4592daf25fdb38d14479c37cbfbac1fc7643e3ef32bd1acc4ba3c23b3a262cfa0a76295c0d9a0df06c05639a6f4a603a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706500557, "uuid": "7fa7c373-d41b-4b2a-a83d-dfc596ea33b1", "value": "T14D45BE01621E0957F3956334D6AFD7320610ED62A5E3C60FA2C53E7B713E3AB7A70A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706500557, "uuid": "af0b541f-10a7-4d9d-86e9-7d3c1ba9820c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706500557, "uuid": "fbbc11b5-3f8c-44f7-bace-8fc304bb624f", "value": "12288:Rs++Ywg32+1g2o1rn98T6w+290xp0pSkpn/Xc8HmLw7IAC1CYdbZyZL9Ch:vwf+y/1rnOeBbsvcjE4yLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706500557, "uuid": "957971f9-2222-48aa-bab4-0fb5a2b31a5b", "value": 1238512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706500557, "uuid": "d1511e7a-2124-48e6-8020-e9802a726ec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706500557, "uuid": "a016007a-0bd5-4c5c-8cab-d69c3614efe2", "value": "58d5a4054fb2b552c02250a2ba355421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42703eca-be54-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706497959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497959, "uuid": "75b65885-cc28-4e5b-930d-00311d75983b", "comment": "Malware payload (Mirai)", "value": "c0a2523482d19c602595d496e4d28045", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497959, "uuid": "70c178bd-a27f-420b-aaf9-bc9dfaed4332", "comment": "Malware payload (Mirai)", "value": "49c7d2f2537a947f84f51786b2e9f29a3bc8d05306268b25f5056510009b4c2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497959, "uuid": "c27959e1-287f-4496-a6fb-b32b25fd2b76", "comment": "Malware payload (Mirai)", "value": "2289e674a2bdd0f218a18e526f5dca672d9d7d51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497959, "uuid": "ef16d52a-c454-43ca-a034-0bca134c036a", "comment": "Malware payload (Mirai)", "value": "2f210a4a62523a4cb360e579ebccd4e893f9fade2ad0105786c39d2904cc0b52e1ad286a7152b8552ca631b31c015408", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497959, "uuid": "699759f6-176a-4e0f-bc90-468df3991c8d", "value": "T129E2F1116916C47AEB308471E0F6468777691BBDBAFEB0B64473024DDCC294293E1AEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497959, "uuid": "6a64efb7-74c4-4514-a731-4e3f0b2a6929", "value": "768:rEKkUgXAnURCr6HmDFStmYtIC69q3UELdM:nkEn7uHEemNCvLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706497959, "uuid": "e1657982-4141-485b-97ee-e25b71aca5f2", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706497959, "uuid": "d2346993-be7a-4de0-927a-fa9a538549fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497959, "uuid": "ae395cc8-f4e1-4e87-995d-9dc5c78f6c5b", "value": "c0a2523482d19c602595d496e4d28045", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f27f39-befd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706570716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706570716, "uuid": "d0194e65-f648-4942-b0cd-ff68a5d60e37", "comment": "Malware payload", "value": "99eec06f2923c45cdd6ebb2bd1648226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706570716, "uuid": "606b3f48-f876-4f1d-87e1-5a44af57772f", "comment": "Malware payload", "value": "4bdaa5227a23c06acc8ac318bb0d83273972e67105e5e37085c0c8c56001d9b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706570716, "uuid": "7defa93e-dd04-40db-ac0a-8499ea7f10c6", "comment": "Malware payload", "value": "ca6349f3cb7f6dfa28f8dd204c74d2be1a636c90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706570716, "uuid": "358099dd-90e6-493d-b3f1-e4e08fdeec5d", "comment": "Malware payload", "value": "16efa7a6969fc2a66e6492a9c9ce78663659329cf9bba4f834f46fc28a10b346c3a0fffe44307e1f55a172ceb8cd2807", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706570716, "uuid": "3bd83d89-f660-43c9-b867-736981a72ee9", "value": "T152647C11BAC08535F4B3263647748BA5893EBD700F12A6DF179409AEDE71AC1EA31F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706570716, "uuid": "57a58283-1d41-4d13-8e26-298ecc4cf419", "value": "e93b627e8ee3ec62851727e4884df6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706570716, "uuid": "e4c10887-f127-458a-aab2-5bfd47d5c418", "value": "6144:JQSiPP6LoPXOouuq3OgYDqQNlmOXxDlMTv+vaNeO2zSv:APm8XOeDqQNlmBvqaUzSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706570716, "uuid": "1f269651-0551-4bb5-bde7-f05f0c6f54ac", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706570716, "uuid": "bb05458f-98f9-4014-bed2-e64e9537442a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706570716, "uuid": "3c4737bc-b052-44db-976c-583613fd63b5", "value": "SecuriteInfo.com.Win32.RansomX-gen.11727.25490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5a2e3f-bf00-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706572061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706572061, "uuid": "5b254a2d-5cb1-44b0-a4fc-1359426fb989", "comment": "Malware payload (Mirai)", "value": "71b7147aa525b880450b4fef4790907a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706572061, "uuid": "2a004dae-dac2-421c-aace-1aff55092f7b", "comment": "Malware payload (Mirai)", "value": "4c7c9f32c1dcec98326fbe687d5c0f85316a04d7fa94521bf096fe235bb6af1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706572061, "uuid": "fdbe7681-315a-4d0a-8620-185221964ea9", "comment": "Malware payload (Mirai)", "value": "8ab57d9bf4bc2fe8143277e99d18452e5ca9ce58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706572061, "uuid": "521070d2-cac9-4d82-8b4d-d18e7e5dc5e2", "comment": "Malware payload (Mirai)", "value": "e3644c42167ba02b36661edcf6bcbfc81cb9f4afcad812194c852d01b3eddf4c42a192c96fdcde150ddc0197e4fa1b7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706572061, "uuid": "981304be-38e1-4a3b-8195-ade147c267af", "value": "T1B8732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706572061, "uuid": "bcd0f20d-d97c-4541-bd0f-20a120081e47", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9Wo:927jqCt8v3GI/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706572061, "uuid": "3720a46b-941a-443c-a1d5-c8082d9676ba", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706572061, "uuid": "869ed2ed-f19b-4fcd-97e3-93926684c36f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706572061, "uuid": "da748f48-c0e2-432b-92d8-7cfb5333c1af", "value": "71b7147aa525b880450b4fef4790907a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4cae52-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1706536255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536255, "uuid": "78da4a01-3c7f-49ce-9c00-bb8a5828b3a6", "comment": "Malware payload (Vidar)", "value": "592979cd96d6fd6e8eb5c1052e17da40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536255, "uuid": "ab09d9c0-afa8-47bf-8079-315709d7168d", "comment": "Malware payload (Vidar)", "value": "4d78e8f9f29a96570957acee0c5504ec9c67b97a04892b72ebb31830155b8a81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536255, "uuid": "417dbccc-6e37-4b89-a3fc-dfd2ad567a81", "comment": "Malware payload (Vidar)", "value": "f8595fe8c43f53fcef96c7d0c7052acd6911c8c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536255, "uuid": "6a485a5f-2159-480c-ab61-17d63c47a5d6", "comment": "Malware payload (Vidar)", "value": "797ded41c20cf60a79a482826942fba65d9f3309d59d25473626b308048df45c4a49dd9274f1686e006525bdbf1828e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536255, "uuid": "212bdca5-d873-486a-a5d3-3f29fa8490f7", "value": "T14A16CF153BE4DE62E3BF2270D5B0422503A1D8932346F74A7B9D73FC6F267054D92AA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536255, "uuid": "2a05a2fa-af91-40f2-a607-c7fa59c265a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536255, "uuid": "94000530-5756-4a09-8bad-cb869a4744f9", "value": "49152:XShgK5pr1wSKK2wAtpkspdExgeXxqusHK/Bu/j8IUI3F4AyZl0+Y5hVfuM+Bde3D:ChgKE4iwkusL9UsyZnY5hBMe3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536255, "uuid": "ac5f2405-bb04-4a81-b9d6-3192125951dc", "value": 4269768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536255, "uuid": "60d7c887-7055-41db-a08e-781dd999e9ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536255, "uuid": "bd6230ae-c554-4827-a45a-0e5f9787b6b8", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ab6a84-be85-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706519060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706519060, "uuid": "ef5e7068-7994-48ae-9a0b-bef8b5cbf2b7", "comment": "Malware payload (AgentTesla)", "value": "03fff870c9ec132b66dc6cacd1b88f2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706519060, "uuid": "8c0c9a0c-906d-4e97-be50-ec87186613bd", "comment": "Malware payload (AgentTesla)", "value": "4f89a3ab1146a0513cd923bd8f66604c81df7e90c2e526a8dd3dc96c5dd1a68d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706519060, "uuid": "3da63560-108b-4fc0-88b2-b91c7988bbf1", "comment": "Malware payload (AgentTesla)", "value": "f2f10f1ee3efd755db76de35252ca89de52cdcb2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706519060, "uuid": "7901c1ea-135c-4d1f-b7db-8c9dafb90e70", "comment": "Malware payload (AgentTesla)", "value": "0d7e00ed2e7da7717bbbdc2c066ad40bac202ffaeb365d4812e2b9b990ce62e589aa836596775b1f4a20aac487c327a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706519060, "uuid": "a9825c78-24c9-4273-a6bb-5ae53e9d11b4", "value": "T186F4120237F89B27CDA9D7F8647065455BF0B42A2441FB890F9670EA29E2B910F147EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706519060, "uuid": "15fcd7ec-11d2-40d7-a6d9-43ac4e54b9d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706519060, "uuid": "3976ce63-235f-4863-b953-504b23e6ed2d", "value": "12288:Oa1EEIoIFFHgeg/c5RU2BCqUnF7cdRBT5bFP4HGekLnXYmUyWHmqWSKxqAq3JfD5:JIXFx52t7cxRqHPkLImUBWSKQ48LSXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706519060, "uuid": "60cab7a6-157b-4c8e-94b6-9353978430fc", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706519060, "uuid": "61df641e-ba9b-4613-b4c2-2e9ca90dc238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706519060, "uuid": "c165e22c-caa6-447e-89fd-1e76b29f0b65", "value": "PO amount drawings pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d1ed2a-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706536267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536267, "uuid": "02c4a365-218f-4641-b192-4ce3703951ed", "comment": "Malware payload", "value": "39f1366b2e64639a419d43c656bd7d4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536267, "uuid": "9627e1f3-6266-44ce-a0b6-4837272f7358", "comment": "Malware payload", "value": "50606b38ed6452d7a22a857f30b4f05e0d4b24351b838e346f2e1b603f03004a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536267, "uuid": "cd318ce3-7875-4548-94c6-137d87ce916b", "comment": "Malware payload", "value": "9c7206147911cbf9333605f5a9471255cf3a6be4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536267, "uuid": "f7c094cf-2020-4e7f-a50c-63dd2f849787", "comment": "Malware payload", "value": "e79339d4546e7a88f2c090a9a97863621525e2a5293373df3c1a16e40da10b988ac958c7b850e93762b6076ecbe5962c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536267, "uuid": "4beeba71-0742-4436-adf9-f32d4c35ebfa", "value": "T1CCE733D3BEDA8067ED0479FA6B805CA06D0D341086357B63E156385F1833DC6EA6B27B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536267, "uuid": "3d1f7ffc-1ab7-4c59-b12c-6dee2ac57305", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536267, "uuid": "3e17b326-d876-4744-9c0c-4e9e84f34498", "value": "1572864:JrziNx5qwFpB8KBeBDOiR3hpVTBxdfqXFLWxixdM1iei1s9DC7:kx5qwLADPR7VtxNqXFLWxAM1ir1a27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536267, "uuid": "377673d9-23a9-4617-ae05-2bbc3bd71e89", "value": 69184786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536267, "uuid": "3ce9a35d-2e30-4703-870e-85ed5df945c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536267, "uuid": "ebe17608-982a-4d05-a15c-a621ad2aaf07", "value": "Nexty 1.2.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e981ba-beab-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706535593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535593, "uuid": "4b2749b2-f45a-4fe9-ac99-128cf799c3e3", "comment": "Malware payload", "value": "ee588f49ead22c38d8d686850bfa2bce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535593, "uuid": "211afd4c-b766-4130-a92d-e33ace91d73a", "comment": "Malware payload", "value": "508319acaf8672b4a7818d90293732e00d818cdbc2cb23938546ea0a9834840c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535593, "uuid": "34b2aa03-1633-4166-b5fb-df9325e188a7", "comment": "Malware payload", "value": "b6f2620a3049928efea5c82d21e5ddddd028ea55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535593, "uuid": "86fee1f3-e6fd-4ae5-b740-331504dcd5b6", "comment": "Malware payload", "value": "fdcfc046ab6f2195c8afa53559e1a1fc896281752818b572375f94700d95e55362990000cbe40e6a7a708f777e0dd76d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535593, "uuid": "57f519d6-0d59-4703-bef2-531653214ec8", "value": "T1D9C53A1262C0F03BD0771A36582B96847C3BBF952E16DA4B2AB43D4D4E396426CFE717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535593, "uuid": "e4cccb3e-51d1-4f1f-9edd-a000de2fcefe", "value": "90c2b8557a74555a155ddec19faadb36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535593, "uuid": "31068f93-9f8e-426d-964e-6ad7673124cd", "value": "49152:X4pSdSo+qkb3YJU+ofM2Ddrvp/TYulaCP:XpSouWh2DdrvpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706535593, "uuid": "46f8b5e1-6831-4323-9b49-aaca30e626ac", "value": 2535936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706535593, "uuid": "d7565385-e36f-42ff-b2f8-ce98f5971988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535593, "uuid": "5c088d48-90c0-459b-b0f5-218c5e18e413", "value": "SecuriteInfo.com.Variant.Tedy.444896.12533.20621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a94281-bedc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706556648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556648, "uuid": "63fbdecc-3222-49d7-aec2-92a8b8aee355", "comment": "Malware payload", "value": "6dbdd4bbc4210c5e249ca667706dbb2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556648, "uuid": "0ff30756-2717-4cc7-8bd8-9671f4cc7e5f", "comment": "Malware payload", "value": "512f9410df6792c8349dc93a1992c618300dfa0d243a64a4972b9fdae9bd4c39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556648, "uuid": "1c2269a0-10b1-4ae0-80c9-e2d2ded4308e", "comment": "Malware payload", "value": "25672673938749cb1edfaa658771a115aeaad7d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556648, "uuid": "2248c544-b184-4f39-b067-23b06bfb39c7", "comment": "Malware payload", "value": "8448ed031b677f374204b256d1534f5755514212f531f04bbf1c64013fd78a9a500b5cbaa5745d656c1489f6b7a247da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556648, "uuid": "20ca972f-4a17-4293-ad0a-9a5e9dfcaf66", "value": "T10127332365010CFBD0755239B209D62A4D31B891D7BAD18E5BFDAA3E1E979C0FD32E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556648, "uuid": "fd94d136-962b-42ec-9554-6949ae6fb9d1", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556648, "uuid": "a0d513c6-3232-42fe-885e-f1178bc8670a", "value": "393216:P94n6eQnA945zgetEL+9qzT1gIxwGcSO6o5dYT2o:P9mQA9wM+9q/1gIxNc7Ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706556648, "uuid": "0b51a2a0-8101-43b5-8086-1e612680a86e", "value": 20626682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706556648, "uuid": "005dce39-d705-4dd3-88ec-edbc606e7ada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556648, "uuid": "ceec1e24-8154-496d-9f80-b75bf16435d5", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.35370.582.11355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ee7d3a-be52-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1706497213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497213, "uuid": "baf26426-a4d2-49ca-8510-6a974551cc72", "comment": "Malware payload (AZORult)", "value": "ad60738dd00b749952f748586c775f7d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497213, "uuid": "eb8f0e65-7bcf-4509-b319-b4ec6aef6f98", "comment": "Malware payload (AZORult)", "value": "514afae06d8b1b4fab775124e5ac53054353b7b7c6a2dbdc2909581cdc438828", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497213, "uuid": "8b970b19-c616-4cd1-8f3a-bd799cc9a986", "comment": "Malware payload (AZORult)", "value": "cbcbf7233e4b8232351eec10770a4236c00a4077", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497213, "uuid": "1d9ecfd5-e3a0-4077-9909-716526e01513", "comment": "Malware payload (AZORult)", "value": "7047b2daef796d317d59c41102af7448d7c62b059ab05b9d6811e8d464906de83578f901f125cbe7ec3b4a80932019ab", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497213, "uuid": "f2746c0f-0f26-4a61-9aed-ef04030941e6", "value": "T107D46B31B79BAC96C4190CF2515E03EF04D0E7AF166497C3E391ADAB7F2A581852B8D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497213, "uuid": "c9e6c329-63e4-492f-8eb8-e46fbfbd74b9", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497213, "uuid": "6f66e531-2079-4dcc-a5bc-cd6c06bb96ff", "value": "12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLUUvNR:AQy6ONsqLUCqCpP7TrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706497213, "uuid": "d9cd3da8-49c2-4730-8cac-73d80c72d63e", "value": 624026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706497213, "uuid": "68d76318-72d9-4e64-bec3-f949eee86adc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497213, "uuid": "0d7b85ec-ccc2-4bbd-ba09-c9782457cf52", "value": "Cucurbit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdca4a66-be9b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706528687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528687, "uuid": "f4565ef0-9221-4b55-a424-e33133c7783e", "comment": "Malware payload (AgentTesla)", "value": "0609cfc660c0dedb0e28217cf1fb7fbf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528687, "uuid": "36f705d5-7814-448e-ad38-6f73746b6b97", "comment": "Malware payload (AgentTesla)", "value": "55cd2f21de67fd054ed1f7337cb5483408ef085348cce685be7752615ca7667c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528687, "uuid": "7bbebe6a-760f-4f08-a0e3-321edf4b53d3", "comment": "Malware payload (AgentTesla)", "value": "1e75d9cda16c9b343baa9ee65c37cd84d5b56055", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528687, "uuid": "d383c049-35c1-4723-b455-de3807a5fe26", "comment": "Malware payload (AgentTesla)", "value": "d719f88d0ca89d56accc16e5579398bf2cfc1f6a41f9c6396d71db3b071e9a33b2090a4d0212c64c9faa91a3816495eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528687, "uuid": "c10cd065-a5e9-4e57-b98c-6c254487be06", "value": "T1E114540277DA67A1C2855F36E7F104035367C842715EDA0BB64E3ED909E3F9FAE05A0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528687, "uuid": "77f25dfb-dd43-47e1-b6ad-1747fe20bdf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528687, "uuid": "0a970617-ad09-4a2b-bdab-1e9d096fb0fc", "value": "3072:77QzuorbyWV0uXiJoLd64+Auk3dORlEMgK:YzuMWWVp3Z64+Auk3dORl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706528687, "uuid": "b82e1d99-0123-464a-8aec-987c531310d6", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706528687, "uuid": "0f2cd3dd-4772-4284-81d5-4841d1438fbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528687, "uuid": "0a4d7880-311b-424e-95b9-2904975dda49", "value": "RFQ-KYL-2024-E0002-B(02).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072be506-be68-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Simda)", "timestamp": 1706506450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706506450, "uuid": "b5960804-9c52-4763-ac22-2f39e4b85545", "comment": "Malware payload (Simda)", "value": "69f27b07404cf9c51dd2d2e40fca4d65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706506450, "uuid": "0ec18112-75e7-4d18-bada-437675884341", "comment": "Malware payload (Simda)", "value": "5617238b8d3b232f0743258b89720bb04d941278253e841ee9cbf863d0985c32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706506450, "uuid": "ad9069a3-d6ae-4802-8ff6-5eb7afd0c7f5", "comment": "Malware payload (Simda)", "value": "56d7f4aadedbabf9b889dd6fb39f710812fee09e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706506450, "uuid": "97e676f8-7733-493f-9830-c3760ca6ed59", "comment": "Malware payload (Simda)", "value": "2566f0ac6c0f365222305e32fbfd54e26c9f2b910206e7e49cca384caea61cb54417d42b7540e19acaa9492150e49b92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706506450, "uuid": "8714d4b0-41d6-42d2-b4da-a8e1eb3153d6", "value": "T15005C25F2F81C308F2A92DF6D5D5D8F2027F71DF5E28686691D8106CC6AA29CFA36350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706506450, "uuid": "3622cf26-4ae1-4836-81c9-3be50f6df47c", "value": "4de321e101993eb64afa7391ff67dfd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706506450, "uuid": "0cb69588-3d0c-47af-ac24-9a85c1a095ca", "value": "6144:wJvWo7JhhqFTkptLgBX74A19+cMBmOjHEtDYWxcGrKOwLByOBveZ+gw/TpTQ03la:SNd4TOghZ9d0mTiWALJEZuhKt5cyNMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706506450, "uuid": "4a58e21f-6af0-477d-a2aa-43b3ca74daa2", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706506450, "uuid": "0fafdca9-50f8-4113-b73b-4cd6f716fc4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706506450, "uuid": "840bbd23-6ccf-4143-839d-0c41fbbe6bbb", "value": "simda_trojan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fe6d5a-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706536408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536408, "uuid": "a0d90d27-f3d7-46ea-80a0-12798919054b", "comment": "Malware payload (Formbook)", "value": "9d02be3fc077a5897d6e6e4cf009fafe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536408, "uuid": "17685886-4ba6-4e54-bccd-dbad1652b50c", "comment": "Malware payload (Formbook)", "value": "56471460f50d8f0470fc9e2d53e76e9082313dc8430f74890fe421e00e35e2cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536408, "uuid": "c81d8ff0-0aa3-409a-b976-9741a7fff812", "comment": "Malware payload (Formbook)", "value": "36a8cbd5ef1ca72b23a5365b34b2a78389a601cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536408, "uuid": "7373bac8-54a5-4eb8-a4f7-eb3b35e6e351", "comment": "Malware payload (Formbook)", "value": "4e7fc020a8079e50d22383a73956ec95a60e3408de0e09ed7ce0d8038d59af73e526a03d580b1c4f8503579ad33a6930", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536408, "uuid": "7e869a5f-8508-4248-9bc8-c558925d9dd9", "value": "T18E256ED1F1508C9AE96B06F1BD2BA53024E77E9C94A4810C569DBB1B76F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536408, "uuid": "b9176d8f-3058-4b8b-890d-095d7db0e336", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536408, "uuid": "73e46c71-58f7-4ff3-8413-c1b393b23d85", "value": "12288:H9d2iNjJz/IIHF3fKqHvdgkGnhjfuhgaO8OxEKvAGarZoNOhPHHbLNBEtd:Hn1NJz/IIHFv9Hlin4hg/8IIlNvn/NB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536408, "uuid": "6b11c947-bbd6-48c3-a816-1546e59b5095", "value": 1021952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536408, "uuid": "63e87603-4dbd-43ff-82c3-dfe004a3f8e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536408, "uuid": "c7ffc9d1-92b8-494f-bf33-e131b2c6efc7", "value": "04251452615625625.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2f7ceb-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706520229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520229, "uuid": "2d8ae5bd-f9f8-489e-af35-028138f3485f", "comment": "Malware payload (Formbook)", "value": "e34878076eb9096d7ee9134dcc06988c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520229, "uuid": "4129209f-2f91-4a07-a1ff-7c2f9d337a90", "comment": "Malware payload (Formbook)", "value": "56f2fe58468c40326131a779fb59a349bcba8e9953204fd2ea23c1285581cf5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520229, "uuid": "bae5ad8d-bce3-4b8f-9aca-82a953aca637", "comment": "Malware payload (Formbook)", "value": "c74e3139ad1a756c89f3db894cf36e009c666c20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520229, "uuid": "4422cda2-9496-403f-b6b3-ee19fced8f9a", "comment": "Malware payload (Formbook)", "value": "7c1460da33e869c082cb73905cb8342cadd3bc429fd52babdd153609c1366daf331f6c7b624ac17ea26f72cc56e7edc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520229, "uuid": "3b9e8a4a-f14b-44c2-92e0-49ba1e924de2", "value": "T11404AE32D602C070F2B251B5F7BD1B7B483E0E347295A0AAA7E115E16EE09A5F52D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520229, "uuid": "4601a46d-f704-4664-8314-d2e0396d3fd9", "value": "3072:pMvECkVK8gU4m2389WGeqKS6br2712VG9fIAiTOHAT92pi:+Mg89VTb6br2MVGZI/TOHAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520229, "uuid": "00deda88-2b60-4783-b34a-8a2e00b5489d", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520229, "uuid": "eecf0d59-9a42-4652-94b8-75e2ead251f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520229, "uuid": "e0a763fd-f1aa-407a-8841-94da9f45d870", "value": "56f2fe58468c40326131a779fb59a349bcba8e9953204fd2ea23c1285581cf5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211e19e9-be54-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706497903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497903, "uuid": "02ffff81-bfcc-4345-bdff-00834fb06037", "comment": "Malware payload (Mirai)", "value": "75c5345bf5ee8c0c3b553c7598cd573d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497903, "uuid": "31d8ead6-24e6-43b3-8c57-89aec4ec83c5", "comment": "Malware payload (Mirai)", "value": "59885f4e4eb3ae10cf7e6ae07195f9477d5e5d26b604f43beb9a3442bc10866a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497903, "uuid": "fd458264-c1dd-4807-b768-9edda4171da0", "comment": "Malware payload (Mirai)", "value": "61da402c532c028f6cd5dc906fc5dad400dc3abc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497903, "uuid": "84893613-3d5c-4dfa-9eb6-3419b8544c3a", "comment": "Malware payload (Mirai)", "value": "f78b042c948c692b690fc1e4a7832ef49fc9bbbf1016c04109310ae3f2ad222bb7f0aacdabc0ba16a4f06297cad27bb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497903, "uuid": "203c9b65-d11d-4168-b763-243c9cdf507e", "value": "T141533B99F4028E3DF88FE9B984160E05B93123D212931B276BAEFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497903, "uuid": "7c3988a1-9aa4-4b23-8274-f8794b0ae1bc", "value": "768:me4gpsM204GEkRbjveXQonQiuQtt7v3gFHy1eu48B8vB6J7EzNfXQuJpozEE7Py:mo3EkRbDfDiDHIFy1X48B2SEzNfAuJ6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706497903, "uuid": "3ab3e738-ae97-4b7d-8ff3-5da66c6b6cbc", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706497903, "uuid": "a2821bf2-7146-45f7-b73f-75c11ef9af0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497903, "uuid": "60a841f4-a50e-41fe-a162-c840f4a75261", "value": "75c5345bf5ee8c0c3b553c7598cd573d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9b8ac4-be91-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706524256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706524256, "uuid": "06850de5-1c1a-4e3d-bfc3-7452e3b441f3", "comment": "Malware payload (AgentTesla)", "value": "cc9320801a411bae88d4293006f8fdd2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706524256, "uuid": "a7d73b2b-b73e-4d63-b80f-56ded9c214c0", "comment": "Malware payload (AgentTesla)", "value": "5a948b605fbabb59ea28244fdf05cc6980a82057fa1cc1138a1cba3569b9a294", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706524256, "uuid": "b001a88e-b1ee-4fc1-b5d2-5649c10d32a8", "comment": "Malware payload (AgentTesla)", "value": "00995a1f3b4f14ffc260f17a9d2294671832b861", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706524256, "uuid": "204d95e1-b750-4114-af10-b097b590adf3", "comment": "Malware payload (AgentTesla)", "value": "427ba686f79ce41be5041ac9614004a12c3f3c254ae79f7038699f816c9947723169843fc0270c414a8206e8e79d2fff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706524256, "uuid": "5c132edf-6d5a-4b0e-be86-9a4ceaa11440", "value": "T1CBF4120137A84B26D6BF53F4193B60908B757A5BBAA2E71D0CD160CE0D77B404B62F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706524256, "uuid": "523bdd70-20ed-4db7-928e-77c337c8d6f8", "value": "12288:LdTKGZrAHW3XVcJsWcv6QL8B2rA4tO5yoEZSsc2RUzSZQ1HkLdU+0bS:L/SpHcv3rAeO5VEIscnmyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706524256, "uuid": "236f776b-fb81-4a19-9bc8-e58c31270f67", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706524256, "uuid": "8dd0f602-b8de-4011-9a77-cea661f0456f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706524256, "uuid": "f1cca36f-0541-4d96-a4f4-1813447aef3b", "value": "Inquiry Doc2pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6794bcc5-be80-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706516919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516919, "uuid": "15b30411-19ff-4545-9edf-2f0fa43a4691", "comment": "Malware payload", "value": "abf39dd4e4707cdbee26f2f93439078e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516919, "uuid": "33985d34-b8db-4fea-90e0-35d961baeb20", "comment": "Malware payload", "value": "5aec3c8948d4802a588f07dd93bfbaba1b67bea6e97d41c6f156f21998f0a6fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516919, "uuid": "dccf4f59-9499-4945-89b6-26d97af1861d", "comment": "Malware payload", "value": "d113858d6bbe1461382c5f01e2b884afa177849f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516919, "uuid": "f09da9b7-d732-4f1d-98b4-35fac1733446", "comment": "Malware payload", "value": "ea2612ad1343572154195cb18650cbe9ff0d3282292008fc008e1e8cef68e2971b0cefb177103793bef43bbd343707c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516919, "uuid": "4dbc8101-4bcd-4da8-bf59-1f14997d6946", "value": "T1CDC3A341B7E40917ED7657F85832C87507733EA96931C68C0DE674AB7AB37828920F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516919, "uuid": "3cc395a4-c3f9-4a14-9020-627e2cae8579", "value": "1536:EUICJCR2Du+biVYnPQrK7j4pDhExjz6dJUZKeJXJh:EzwCx8iVYPQu7j4thExjzEUA+5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706516919, "uuid": "90c947cc-ff78-46d0-9896-e4c4464d6326", "value": 123392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706516919, "uuid": "40f24155-7699-4b54-bd0e-c652471f69b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516919, "uuid": "3b38b785-8b51-4a30-9ee2-df8c837f526b", "value": "SecuriteInfo.com.Win64.TrojanX-gen.29563.21465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98a8e10-bed1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706551819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551819, "uuid": "244efac7-7ce1-4c7b-b621-d9e98d5fbae3", "comment": "Malware payload", "value": "8eae91cc1101b2fcb9058fcfc7fbc544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551819, "uuid": "b0c45ebb-5728-4985-a029-e937f9f23797", "comment": "Malware payload", "value": "5b954bdb3cdff9ab01fdcaf026a431c42db18ac651d062bfd8ba13261b808234", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551819, "uuid": "b594dafe-b32e-4a58-99e7-e37dd8c7ca95", "comment": "Malware payload", "value": "1547f8d0b584a27806c5287974d60825dce2f277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551819, "uuid": "92757222-e1ef-4810-a3a0-196593fca473", "comment": "Malware payload", "value": "8696d7619f7f76027eb362eff323b9c367b1939b277cf8d921378c57d3bee3bb8722fa88a59865c0cf9eba75e8645d34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551819, "uuid": "919d4055-77d2-4291-92dd-98168a6913ab", "value": "T14EE4F60013A5E1E0D2AEDA37D8ED6505C7B9AF1297EAE34E244E7594CD3377A880172F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551819, "uuid": "f21eda32-2ba1-4860-a4f7-91d666a332a4", "value": "6144:hEd/luofmO6VA/h8iqhlTaGtlFCq76bbaSEnTrv9Gve31eAUbcBqgNY1t7MWb4S4:OZ/h0k0lYfaSqexcBqgCbM9Ilhk7j/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706551819, "uuid": "7d858850-2536-412f-b439-e1bfb128f59f", "value": 658552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706551819, "uuid": "add25f57-cf42-4416-bd63-4c13e587d2fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551819, "uuid": "fe7b971b-aca9-4956-8095-f72cfac1b1ea", "value": "rSWIFT_DETAILS_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfbc1bd-be6b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706508099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508099, "uuid": "2c97dcaf-8630-4722-a739-c0a2da1c91c6", "comment": "Malware payload (Mirai)", "value": "ae896eef7e082d29122f74516b1d7835", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508099, "uuid": "62337a08-5fb5-44fa-9308-b7f95d348275", "comment": "Malware payload (Mirai)", "value": "5dbe3a25a374464dbf859c31e059b6c2bcc7f9af9442543f2ccae53e07010cfe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508099, "uuid": "8fec4ed5-5862-4039-9fa9-a55c6285cefe", "comment": "Malware payload (Mirai)", "value": "bd7dc2cf482ce30eade88d1d8d21eed5d88a7cb8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508099, "uuid": "1451db88-23b6-4360-b3eb-22c5d3db19b4", "comment": "Malware payload (Mirai)", "value": "bb811fbdbcecbbe50fc22b500178c6ba54bd66956ec58ef5736e576f8f7d483bf75dc67cc7763b906a9fc0fca4ecb8b4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508099, "uuid": "6116d5c0-37c4-4abb-ab20-9b125214dbef", "value": "T1E714971E6E228F7EF368873147B78E259B5823D627E1D644E1ACC1101F6439E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508099, "uuid": "869dfb0d-3794-4073-a4b6-38ef8f145129", "value": "3072:wkPTg1OKvBpz3wviY1bOhxcLW6mg+XCS859OxYo:wwU1BgUL9hg+78DOio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706508099, "uuid": "a2c2fde2-d4f7-4978-8303-9a7439704dce", "value": 194424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706508099, "uuid": "980fcfcd-4d99-482d-bc55-605f9632348b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508099, "uuid": "0b339353-ad2b-43e0-83b7-1516f9a7d49f", "value": "huhu.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25cae010-be54-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706497911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497911, "uuid": "2c63f6d3-38c5-4ec5-bc66-d132dfc736da", "comment": "Malware payload (Mirai)", "value": "e69e7a3518cd599ecc6290d7581fd6e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497911, "uuid": "aeae2723-f38d-48b8-ac01-e4b3b9a54338", "comment": "Malware payload (Mirai)", "value": "5df3bb6ad7072123a93d8446f84a5eccc19a7ba5906d16b4a54425e502144fc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497911, "uuid": "3088b885-0a2c-4a3c-8ec7-d61c071230fd", "comment": "Malware payload (Mirai)", "value": "bab940c547047733dcd29e1d47b9ae540180cf39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497911, "uuid": "a025f47f-8caf-4fe0-b6d9-16be7096ffcf", "comment": "Malware payload (Mirai)", "value": "44caf358205a28b2cf27b8029dd43be3bf9edc39f26c572c246972c2349965f3db56905e03fc41c1d1e4c1c59c2a0491", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497911, "uuid": "01812f3e-90c4-493b-9dee-b56b516019b2", "value": "T132C2F1655228D472F0B45536FDBF01035736CFE8D6EF322622144734A097D22A6B5F8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497911, "uuid": "67d2eea0-a4d7-40ef-ba65-95cab8719a56", "value": "384:KBH2HEdV7UQDoYQHXxcjllK5+AWaFmK0MF9lz7X6AGexXVzonBY6plNAgrhymdG2:byNUQUfhQllxlaH0MFjlOnGsOCs3Uozg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706497911, "uuid": "ad103048-7a37-4698-a506-0d67e6614c61", "value": 27344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706497911, "uuid": "78ee5653-2f74-40d0-bdad-597821dcbc58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497911, "uuid": "f167cc60-5b7f-4f6a-84b3-1219e96b2e7b", "value": "e69e7a3518cd599ecc6290d7581fd6e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5afe753-beaf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1706537344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537344, "uuid": "1202ddba-3bb3-4020-9c04-28311f6e73c4", "comment": "Malware payload (Stealc)", "value": "e8c1d9e9dc777de306692212a00c1d64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537344, "uuid": "8437527f-e1d9-4675-aa02-6849dfa742e9", "comment": "Malware payload (Stealc)", "value": "5e19860c1c39cd2f59baec1bf7e9ecef6894612bd90fd4a7418e051fab415ca9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537344, "uuid": "87259175-32b8-4bbc-a8cf-c1f665bd88be", "comment": "Malware payload (Stealc)", "value": "cd4479b8b3ab617c71b5f0c3cea45462578baac7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537344, "uuid": "164fb85b-464c-466b-9349-e54783e76647", "comment": "Malware payload (Stealc)", "value": "0814e7d216919ded99d504b75df0d3bc955fc805cef3351ec94a1f3dd9a138a6901a20e55994fb9c408229a1797854d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537344, "uuid": "5ab70599-ef89-4f44-9790-0ddda69916aa", "value": "T102A5334DB5538E32E8B94972A5312BFB67BE8E7845D435187734B7C8387002B229FB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537344, "uuid": "4912eba4-d27d-427e-a343-32e10028fcd2", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537344, "uuid": "1430cf36-e13e-4dea-a975-33360a2e4eae", "value": "49152:ChQF2z0X1W34qvuyXPHcqaGqW9gwLgMyu5noEiyIJAuV:CeFdFWINS/NF9gpMR5oEfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537344, "uuid": "a5ca46f6-d284-4d4e-8903-0ee189ca73fb", "value": 2123215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537344, "uuid": "6f83b315-1c34-4cc2-83cb-9845214e709c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537344, "uuid": "74c16eeb-b187-46d2-84de-9fa6f103c39d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76bebad6-be6e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1706509214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509214, "uuid": "5e822019-79ef-49df-a512-52ad0c47404a", "comment": "Malware payload (Loki)", "value": "ed014824e2e3caa1cb6258e96ba89fa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509214, "uuid": "c4ebfe27-12cf-4484-8ceb-fe347dc8abf8", "comment": "Malware payload (Loki)", "value": "5f340e428427104f5c36f7c14d7a1f9cb81e62055c4d9664d5f894073a627192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509214, "uuid": "aaad2aab-34a7-4b5a-924c-526950a3cdd8", "comment": "Malware payload (Loki)", "value": "10f5a52982953d002cc23ddc42fe2f0771ad39ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509214, "uuid": "aa3d7e63-4a7d-4fe7-bc4c-dbad06ef8343", "comment": "Malware payload (Loki)", "value": "5c46ae3eb83763ecb0e38e94d0ec6966f7cc3e2859334074f707a0c9ff076cb85ec9fe1b461cdf818fb0ecc64357ba5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509214, "uuid": "9e1ed187-0a04-4584-bd43-fa5099765285", "value": "T13745BE1277D49076FFAB9173AF56B7115AB86C651123806F23AC1F78B8B11B1123EB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509214, "uuid": "c38f0ba9-bdf1-43e1-94b0-d2644e7a8918", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509214, "uuid": "a39e2ab1-2e53-42f1-b2f4-db8b31dc4a92", "value": "24576:EAHnh+eWsN3skA4RV1Hom2KXMmHaKSchOZiv8DN/5:Th+ZkldoPK8YaEhOZxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706509214, "uuid": "d6318e8e-430f-495f-9fe0-898b2e638854", "value": 1177088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706509214, "uuid": "47a27f60-0c38-4b75-92be-6413f7912068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509214, "uuid": "2d833587-e411-4af0-9d4c-c1b306768d87", "value": "Remittance CopyXLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9037511b-bed0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706551347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551347, "uuid": "a7a56759-4a2f-46b0-9140-34e40d4ec8cf", "comment": "Malware payload (RemcosRAT)", "value": "1ddfb640584eb94a8ea68acd7fc9923c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551347, "uuid": "9e63b49a-eb13-4631-9565-c90bde821a77", "comment": "Malware payload (RemcosRAT)", "value": "5fe7b0950f37579b7d800c316c1c26f0a217bc796bfff881a8938e4d7f09fdb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551347, "uuid": "449531f8-e53a-42da-a674-00ce50b54c37", "comment": "Malware payload (RemcosRAT)", "value": "001d5139b42f6774ac57ad69486806db0255018e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551347, "uuid": "f98bcf2f-c80e-410f-adbc-2d64d813c5cc", "comment": "Malware payload (RemcosRAT)", "value": "478dce4929210e1950a6a40bcd48baeb8b1d190832b3b6209859ca6498e6be820582d07a3cc64785a29684c6bd562e91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551347, "uuid": "363323df-a80c-4c86-9774-f29d3b8c682b", "value": "T1BD25E04762164E23C395A771D5B757014712FBB2A067C74BB7C9A238581B3BA2FE2B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551347, "uuid": "327af5cf-9f75-4326-aa97-26299b0446bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551347, "uuid": "e2841782-c558-42a1-be1f-939034661ca6", "value": "24576:uULdH/fNEOh8KsnJzzJdfGtYTMmmyBBcHA:uqltEOWlVz7fwMMgBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706551347, "uuid": "a3c4417d-e9ab-423b-a386-0e9a077813d3", "value": 985600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706551347, "uuid": "5d303309-d65b-4f0d-b0c3-2f700b1fc8ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551347, "uuid": "c3599e1c-8504-4500-98e7-8d3d85ec7774", "value": "z1Purchaseinquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c5d550-bedd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706556784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556784, "uuid": "8e342d96-1a02-479f-b29a-d61aa6403120", "comment": "Malware payload (Formbook)", "value": "51361d84cce41cae050d6b134f758355", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556784, "uuid": "872b6106-ac4f-4981-944b-63ab250acc17", "comment": "Malware payload (Formbook)", "value": "60c79090dd1ae506875ac4d40e82ad58209f866ad8c1bf539d7b539380daeff9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556784, "uuid": "04042cc8-cdc1-4e86-ba76-8adb68ddeab3", "comment": "Malware payload (Formbook)", "value": "c93b3153a15b7c873d51c9c0cfede656d77569d0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556784, "uuid": "6fb0cfc8-154e-44d4-a34d-4bec8210af63", "comment": "Malware payload (Formbook)", "value": "540ff217f1909a3612f5fbc29d7250af21eee0a44cecfa1f36e849de0d365e6aab8dd9af44a46cbb00125c99c7cebaae", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556784, "uuid": "7021788c-fc0c-4dcc-862e-e464011e3327", "value": "T11AF4338A125B4E4583CC9AA7D5D40EB87CBD0903E7DC8EA5A53EA064AC77DD02377B1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556784, "uuid": "6b0dabff-7326-4d94-bbe0-78f4504c37ce", "value": "12288:BR9cQgrziFmJxYNsVgfVYriXQykSaBNIwXKSy9xpPLNmG3E9miJ8Iy8F7:TFmiUJxYNMgNXQNfnICKx3bmGmbiIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706556784, "uuid": "4ede84ae-8aa0-4ba4-b904-8d873d924871", "value": 764340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706556784, "uuid": "bd8752ff-d17e-47a9-8c7e-0263690cd45f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556784, "uuid": "4c143d0e-2ab0-4663-8aee-15c0b2ae3e64", "value": "STATEMENT OF ACCOUNT_xlxs.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82d8bbe-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1706520490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520490, "uuid": "3cf2808b-ba9d-4495-a66c-cec8dcbde384", "comment": "Malware payload (Stealc)", "value": "2bc8639cc65bbaec9670c58fa27963a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520490, "uuid": "e348d5a2-666d-4871-acbf-ab17bcf25502", "comment": "Malware payload (Stealc)", "value": "615b666d7dbd523685e35a7bd7abb3d93f3cf82a9bc3374be0134be716a89080", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520490, "uuid": "167ea670-b66f-4b3e-9d6a-83dd760dfe8c", "comment": "Malware payload (Stealc)", "value": "df2bb824f891d5739bc0e4ee35987eb9d6beb6f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520490, "uuid": "50bd73d4-21d4-4270-87d0-6ac9eabad467", "comment": "Malware payload (Stealc)", "value": "d13ddafc6a4daff668d695362fcea7636dfeb0e163ff994b40610674db729dff01800cc03d19aee5024bae6a827d206e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520490, "uuid": "1f90eb27-e53c-40f4-9f30-5188aed86802", "value": "T11054F1223AF09532E2B34D714935EA916A3FBD62BEB4C19F1654073E1E216F0DE66313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520490, "uuid": "5b7d0f02-88f6-4dfe-bdf5-aad03f6195c3", "value": "7971ac7f33adf28893231e5f2764736c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520490, "uuid": "d07651a3-f877-4130-8c95-5a88f44f86ee", "value": "6144:VrLjp+1xf5atcTdV8Gviyn49UKRF9u+diYp0va:VrXpIf4tcRViynAU1+0Yma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520490, "uuid": "d8d4ccd1-53a4-4ccf-8b51-3f3d04a625ad", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520490, "uuid": "5e119e5c-0aa9-4bc1-94e5-c620d2e523d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520490, "uuid": "3a9954b6-39ec-47e4-8aa7-7b081a99f993", "value": "2bc8639cc65bbaec9670c58fa27963a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a4b8ae-becd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706549967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706549967, "uuid": "7598f1f0-0b13-4f4a-8104-226d5b74060c", "comment": "Malware payload (RedLineStealer)", "value": "af31188d740ed50d5a39019356351a95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706549967, "uuid": "180f3a14-bb70-4aa8-9539-b1d0e9d1a441", "comment": "Malware payload (RedLineStealer)", "value": "617f84f748623a4237beb43f2d3d16cece36cfd494a94b04722d65e2bbfa31fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706549967, "uuid": "e8c20fbe-6b0a-42ff-bacf-0c1dd0039cc8", "comment": "Malware payload (RedLineStealer)", "value": "43f61acea8845a3205e66d50c362bdfc3eb984ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706549967, "uuid": "b0ede2bf-14d7-4e08-9ba7-7a136618cead", "comment": "Malware payload (RedLineStealer)", "value": "0e9b0861f013db739bf4fdedc01d01dab7223da8478ef63e1b8712f14c3e444a3bce9aa41061e7fceb6b95995e6ad0ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706549967, "uuid": "bc388e95-801c-4c72-ba5e-a2ed1f25c1fe", "value": "T106A4011574C0D1B2C4B7103144E5C7B99E7A31360B69A6DBBBEC2B7A6F212D1A3362CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706549967, "uuid": "184c35e3-7cf7-42db-b317-344b3282ef89", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706549967, "uuid": "6e033788-45f2-439f-b0c2-fc3d9ce904f9", "value": "12288:Dh1Fk70Tnvjcrll4QTd8lKdMz30CenAC/+xLJ:Zk70TrcBl5oK4vAACC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706549967, "uuid": "b4a6080d-009d-4b1a-9f1b-a6342b2db24f", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706549967, "uuid": "e36eaf59-420b-4cfc-baa0-7ef2048f621c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706549967, "uuid": "7e13600d-6246-4ee6-b886-d8f6702baf25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130ac480-bec2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706545124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706545124, "uuid": "58b82003-7a55-4a81-9031-1c92b0e82d29", "comment": "Malware payload", "value": "167c40ace009f5d5cda541008804c3b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706545124, "uuid": "e2ebf01c-c190-44b8-9f11-1891cb41b136", "comment": "Malware payload", "value": "620bace13215ee69bcbdf8ac237798e8ab2ff052492303e2bac32d0a5a03f44a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706545124, "uuid": "2f312ffa-ac6a-46c2-afcf-72abc5ac239b", "comment": "Malware payload", "value": "541bc50815f39227b9e01e5e4db6a08c02cedf4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706545124, "uuid": "a9afd51d-08dc-4358-8b91-c8411df98f63", "comment": "Malware payload", "value": "75ce649abd3a0ee2c5d4d3dfbfb02625d7c2fa796d10661d4570e6b4ea42735f12dc5709a1af6642bdad98b68e346248", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706545124, "uuid": "09a36c86-e1c8-4d2e-bbc0-743d780716a7", "value": "T1A3E48DEB9778C863E9E7EC72EE24519A941315726D4CC0CC3A990D4DB962F634E8E10F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706545124, "uuid": "ad0d19f4-1f26-43d6-bc3f-1211e22cb243", "value": "2b7b16ea6305513a3787fed6f5a40b28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706545124, "uuid": "cff073e1-4bd7-42e9-acc1-56974af6a16d", "value": "12288:N7D2B/BSBPPdVUQK6HeZ+0PRJl0cTPqvo4qMP/Ai:NdEQlXplvo4bPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706545124, "uuid": "ff3f765a-0cf7-497b-b767-05ca42b01599", "value": 671385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706545124, "uuid": "3e32ea55-b1ae-472f-8d26-eaaa51747c38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706545124, "uuid": "31167da2-149b-4134-a20d-8b994b42d501", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30700c7a-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706520263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520263, "uuid": "35b63605-e858-42bd-8cd1-32316db2d60f", "comment": "Malware payload (RemcosRAT)", "value": "7cf71967c27363b7f81e184ab436dc20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520263, "uuid": "5192ee28-5d44-45d1-8586-7301c3d95c16", "comment": "Malware payload (RemcosRAT)", "value": "632e9965d05c17941c959bde2b51cee63dc6c85d655180e382ad4e3adaf14bce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520263, "uuid": "95f0517f-2c4b-4f2d-b6e3-6cbad5ed5572", "comment": "Malware payload (RemcosRAT)", "value": "64038ff15d4548d81020d01d02f1f961468d3d2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520263, "uuid": "9f33594c-a302-48dc-b6ba-7a14ca3df7f5", "comment": "Malware payload (RemcosRAT)", "value": "4f96ea138b490881bf58816ac4190ef74daf3ff96e07e038359efdb29e2dd6e3f0dc3e3d473f0c2e770283e1edc1fb07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520263, "uuid": "bf33ddbc-a609-4cc7-bf89-dde346478931", "value": "T1082512903BEC5B23E27B83F00826506147B67653BE62E36C1ED161DE1EB7B0057A1E5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520263, "uuid": "09a6cb60-eed9-43fe-82c2-4f40e84c70d3", "value": "24576:BWD/IrM53q/1nVReOTvjeGfTBt0ZunK5w/:Baa9VkOTSAtK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520263, "uuid": "69a09aaf-1c7a-4cb1-9f2f-09d431682e2c", "value": 1010688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520263, "uuid": "000cd510-3629-43f1-a93b-f5742758ca5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520263, "uuid": "1150610c-97a5-4788-878c-d4f2e62a4199", "value": "Overdue Invoice 20231231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0182ada1-beed-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706563563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706563563, "uuid": "dd4dea7e-97ba-437d-af26-81f40c6a229b", "comment": "Malware payload", "value": "d566b5014a0e3985901a7dbd66664444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706563563, "uuid": "cb7dc948-0bd3-44f9-abd8-79468efc43a1", "comment": "Malware payload", "value": "6551e13d6e449b2d68ad9205fe7c57096396e49c92d14f37a60d3764744ced05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706563563, "uuid": "1a3ebd42-66c9-44b6-a8e9-a23b299abb3f", "comment": "Malware payload", "value": "bb93d42c50c2128fa27090131e4ba506b8394f9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706563563, "uuid": "ea6aa825-71bf-45aa-9d24-6e5c83c1b1ab", "comment": "Malware payload", "value": "8c7345d5fcf9237f3efcc8cb6e5eb32344c644f203b02720244fb66fc1a1e382f2f829f1f25ae1d2b6e4107fb286f9e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706563563, "uuid": "58ee76a5-9ae3-4290-8b0b-0bf232c4d514", "value": "T14BE49E6B8A3CD423DEFBDCB9DA2492EEE42354726C4C804D3A8D0D4D7A22D564E9D11F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706563563, "uuid": "84598639-7dc1-42e7-894d-fa01199b7b80", "value": "2b7b16ea6305513a3787fed6f5a40b28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706563563, "uuid": "e6ebf010-7735-4385-a722-83e43858d068", "value": "12288:pnGFS9zLkgAg2ehwdupgmKH8kwe4xe+10eOc4ux:pnzyegxcje4xe+1Oux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706563563, "uuid": "0974f198-c0a1-4bbb-ab95-0333fce713a6", "value": 674457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706563563, "uuid": "c02a40be-2f18-47a2-8325-32feecaf448f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706563563, "uuid": "1b898b7a-d37e-449e-8a49-2bba4e2f127f", "value": "SecuriteInfo.com.Win32.Evo-gen.17664.5060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9837f3-bef5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706567337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567337, "uuid": "ec18b4b9-9824-4fe8-931a-0a7d536ff2ee", "comment": "Malware payload", "value": "f838df75b8246152af74728a058fa8c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567337, "uuid": "7e48ed2c-9098-44af-9cc3-1b27559f1315", "comment": "Malware payload", "value": "655ec713446b922fe8e9233e614d813906c4ce43c4db273180cd8c2c6a79d52c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567337, "uuid": "517ad6c5-b9c6-4e7c-9071-03b667b84f25", "comment": "Malware payload", "value": "3eddf463a67b5a200b0737f4574224250e85068e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567337, "uuid": "42a9abeb-39c9-4173-96f6-9a6e5038cf31", "comment": "Malware payload", "value": "a4aa8e8757c13100d8de88e27873bd07dcada346d7b896348433df132e4fd71fcb6f26ecc26906ed8c85a7cb950db323", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567337, "uuid": "1a5c7f77-1b4a-41d3-a59e-5fc9fe9ef787", "value": "T135F41B56FBBD4272E051C135C9A6E7B5E6B27C855D30970B2345EB2E2F335118E3AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567337, "uuid": "8abb1d0b-a6e9-447c-becb-48d9da8dfd7e", "value": "f2fcd0efb031ebebeaa83cd4cd21090b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567337, "uuid": "4e36a13f-f0b3-46a0-931a-b5336691865d", "value": "6144:nA01NdBRvxQWQSYYaE57iibdoaxQ7cUBmCUiJbc77ZvfuYuEdGxTC2+Wf7xLUnwa:nd/5QWJGibiFShtdGxTC2K5JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706567337, "uuid": "ad0f39c9-cd98-41d7-a6fb-675772735d67", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706567337, "uuid": "00881ad2-b286-4ac1-9f6d-683ddbad1f04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567337, "uuid": "8520f1ec-d1ab-4397-9165-ec8775042327", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9cbedb1-bea2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706531741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706531741, "uuid": "aef194c7-b967-446d-b6ec-3af0b7e146c8", "comment": "Malware payload (AgentTesla)", "value": "d3e39c821fcbe1b4480c4b276e42c697", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706531741, "uuid": "feb0ad6d-f62c-4953-b884-70280630f09d", "comment": "Malware payload (AgentTesla)", "value": "67bfd54ab40149842a8ae6441e886472a8d036a4565fc17a96dba239b8f0fe9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706531741, "uuid": "0beb727d-f81c-436a-b0d4-f04fe5461131", "comment": "Malware payload (AgentTesla)", "value": "3fcaec8036122195682c7394f116211bbc330b56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706531741, "uuid": "1c29cbeb-7a50-40af-9278-6b743b18c0b8", "comment": "Malware payload (AgentTesla)", "value": "6433bdb2a23d970a60335f811a5075aacaf9a4217b680f0a075cef19957e09deb127578865656eb5e55dc15376f6c035", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706531741, "uuid": "cc40b7f9-d8e4-45a2-8023-d22c2eed2631", "value": "T168358C36E391F4E5FE969E7FEB15A1C156797B2B0123802F1E881D78687047D1B2E232", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706531741, "uuid": "ee8d4a1e-7d65-48f8-9096-e790fdd2b983", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706531741, "uuid": "e1ef6f03-930e-4418-a4d0-d9fda8954745", "value": "24576:YAHnh+eWsN3skA4RV1Hom2KXMmHaef9U5Ia5:fh+ZkldoPK8YaefuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706531741, "uuid": "0664e785-9f9a-4e61-be32-abc9f443b227", "value": 1108480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706531741, "uuid": "a8c93b72-16ac-42d0-b3fc-60581aef3d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706531741, "uuid": "a05a1d9d-f983-46a8-9d27-db6036d016cc", "value": "SecuriteInfo.com.FileRepMalware.3460.13412", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b07d4a3-be99-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706527609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527609, "uuid": "f097df56-714b-46c3-985e-361a4a285001", "comment": "Malware payload (AgentTesla)", "value": "124c43b86f381b357f8eb4b986610e7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527609, "uuid": "a18d8faa-3a9e-446b-841f-5db84b0fea02", "comment": "Malware payload (AgentTesla)", "value": "685f0fec638c8fc195d01209dfe9122cf9851d999a28af14dff0b597a0294770", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527609, "uuid": "06d35382-6328-4f9a-a6a0-49c8afe5b05f", "comment": "Malware payload (AgentTesla)", "value": "9e86f0fe7adae6b6e289490d71442a8e14e8db20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527609, "uuid": "b2db45af-c2ea-43f0-bf1c-c27da3a864e3", "comment": "Malware payload (AgentTesla)", "value": "ed5e7736bac2318d41fede8be499f2e3d3c5144d9b1d435e8bef534c8851b024c843733989873392417d16a66b7fff5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527609, "uuid": "97566a01-cb99-4491-b9eb-530e1886fc11", "value": "T171F4120536FC5B53DEBE4BF6642040208372AB677A72E35C4EA451DE0D72F1181AAF6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527609, "uuid": "6eca42f5-9c38-4589-9a7e-8872a88d4ce0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527609, "uuid": "82fb96f4-fca1-4155-b02c-d3794909e766", "value": "12288:MhOxAoIFFHgeg/ckBjC9FMavEkkqvOBYXyRJ4298HstaWDEqkMp3F8vKaUT:qOxAXFxouEUNXV2wsVEqL18vK5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706527609, "uuid": "3988d3d1-8464-4024-8073-8feb9b402c4f", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706527609, "uuid": "c3a7b2df-7f03-49f6-ac8d-3855f142c24b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527609, "uuid": "12000346-c4ca-49e8-9105-7e98f4ef9ab7", "value": "sat\u0131n alma sipari\u015fi 0129.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d39e952-be6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706508393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508393, "uuid": "5ee89f0e-9b33-4d29-b334-e40f06af9019", "comment": "Malware payload (AgentTesla)", "value": "c55e20e5d3bdb01415559f6ac757f604", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508393, "uuid": "8b631756-95a1-48c2-893b-16141c081ddf", "comment": "Malware payload (AgentTesla)", "value": "68bc379e0b8b0e5d4045fa775d0edf9b49f07acafb007ac45326d81394860fbf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508393, "uuid": "090856d1-7de0-4120-afdc-117e90c30b68", "comment": "Malware payload (AgentTesla)", "value": "4c8b3478da576ead318f46b85e3452699c9cb194", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508393, "uuid": "3b58d4c6-3eac-4b93-8c23-f0fd428b9ae1", "comment": "Malware payload (AgentTesla)", "value": "c3e6a7cca1b103dfe57054742656569a0b4896994195a5901f5c488a4a54e5230b1445c3bb774c5c52c57a409f54e6f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508393, "uuid": "cacfae81-2f1e-4b48-825f-58b8ab0cb5be", "value": "T11BF4124733DC5B22C8B98BF9A5A461100BF4B103B102E7985FE431DE5AB6BD18B15BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508393, "uuid": "6e158164-b43f-4ca7-bb73-6aedb4667c13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508393, "uuid": "d1f9a40b-8096-45e0-8601-18ca6d5d6051", "value": "12288:1a1/IoIFFHgeg/ck9YwiHS9Xp2r8vtCGtq/Re8p42I2Po9yb2+nUZTm7D:oIXFxZLSiUnqsr2w9y6+UVSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706508393, "uuid": "a4cbc13e-3e59-4e00-8811-6d256f005948", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706508393, "uuid": "d05735ce-3f80-4d82-ad36-3a584fea56c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508393, "uuid": "48d28929-4607-4c2f-8fb7-78398b0b9cff", "value": "FedEx Receipt_AWB#6355646657577514374654-pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75caf2ac-be91-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706524245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706524245, "uuid": "0e1f324e-fbe3-4648-9762-e26420ab3c81", "comment": "Malware payload (AgentTesla)", "value": "93df6e549484c0cbce3766213319c46e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "raj", "colour": "#8F309A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706524245, "uuid": "e0283921-dd27-4d04-834e-6e21c5bc9220", "comment": "Malware payload (AgentTesla)", "value": "6a0a1e180b4f5e5c202677d23641ebda746e5456a94b25545d70eb04688a4374", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "raj", "colour": "#8F309A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706524245, "uuid": "7b282aba-ddf2-46af-8d97-6efbab05489e", "comment": "Malware payload (AgentTesla)", "value": "bb47e1578d03ae827e2a3966fb0881455dbf1f0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "raj", "colour": "#8F309A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706524245, "uuid": "8a47b307-b49d-4b8e-a9bf-f6daab6755c0", "comment": "Malware payload (AgentTesla)", "value": "a9b0012ea0b85e1418d53b8022d2bbc6233bbb9d2534ccdee17004de00e8b0794b5993e9fb69e7fe93cf655d6a886fab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "raj", "colour": "#8F309A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706524245, "uuid": "77ffb885-7e8c-4494-b792-b162e33cee8b", "value": "T18DE43359BF23242D286839578D5D9C0503020B8529B0AFE6338E878D95F7DEAFEDD9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706524245, "uuid": "8ee4f2c1-493d-430c-9d5a-f75c0a3b5870", "value": "12288:ocwGUtwu0TFqnZMz4I0L+hJGxIYUn1AK2FG1yfngdhlP34H6HMk3Dm:ocwGUtwu0p30ihkxIYUn1EqIgBwHtkTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706524245, "uuid": "2e080f46-7ed8-4b63-b4cc-2898b1a19f97", "value": 686045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706524245, "uuid": "ede5f5b9-f8ca-4cd0-8331-2fb9b6e3a724", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706524245, "uuid": "fa9236ac-732f-46cc-88b8-1406c9293ffb", "value": "Inquiry Doc01pdf.raj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ef2b35-be8a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1706521297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706521297, "uuid": "45ce33a5-268a-4ac9-97c1-849220716f2f", "comment": "Malware payload (Smoke Loader)", "value": "e5dbf324cdf791b9cd939d3ba89d2970", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706521297, "uuid": "cca1f0f7-0216-4ac9-91d9-701762d20cd0", "comment": "Malware payload (Smoke Loader)", "value": "6a684f04b6dc6ed0ca2bc55dec214e78c664aa18ee412fd290e6d543866115a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706521297, "uuid": "744f665e-2358-49f1-befb-72e97c9ee78f", "comment": "Malware payload (Smoke Loader)", "value": "7e19c5052f49f32689d22fa77141137b5d55208a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706521297, "uuid": "157564e7-e74d-431c-867d-bfcf0a63c54d", "comment": "Malware payload (Smoke Loader)", "value": "373ad7e65f50721d2dad512c36a3cf1bcdcfe8ba4c786a47e262a977936b5e2372c2b71bdbab127996098bba9d6b6dfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706521297, "uuid": "f03a0310-491e-4c2b-9ba8-7a9cfc64bba0", "value": "T1C2748D5037ECC4F1E2B719358935C7A50B3BB8726E30A68F7AD56A3A5E347C1862131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706521297, "uuid": "959876bf-ed2d-4fcd-97f8-0397288a66e6", "value": "cd132b2f89f79b212f0c4061c0a4f036", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706521297, "uuid": "12945f03-e140-4499-aece-28946df1f44f", "value": "6144:Pg0i18FzH1EdOesCdFGSRacbvJNLW9Y3fXkAa:Yp18FzH+dOevRaclNDfUAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706521297, "uuid": "fb8cd5a2-b2b5-42aa-8246-e315947d1c0d", "value": 352864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706521297, "uuid": "f6c1cc7a-f823-4e45-9102-44c99fdc630c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706521297, "uuid": "7446aab6-9b76-46ca-9862-9b15f49e3f35", "value": "\u0420\u0430\u043d\u0443\u043d\u043e\u043a_\u0444\u0430\u043a\u0442\u0443\u0440\u0430_\u0432i\u0434_23_01_2024\u0440_UA353348510000000026002229804.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4d26b8-be74-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706511936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706511936, "uuid": "7cda4691-1e60-436f-a2c6-0706272f9256", "comment": "Malware payload (LummaStealer)", "value": "fcc897939f337b97a78d541a94e34303", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706511936, "uuid": "f9131ecd-5e5d-42ba-8028-310b259c29c5", "comment": "Malware payload (LummaStealer)", "value": "6a7afd800f236e6bf6cdaa2fc93869daade49c2b5698bbb39c3d8ecc13d0fd9c", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706511936, "uuid": "27857e86-12ae-4a24-aabc-b8f5a9ec5a97", "comment": "Malware payload (LummaStealer)", "value": "5906e6d4d11804b0ad06c20e1817026aafb014a0", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706511936, "uuid": "43764ea8-9365-4178-8322-4e3aeb726c50", "comment": "Malware payload (LummaStealer)", "value": "3e6f21436341f90651b1a391eb43cdf1528f3630acecb08b009efb1554181bfcec76e6a9fab7c2ec673ab56f5d472735", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706511936, "uuid": "9d3b2cd5-c1ed-4b42-ade4-f7f4631b8310", "value": "T1FD450272B391B43BD63325738A9B5AE3317933781061545F4F881A19AFB82D6E73036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706511936, "uuid": "32ac574b-c5c1-43f3-b867-af752d14c97d", "value": "3aa346d8709331035c6d7460981619af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706511936, "uuid": "28b0bc39-f3b9-4df3-8f3f-288862866584", "value": "24576:M+O08Sh4J81pcXgYlzJd2TJHZl6eM8zV440wYZbTdUsKcQTzcQz8kIBG+YMU0GXw:8tzJwT7VoBTdUBPFAHc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706511936, "uuid": "49f79f5a-26ce-4d0b-9420-23faac5eb9a9", "value": 1172686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706511936, "uuid": "9ffc0b7f-40f1-4556-ab32-aafd6282084c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706511936, "uuid": "eacf15b2-d992-4c8b-a721-f2f685e6677a", "value": "3_scan_word.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896bed16-be9a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706528143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528143, "uuid": "f8fec05c-f346-4eb9-9965-7d25b7868a96", "comment": "Malware payload", "value": "18069ed2eba5cb3edae636e61bef0334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528143, "uuid": "d3875e92-47fa-4246-bc25-e5fd37ce5698", "comment": "Malware payload", "value": "6be83f5f3bc51f6223c76e2ec1bf69d0281ea4efde8f2bf0679739bc63072edc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528143, "uuid": "77a9b498-c8d8-4344-816d-60cb9ab1c09e", "comment": "Malware payload", "value": "0ac7c7d69edc1deabd53733a077fe1474265f385", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528143, "uuid": "9af5a7c4-f7b4-444b-b63a-6ab7ffdeec75", "comment": "Malware payload", "value": "4b32e200f1cb409d557092673c920fc25b2b985db9e9cb592c6e7dcfa649d99fcc452dfbd08ce5c54e1a3c88f7bb072b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528143, "uuid": "ed979338-b867-4a93-9495-601b61b31e65", "value": "T11E05CF12F684C072C26232714E86C3B5A6E5AD70BB35577737D82B3E6E743C18A3971A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528143, "uuid": "38fd052c-40f6-4cc0-a651-9a2954238b55", "value": "b7f2d2fa6957f1a773dabb76c22fa4a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528143, "uuid": "28071379-b442-4889-a1f8-c2f64c00d3fa", "value": "24576:fYDGpx5RWaAYHTrxmUmakIaejOCXnIv6ZZ5:fYDGpx5cwHTVmUmvIas5XIWZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706528143, "uuid": "0e4a4c7b-5d5e-47bc-a895-0beae90bdccf", "value": 795235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706528143, "uuid": "b36e2727-70de-42cd-8f7e-d040a0069bf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528143, "uuid": "a4455719-4d7b-4432-a522-3b8c8e126df7", "value": "SecuriteInfo.com.Adware.Presenoker.16633.3573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28426741-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706520249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520249, "uuid": "3ab47f37-5ad0-4407-aadb-7fc00a6b621d", "comment": "Malware payload (AgentTesla)", "value": "bcc0b41935f136c8b9fb70e802e9e5ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520249, "uuid": "dbec68db-b248-4495-bb80-7b60a4c259f6", "comment": "Malware payload (AgentTesla)", "value": "6e4abc6a114b9b50936426d9eba916fe2a4fa59e9e226ce1c369ffb092d8087d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520249, "uuid": "25ff9bbd-e09b-4a55-9058-2c892ca7e7dc", "comment": "Malware payload (AgentTesla)", "value": "adb5d45027481c53c24206fe231e4352d262a0ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520249, "uuid": "5f55bf6a-f76e-4c93-860c-a2e2056b8351", "comment": "Malware payload (AgentTesla)", "value": "96c0608ff5d438c81be301fa83a72f1503b4217c99a833674a81f8a17ee70cf83eefe1af55b52a27416b85cc2a22dfd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520249, "uuid": "2d635e9e-171b-41d7-976a-64406c46d885", "value": "T1BED423546F21E736C82CE37A501AE0A3A772E5832043B38C88C5B9F36F7F5295652F64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520249, "uuid": "0740c155-870e-4761-a1e2-3f1cc8f05d99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520249, "uuid": "e796d0d4-73d5-479b-83e3-6685aeee158c", "value": "12288:3U3YPJASnwPbU7wwkrBzHxd8+1yy3+3qHiNJ0GzCAQ2G6MIsAcBdVQyTzvvF:3JPFMw0vygsNiGnQbjd+yTTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520249, "uuid": "c1d4978e-eab5-4e6d-b2c8-0e5b8d32c919", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520249, "uuid": "b8b776e6-38ee-4643-b081-b4c05a6e9c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520249, "uuid": "3a468637-8494-4ea5-b1ec-a0c08b6b240b", "value": "DHL SHIPPING INVOICE.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63ff3ee-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1706536405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536405, "uuid": "fa10b3bb-fbdf-41f4-9c98-d1ccd92d8427", "comment": "Malware payload (SnakeKeylogger)", "value": "6d4443427f8685adac6eeb1448248f93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536405, "uuid": "db48dcc4-561c-42c6-ae26-8a02d2c6afe3", "comment": "Malware payload (SnakeKeylogger)", "value": "706c041ad5d324064ea8bdcfb68f81e0fac4b6452d0629a30ce75d84592b1bd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536405, "uuid": "4530da7e-1124-44ed-976e-337c4828bc64", "comment": "Malware payload (SnakeKeylogger)", "value": "fa5bc1820f062cba30d413e67f61531abb96aa3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536405, "uuid": "e28c041e-daf9-46d2-8076-71e1413f84b3", "comment": "Malware payload (SnakeKeylogger)", "value": "20b6ed0cf91ff15e746d98d8742b439baecc0349aa3456d06dd944562092402abe4c14e7118c52b55abd38c7f1ed2c4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536405, "uuid": "2ee6b4d9-1f61-494d-86d9-b9b1f6b02703", "value": "T183156DD1F1908CDAED6B06F17D2AA53025A37E9D64A4C10C5A99B71B36F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536405, "uuid": "78512caf-ab03-4f70-91f7-8830d14e998f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536405, "uuid": "ca301fcf-04a1-4c5a-9293-b1540f12eea9", "value": "12288:JVfAoIFFHgeg/cSdBsV1In4qW6xzsU66kE3fldhU6MeS:JVfAXFxSu1In4F6xLHlfr263", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536405, "uuid": "34290ded-52f5-4a59-8adb-f6c40ec0bd4c", "value": 928256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536405, "uuid": "c5c55478-d2e5-4f7d-a982-4deab41f9916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536405, "uuid": "cdb8c967-631c-4c7d-89ca-b13936817d53", "value": "RFQ-20240129.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20a9bc1-bee7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1706561363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706561363, "uuid": "dbcff65e-74d2-43b5-ae9f-89857c5a271d", "comment": "Malware payload (njrat)", "value": "0b169dd780eb5087eb38ec022ac9a362", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706561363, "uuid": "454bf6ac-6f21-4755-9ca7-af0134d9f95a", "comment": "Malware payload (njrat)", "value": "708575dac27cc61c220278fc0464c884dda2be8870aace5c293f51c909c9f091", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706561363, "uuid": "bf666c9b-04de-4505-aacb-e972dc817185", "comment": "Malware payload (njrat)", "value": "46cdaa08857478f33f4223ae3196ba0e433f987e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706561363, "uuid": "d24ab08f-a4ad-41ad-a471-d1d21f056a8b", "comment": "Malware payload (njrat)", "value": "97bbaf7941ba87f3846300ecc5834f4cb774f167c9638353bd1330ac58aba6a733179273a64d41f6c5eda37b835807f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706561363, "uuid": "747a6350-e32c-42e4-93bf-f6a10e4b8fe8", "value": "T1E1E208067BE94215D6BC5AFC8CB313214772E3838532EB6F9CDC98CA4B676D00645EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706561363, "uuid": "d5da6e04-d08c-4366-84a5-c87e1a16150b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706561363, "uuid": "513c0cfc-aad9-4eb1-927a-ef5c3ddac8fe", "value": "384:y0bUe5XB4e0XyOFHw0Q0mS03AWTxtTUFQqzFthObbB:rT9BuxC55dIGbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706561363, "uuid": "df0d32ca-7c3a-4104-90f6-81cf2b3fa216", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706561363, "uuid": "5a3c500e-7069-4e7e-b73b-4005b401121e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706561363, "uuid": "dc7f4a5e-56c7-45b3-974f-6c53381b3dc2", "value": "x4WkgNphOP0R.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255af9ba-bedb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706555892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706555892, "uuid": "80464aa5-a7f9-47f9-9bb4-20cb8ed862bc", "comment": "Malware payload", "value": "6be5f1ec5f186efc5e068802a1c06f8a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706555892, "uuid": "e40100c0-8678-40bc-ae9c-33a148b13855", "comment": "Malware payload", "value": "70fb9deff166c033679f1425875142e17fb1b243e645d94377a2fb3628197ca8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706555892, "uuid": "22b5219c-e5ab-48fd-97bb-3fbec801feaf", "comment": "Malware payload", "value": "fa7f2ba8ce8c4b3b37d1a85db5d81f0eea8f502e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706555892, "uuid": "82c4269d-a42e-485e-b67d-5c8ac215df00", "comment": "Malware payload", "value": "72784ecd73a034518b84ee0b25ce62d2be68b3116cd2e4cb25dc2a093dc313d412a15ff3001d8966cc0282257034c1da", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706555892, "uuid": "f8e54b21-ad81-4718-a299-3e4c175e2e3b", "value": "T10F35BD5761A20F88C95C21B994DF1F8367A9BF4A051AD38F5335F22F7EB26F8AC24405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706555892, "uuid": "999d7f85-8644-4609-b804-f9c8f74341a3", "value": "6144:1gPikcXCmIuO1XNe8iLqJ1ixyC+uJu8Ueuct95WgfztEfGTDqH93VfFOI0x:mPiR819eE/i4C+0P95Bt5Mfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706555892, "uuid": "23598038-76b3-42a4-a981-4847987b4ed1", "value": 1071926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706555892, "uuid": "710a52d2-5245-4efe-a0b1-0727c245b437", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706555892, "uuid": "8054ec59-f5a5-4ce7-ad06-715ef130a60f", "value": "Photo 24_65.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8bf684-be9c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706529063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706529063, "uuid": "1bb50ee7-cde3-466b-a395-0909c7c0a950", "comment": "Malware payload (AgentTesla)", "value": "63b53532b4267aacb2fab99033d2ea60", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706529063, "uuid": "1d00902f-4fad-4088-bb5f-65e048947122", "comment": "Malware payload (AgentTesla)", "value": "714f11ed7d83f9cd2067675f873f43e76781fa23982832998d9813738e2e26ab", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706529063, "uuid": "4292811e-d5cf-49c2-a007-e94d97941c86", "comment": "Malware payload (AgentTesla)", "value": "f4927de1d1c3b0f8f0b41e0dd64cadc62df32023", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706529063, "uuid": "040a34ab-f50d-4a7d-8201-8428d6ce4e37", "comment": "Malware payload (AgentTesla)", "value": "6b5a2dd7b272292adbb195557b9a70f7cbd34814eee7b32dc4c6a633081f18ef675595678a5412330df9c94caae68c24", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706529063, "uuid": "826075ae-294d-428b-b833-f8d3f00b0f7b", "value": "T1A2F4122436988E0FC5AD05F94403958093F6A0A737E5FFDA9CD653FE16E9BC305A20A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706529063, "uuid": "41ec1715-e914-40fb-b3d0-6a9a8d968464", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706529063, "uuid": "194c355c-129b-41ee-a23b-d01b8718253b", "value": "12288:KhISonTeU3yl7oZgmt3HsnCeZX6Wnb7+NtoTKGZruC:U01OWsnR3b7atS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706529063, "uuid": "3e3b707f-20e3-4769-bab7-a57ff528db8b", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706529063, "uuid": "9be38dec-ce61-4f28-8dde-3d86c532d156", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706529063, "uuid": "d1eb8536-c0a4-4232-a872-bae381ba09d5", "value": "63b53532b4267aacb2fab99033d2ea60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251bf95e-be96-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kaiji)", "timestamp": 1706526257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526257, "uuid": "671ab313-1882-4ace-b8f1-5f33ee071f9e", "comment": "Malware payload (Kaiji)", "value": "5151297cdfcf25d6b9800d55ae9ccf24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526257, "uuid": "0a63c1a3-09d7-4938-8404-589d9bfa5a8f", "comment": "Malware payload (Kaiji)", "value": "72c13b692864e89161075008ece12346ff385cd5632df391a8e209538ca3fe4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526257, "uuid": "c9bbd196-76f7-4a58-80ee-941db91dbde0", "comment": "Malware payload (Kaiji)", "value": "1af7316f845cc113308aa9dc9345ef569a407007", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526257, "uuid": "66a4e94e-732b-4946-af12-92728eef56a0", "comment": "Malware payload (Kaiji)", "value": "f3aaa130f766eab442d194ae8efd53e73f1d694647450b6ad2733520917b5f8bdfd1199096cb823e2eb08f04eb6780b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706526257, "uuid": "feaf3cb6-5e91-4fca-b363-ae9a0ba05918", "value": "T1A6363C4BB8924682C4E4367ABC7D81D473B34EB99B9713666D04FE3C3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706526257, "uuid": "a1a2c259-37bf-4632-a8d0-0b45af58accc", "value": "49152:Dx+8QIc65Q5pjPhDWacC/rzwS0sELVI1:Dxd5c6k5D6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706526257, "uuid": "232cd890-d8e4-4024-a452-abb03f44f697", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706526257, "uuid": "e0c726aa-36bb-497a-9555-b258d01641c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706526257, "uuid": "dcdf9325-2fd2-458f-af25-1994542cf262", "value": "5151297cdfcf25d6b9800d55ae9ccf24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f901961f-be5a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706500842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706500842, "uuid": "7ecc5ce2-242c-486f-a7f8-5bb6308b6eb1", "comment": "Malware payload (GuLoader)", "value": "a6fc2d8611cae0eda7fc1b53495a6b3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706500842, "uuid": "ff7ed00e-8dad-4a7c-84fd-01179d3b2cf6", "comment": "Malware payload (GuLoader)", "value": "7361df98c7cd1e56e0345e61cf68c1d5818d4064269f9b234511c7060e97ad9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706500842, "uuid": "65aa1896-a9dd-4a52-8abd-edcbffebe9fa", "comment": "Malware payload (GuLoader)", "value": "0a8a58bc8bfa8eeb98dca98af8b55aa780f52b10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706500842, "uuid": "81351ded-ad68-4f63-a5f5-00d41e2a397c", "comment": "Malware payload (GuLoader)", "value": "f70326e72e740920f47e6d5b58c4c0009306ce0ab2523e906c7a7bc8b9e95580de186cc2efeaa16d4c8136960ad4cabb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706500842, "uuid": "91570ee4-cdcf-4fca-936d-b8e81dee1439", "value": "T182F533189914E105F00AC1B39B273ABA9F247332D6DB6FF71E119D9D7DB2387988C909", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706500842, "uuid": "e1518362-734e-41b5-be5d-0f5de81c2c5d", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706500842, "uuid": "c2324872-a610-4d4c-8edc-fd691e31b530", "value": "98304:qi++qX8iuivYw7Kx0tJI7dKeZICTTTr1jjxS:xcNuyYw7RtJI7ZZhTTtjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706500842, "uuid": "65de2795-2599-4d29-a0c1-5ddc464f5f72", "value": 3427787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706500842, "uuid": "6fc00146-880c-4c55-801d-a5d0972605cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706500842, "uuid": "049779d3-7d55-4d5f-91a7-4269f758046f", "value": "a6fc2d8611cae0eda7fc1b53495a6b3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44d6dff-bea4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1706532617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706532617, "uuid": "8e023b1d-81dd-4427-b4ac-9a40aea29a85", "comment": "Malware payload (njrat)", "value": "3362c1ba888b859e890de8682faa7b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706532617, "uuid": "38a1336d-ac3b-4868-9a8f-6efabbbd9ca1", "comment": "Malware payload (njrat)", "value": "737f5fb457fa80374ee24900603457d4a43c93a5fe1d438e9e5e5c45b0ea9628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706532617, "uuid": "764d59d4-cd5e-480c-b035-49113d265c2b", "comment": "Malware payload (njrat)", "value": "75139e7a8655f859a0b2504b6da23b02be8bba48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706532617, "uuid": "979a70dd-1fce-47d5-bb12-af3b0ed38c95", "comment": "Malware payload (njrat)", "value": "f114965a3ae1d6bc5e321f96c6219c977975c20630821af8cf742a191f481bb8b36f2370b976cc971f174d35870ed727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706532617, "uuid": "6cb53ebc-a486-4579-b53a-4294a4454bd8", "value": "T15F45A9FBF1E096F3D983383A4235531A1035F6916A228EFD5C66859922F0DCD3FA8653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706532617, "uuid": "a191ad42-27e7-4281-a5fe-b3c7c957b30a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706532617, "uuid": "754f8cdf-6410-42b7-abe4-bab35e619f99", "value": "24576:8bY9GDSyOiHW2a2GxMXDkTt/vd0BFKfW5cne:+m+Qj0z4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706532617, "uuid": "a990908d-f684-4598-a749-88106ac16c21", "value": 1280000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706532617, "uuid": "aa2e86b9-0772-4b5b-b12f-16ce9c6f6200", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706532617, "uuid": "20ba7299-764c-4b2c-b9e0-30a9102cd6ff", "value": "3362C1BA888B859E890DE8682FAA7B1E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dafcfbd-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706520231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520231, "uuid": "7478ee0b-13d4-4c9c-98cc-aae90b98674d", "comment": "Malware payload (Formbook)", "value": "55e94749951612456be16d0c398e45f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520231, "uuid": "03498603-80f9-4419-b8f4-a5754d3c8b36", "comment": "Malware payload (Formbook)", "value": "7393a4ae43ecba45a37af6322bb933a1c04314ae8d92853169b79557b3be9da7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520231, "uuid": "cb276a82-abf9-4c4e-a8ad-7f52650abede", "comment": "Malware payload (Formbook)", "value": "d8fca5bcbc2fc7b0ebfc34e748a61b8624b497a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520231, "uuid": "44954d51-ddc2-4535-8125-853dc2091cd6", "comment": "Malware payload (Formbook)", "value": "1ece13324d00b6181380516d50933bb69fd4426f2a22a7bc683f9fec9c0ca2b02591b40647c8c3bcaa31074d76525271", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520231, "uuid": "2f56c3fd-023f-4554-9e3f-62fe45e18f6e", "value": "T19404AF32D641C071F2B251B4F6BD077B883E0E343295A1EAE3E116E06EA45A5F57931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520231, "uuid": "537e2117-b8bb-47d9-9df7-8cc28c9bafc9", "value": "3072:cHjpjkLeGOSo8737TmqUtaaFtX8d8dQubG1bzyee46w0R:8IT7qqlaFtXc8qC+yeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520231, "uuid": "de071d76-fc80-4561-b1a1-65afeadca7cd", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520231, "uuid": "05e2a3bb-0165-4b87-8c9b-8977c5ba8d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520231, "uuid": "baf2c5be-cadb-4d70-9cbf-094b7a635a7f", "value": "7393a4ae43ecba45a37af6322bb933a1c04314ae8d92853169b79557b3be9da7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea537f5-bee7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706561223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706561223, "uuid": "c75578fc-b0b1-464d-a84a-9042ad06451e", "comment": "Malware payload", "value": "462a3669179d0793467d0450db7fe74a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706561223, "uuid": "458bcd8a-38c8-497f-a9cb-2b8fc07f2ea0", "comment": "Malware payload", "value": "743bdc5c23634ea865a9dce1c91c1e5789536a4cfab40b958218f037a0015ddd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706561223, "uuid": "cef18bda-d3d6-470c-9bbf-e496f9989ab8", "comment": "Malware payload", "value": "5c601703654b4904f8c99dd8fd9c77d8c4e2400e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706561223, "uuid": "666193b1-f771-40a7-9d17-c664ad270736", "comment": "Malware payload", "value": "57879988092fe1fc4730e225ded329dfcaecd212791fbd1dc77523619b12adb4d7a15d0eef5dcf27d97faf37ad5d96fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706561223, "uuid": "74741e8e-dc59-4be7-9060-8ae3eebb4cbd", "value": "T10BC633B5C759ACA9E47513799076ED220433EF366838142D102C313EAF7BAC2A265DDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706561223, "uuid": "8d74c4f3-b010-408a-80eb-21961f0b1dea", "value": "3cfe3c09f2710b7767a2f16f2283cbe4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706561223, "uuid": "6ba7d180-9e48-4b09-8705-a9c39e0cd3af", "value": "196608:JMNpuKuwkJnQYp/k9Bi0SEoymV+T6uZKS/Js+D8LSdng1qBRFLxfL:wpVVkdH/sc9yAuZfxs+oLSdg1kRFLJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706561223, "uuid": "a5f5cf8b-97a6-4b78-8a1d-d734523b9afb", "value": 12454032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706561223, "uuid": "9d88d2e9-91c9-45e4-9aa2-1f634974f180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706561223, "uuid": "e03d2c91-ba9b-4b44-86dc-3f867f0d3fc2", "value": "SecuriteInfo.com.Trojan.Siggen17.64852.25785.20556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657a2054-be80-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706516916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516916, "uuid": "f088a994-4125-4e25-9ed2-9251ce5a3978", "comment": "Malware payload", "value": "33a93c317ce7d83768be259447b9d3df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516916, "uuid": "6632582a-dab8-4831-b7f0-47fc01913775", "comment": "Malware payload", "value": "74c45a5f2ffffad53ca82c3daf94b5c21ef2e06bdbc2e6ecc8128124933cd6e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516916, "uuid": "06acc47e-ecf1-4b16-bd12-31f16abf8a86", "comment": "Malware payload", "value": "55f1130f1d6b736a44a6fece78f196277def9d42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516916, "uuid": "af7e91e7-9ba6-42cf-a7f3-baf5bc87dc7f", "comment": "Malware payload", "value": "c93b67fd1dc7724b12b84d281c97e500d8df358811cbb3e026404fc668dc8f7e5070bd0e3a02d4fc86529e569877d1a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516916, "uuid": "e1a2a649-8414-4468-81bc-5e32933c2b01", "value": "T18EA533D0C7B9A996E2CD103209925A8E0C66DE10F77D5E376270393AFE710D3B9D2D1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516916, "uuid": "dc9e8450-3e1a-4fb9-b5d7-b61b2e384379", "value": "a19bf493c5f635d0ff645592e6428ac7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516916, "uuid": "a1cba567-22dc-4b29-bedc-8435c0f36fdc", "value": "49152:1fUbjQWk7Z8yRYUAts6Kkx8cODtK+L4UhmtRLPZ+r:0jQWk7Z8sj6Kkx8catFTURk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706516916, "uuid": "5626c262-0cfd-4787-bb9b-3020a9c668bb", "value": 2187936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706516916, "uuid": "851dee4d-4862-4cd3-999e-d1a453cf1603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516916, "uuid": "37813179-2b11-42cc-96f3-010405c4156e", "value": "SecuriteInfo.com.W32.ABDeceptor.POOC-1493.4036.24432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632ae579-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706536239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536239, "uuid": "8bee81d0-9467-489f-9e7d-fca6b931d000", "comment": "Malware payload (AgentTesla)", "value": "3e902a2f0a5c02538f27858309c44e71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536239, "uuid": "33605aba-8965-44e5-8618-ba9633becc18", "comment": "Malware payload (AgentTesla)", "value": "75db37564d36a9f7cf79c21a1f69c5acc5149d6cf32f270b7799531b0d8b3327", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536239, "uuid": "a5c1a5d4-a4e3-498c-be8a-676dd7f4dee4", "comment": "Malware payload (AgentTesla)", "value": "e5c42d3dcc966129b35fda066267a98f040b765d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536239, "uuid": "71aed226-83d8-40f7-8c0a-0fb2664d04d8", "comment": "Malware payload (AgentTesla)", "value": "f0c4a25afb16cbd1ea150120438c197fe5b0bbd1a5d4b428d4c165b2b8f97aa456b8a6626bbc5ab0b79eaa8cfcca9d49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536239, "uuid": "bc274094-8f69-4432-9b32-897342568eea", "value": "T1B0F4121122B41F13D87E53FC946125550BF5B016A982F7AC2FE831EE3E767A28B14AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536239, "uuid": "78e51997-537b-4eaa-ba9d-4db11178fa02", "value": "12288:7aFpedTKGZr4NS52Hd5M+Igh/SkjY/oXA9ULcdD1bT78myovhd:Se/r4Hd5H0L9uch98mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536239, "uuid": "670e48ec-c328-40ef-91ea-e95fc6c2e074", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536239, "uuid": "34f7c3a3-d1cc-4276-b314-a909e11943f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536239, "uuid": "425f1a65-c282-46b2-b15b-ca7ff77a97de", "value": "AMM Consol 020-04860612.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30bf18c7-be94-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706525417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525417, "uuid": "9e826d68-0adb-4820-b813-5ab5ccd7868e", "comment": "Malware payload (GuLoader)", "value": "0e4dd56493f3c6583c569c10a49553df", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525417, "uuid": "a381bcd8-31d4-496d-b90b-dd30c1bdb7f2", "comment": "Malware payload (GuLoader)", "value": "75dfb22fc59147ceaddc6d72bf250faa8d31fe316ced4c653acbaacba4eb00fd", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525417, "uuid": "7966478f-b3c9-4b0b-90c0-93e60f57e5d8", "comment": "Malware payload (GuLoader)", "value": "1e4b62e01f602ecd2aa2e843426a870a7d9b338b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525417, "uuid": "49d4f292-9ac1-470e-9037-21e3522d0384", "comment": "Malware payload (GuLoader)", "value": "4dfe63c7aafa8d7d906080a7956f6c5a22725669789202ce35f9668d78c85becf16a617580c0fb6e0f38794304871f76", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525417, "uuid": "dd076597-ed25-4dfa-9c2b-f2e65d3f1666", "value": "T10992D361D7021FEA5E57EB788881A10DC43B46075D3EF053BEB14E58B43688C8EE96D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525417, "uuid": "c089c02c-55fe-46f4-be92-a379f4b9d9a8", "value": "384:d3YIhsSfSN7xcydorrK6/mENun9E9+7Vx3nkRJ64SSYmDi7RwpZo3S:RYIqLNVnkeZJqxSJwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706525417, "uuid": "37f0c30c-5a93-480c-959c-3bcfa9941b20", "value": 21209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706525417, "uuid": "3c83daf6-a356-44a3-8dff-942515378dbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525417, "uuid": "e2899941-0e9a-4ad1-8c2f-ffe70ecab865", "value": "yxzInvoice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22744a0e-be73-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706511220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706511220, "uuid": "584e53bb-3951-4222-9af3-9589dd7b9603", "comment": "Malware payload (GuLoader)", "value": "25ba729a1538d68ad33fe36ca0548181", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706511220, "uuid": "201aea2f-a115-43e2-b944-4585f46ed9bf", "comment": "Malware payload (GuLoader)", "value": "75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706511220, "uuid": "fee3dcd7-7e5e-40d1-8f67-1d9e675da4bd", "comment": "Malware payload (GuLoader)", "value": "1f87157d8d29b9d40b0e1ad6eb4617ba684c8f1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706511220, "uuid": "cd2e0767-dd35-48b5-8def-8739becd0066", "comment": "Malware payload (GuLoader)", "value": "0950304a125f4e41dfacf5ef0d1a7787bf0b88f3daead6ad4fb5d5dc53b3ebb83a4a38e4150e2c3e761ef2bfd872a48e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706511220, "uuid": "b507cea9-a90c-4439-b22d-0cb5935422d0", "value": "T1D3A40153FA2C4B9FE78A8AB23C7D06B56A589F5319106C02B6C4FE2D853234DED026D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706511220, "uuid": "3402fcde-447c-43c8-9de6-f38e9d7cb55c", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706511220, "uuid": "8d01795b-90b4-43c0-9ad3-4a7031d8aeab", "value": "12288:6a7r+1Jt7W+FFqQ5xrW2nPD4EdaMAboDO:Fr+1T7W+7q+CCP8DqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706511220, "uuid": "f3d09650-1ca0-49ca-babb-f90f30544722", "value": 485576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706511220, "uuid": "e2e536d7-ba23-4b4f-b4a8-76cfbc679b40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706511220, "uuid": "4444b35c-8039-4389-b407-aa6bbfb7e46a", "value": "ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725c7210-bec0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706544425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544425, "uuid": "ebbd9406-5ae1-4965-9edb-6d9c7c95306b", "comment": "Malware payload", "value": "1e1a375fe467c638c1e8390fc0887e34", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544425, "uuid": "47d9740b-bd2f-4c9e-ac22-2874e1526d2d", "comment": "Malware payload", "value": "7609aeae15783c429d2f00fe6daaab012eeda05d4f627aa3529c048b2f87d826", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544425, "uuid": "310911cb-f76e-4b5f-8a74-0a4e0f968f64", "comment": "Malware payload", "value": "e3d097067bd4aa56a1f24307a1cd21481686e491", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544425, "uuid": "fb6cf46e-9cfd-446b-9557-1dd6ce5f3b75", "comment": "Malware payload", "value": "2bbb400dd8bdad6ea359d08ad1802d15044a8de1ef50ddc846567a65520bff02715deb30d791769b3de0b7b37feef370", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706544425, "uuid": "e90ef725-0336-4d25-aedd-fac144de3fde", "value": "T119E6334264C81443940F4DE983C4CE2EE5DAF6E4DE1A0B7177E31FDAAE161A6FBCA504", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706544425, "uuid": "d86e2cf8-131b-4d7a-83e4-beb14ad2a277", "value": "196608:QELXUyUVacK8ljCqDQk5FNTgaBR9hWxpyJTyAvJCnF30Eb8Oc3ngNJIE24Xrn3j:xQjjLtvFtT4oZvcF3nbtc3or247j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706544425, "uuid": "52cf840e-84b5-4821-967b-13f9a515ae84", "value": 13898927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706544425, "uuid": "f06566e7-82bc-4b09-b916-29d0df9b213d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706544425, "uuid": "5ea722c8-4a15-4126-a070-fbbd935237ac", "value": "nlg_ns.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96735b8-befa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706569455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569455, "uuid": "1c5a8ddd-2281-45ae-bf6d-12e034c3b961", "comment": "Malware payload (Mirai)", "value": "b70c1e3b204c6b5b706f49347cb1f35a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569455, "uuid": "d37c710e-442d-433b-a880-8fa995a822e3", "comment": "Malware payload (Mirai)", "value": "7829c72ee62b574dbba327de3a60b4063b31851c858327b1eeb05a9740e30456", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569455, "uuid": "d4116280-6040-440d-bb0c-61099bdc76db", "comment": "Malware payload (Mirai)", "value": "3a05449966842a616b2903d7e405528ec64b4e19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569455, "uuid": "ed31084a-b805-4ece-bbed-9e4040acbfb6", "comment": "Malware payload (Mirai)", "value": "49c5b9b277bf8ff3adf5865a8290d6f857c4c689355699cc7a447534ce81cf3e4267fede37d6bd861c1c203545100a07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569455, "uuid": "835077ca-070a-49e5-b19d-883d617d840d", "value": "T1E4C2E191E1B62E96FB766E505A75C2C177B00E9EB777CDD2254CAF0808A321B47057CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569455, "uuid": "4414a0e8-86ea-4059-926e-f7e411375795", "value": "384:ZWez9/6Jgn9yMGEGHV4u/DT8HgPEt6seDYc/OPM4uVcqgw05VxJc0j:AG959yM0HWubJsWDYcGk4uVcqgw09S0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706569455, "uuid": "41aa2662-ff18-4161-92d3-58cd936a7cac", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706569455, "uuid": "45cc8420-4902-4ffc-87c9-4dd37c5ad2db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569455, "uuid": "d0eaea4c-11d2-48bd-bfee-14024f0d6aee", "value": "b70c1e3b204c6b5b706f49347cb1f35a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38edbe86-be54-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706497943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497943, "uuid": "d9d2b0e6-d4ab-440b-965d-78c2313c9117", "comment": "Malware payload (Mirai)", "value": "ad89e6e4cd82f30f28c0ec43408d3541", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497943, "uuid": "289aa96f-e3ef-4460-95c5-cdc3f5d1f1b9", "comment": "Malware payload (Mirai)", "value": "78c1fecac63e9a7b21cf7a55292273f9abe6f3a8793621ed3abb4674b188a78a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497943, "uuid": "1940770d-6592-4415-b8d3-347cb61a5c9c", "comment": "Malware payload (Mirai)", "value": "55d6802d2c33230a80078710949d30285214604a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497943, "uuid": "c187bccd-ca75-41ad-bc32-bab0095376c5", "comment": "Malware payload (Mirai)", "value": "2e09c27628f4e69e7d7e43e254a71a1f77476206007d1b0706cfd5d0f4e45f4dde997b32a1a02f1fb911c5ff40063dda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497943, "uuid": "ee5838e0-9fe1-4ade-9e07-a56498b3e0a8", "value": "T17C538D75D12DEEA8C0424AB4A9598E704F13A0C046733EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497943, "uuid": "5c2d8207-50e9-45e5-a33d-e1b41053fb83", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706497943, "uuid": "13ff3726-579f-41fd-b58b-9cef791ed3ee", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706497943, "uuid": "3228a621-68ef-4448-a6be-a201f6ed0ea2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497943, "uuid": "16bf083e-dce8-4858-a9f6-98fe007259ee", "value": "ad89e6e4cd82f30f28c0ec43408d3541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f49ca51-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1706520234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520234, "uuid": "fa593d8f-ba9c-4559-9e69-01c5a1c5f86c", "comment": "Malware payload (DarkCloud)", "value": "d2c0fda1ece3cc90733e291661a10162", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520234, "uuid": "938f3ae1-1139-4c9e-9fd5-0e86772d106c", "comment": "Malware payload (DarkCloud)", "value": "7950963b742a8b0d9f4e1fd6c642c8b8245a9dc668ce361c9f5390a86c8fd4af", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520234, "uuid": "b8481d75-7c04-4609-88a3-88869fcbf742", "comment": "Malware payload (DarkCloud)", "value": "ec0ea1da845eda2dde1d04e8b715eb8396b4000e", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520234, "uuid": "cddc8495-0828-41e2-a73c-b6dc884cfa2d", "comment": "Malware payload (DarkCloud)", "value": "3f37fc1e8c8ec7ea111fdbfb0c20b69b02b319c9aeffe73362fbc8ba9ab7fcb295e220ae32ebeb5ddcf35238e4dd0042", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520234, "uuid": "ebd3dcb2-23b5-4f87-ae99-c38b9c79fa22", "value": "T17B944B3BE711252EF093C570AAE5925B68152D7A2288AC6BFB815F0931711D3F8F871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520234, "uuid": "a68d08c1-952c-45d3-a67d-cbdf37dfe0a4", "value": "226f58b327f4cdcc7811c48d59aec0b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520234, "uuid": "1a805d37-a566-4b1d-98fd-b3ae17650534", "value": "12288:fZsVxH05ZKUdcXUN71oyZZYo1+jYKkJj6GmZU:fZ6Hqt1oSZYoyYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520234, "uuid": "16b9393a-fa50-4615-bf42-01d1e70ad8f2", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520234, "uuid": "fc2e899f-f88f-4c5e-b910-50de04e9cdbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520234, "uuid": "91036155-7e2a-477f-be3c-101cfcd12c16", "value": "7950963b742a8b0d9f4e1fd6c642c8b8245a9dc668ce361c9f5390a86c8fd4af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93d0460-bef5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706567361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567361, "uuid": "c23218a6-34e4-48ff-9248-d32b8454ebe9", "comment": "Malware payload (Mirai)", "value": "cad51fabf54d146b2d8132d4415163cd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567361, "uuid": "f840da58-863e-4011-ba00-c485b2d83ae3", "comment": "Malware payload (Mirai)", "value": "7a761ed6b4005e7d974295b467c00182a518e9fbc0cd73800dbcff7d95115830", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567361, "uuid": "e82b50f7-2a0e-453f-86f9-a2379a9512bf", "comment": "Malware payload (Mirai)", "value": "9a71a3c9f2503d5305855cdcb87467bdf06648f1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567361, "uuid": "559929eb-7884-43f7-acb0-c884da561fd0", "comment": "Malware payload (Mirai)", "value": "bb1687a2e88571f3446e5b43e9c3da0abe51c0b54dfce051b4437ddfe68be16843043ccfec7abd0f5768a1877000bed6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567361, "uuid": "c11df259-1930-44c6-bdc8-46d07b2108c4", "value": "T176935BC4F643D4F6EC4301B12177EB365B32E0B9111DFA42D369AA32EC92951EA1BB5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567361, "uuid": "9b301cdd-597d-4ef0-b8cd-c20abd707220", "value": "1536:YdCpQW+9VoFj+dMplB36xRSt7nducz4E34S29T6lx:k2P+9FdMpLeRSRnQK4Klnlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706567361, "uuid": "606d6294-e070-4478-ad54-9fe0de91a395", "value": 92520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706567361, "uuid": "83a549c8-41d6-4922-8814-e09b11e32d69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567361, "uuid": "bea99ab7-bc30-45b0-b3c9-33315dc2ee13", "value": "most-x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06f5e79-bedc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706556636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556636, "uuid": "b870f188-83fd-4fb7-b297-b26e39ed5392", "comment": "Malware payload", "value": "ebdcb068f1bb7288a62ffda7c5b862c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556636, "uuid": "7a9d6374-6e6e-4439-8226-e98212c14ba1", "comment": "Malware payload", "value": "7e42300e37601093990b195d7911f0f6225334a78a695f943a59eedf4ab480fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556636, "uuid": "25c18027-f12d-429a-a4e0-7874e43f47ee", "comment": "Malware payload", "value": "0a02c74af2ffa88613b916331f87c855dda32cba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556636, "uuid": "9a10809e-9c27-49c6-9b99-60de07b1e844", "comment": "Malware payload", "value": "8c137027454dfe5b833a733688c0f35156de363a6e66ca056aa067fa43bc79acaa5f7577175f9663d9f21848dd110907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556636, "uuid": "2eec549a-d95a-4243-bf04-1d4f9be29775", "value": "T197166C02F6408039FAD201FAC3B64978EE789F141389A1D383D5B8F96B765D2783675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556636, "uuid": "aa753b87-99d1-405c-9006-301828281916", "value": "b0e06ecdf8487b878b515f6169fa199b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556636, "uuid": "abce086b-bad8-450e-9e93-17ac04796b67", "value": "98304:jOlxyx1rYP44YaQqtGeIEAGoZXvFBfyCz:jOS7dqtGeIhGQXNBfRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706556636, "uuid": "83c0bd56-4249-4efb-a802-c729a97905f6", "value": 4032832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706556636, "uuid": "21d74a19-ca66-484e-8526-f39978522510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556636, "uuid": "eaba5601-0191-4d83-9612-5633e4fb94b5", "value": "SecuriteInfo.com.Adware.Relevant.199.962.841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b670659d-beab-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706535520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535520, "uuid": "222734f5-a31a-4b83-afcf-22f8ab09f7e2", "comment": "Malware payload (Formbook)", "value": "ba4d0b864f488e2c508bf444a19fc177", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535520, "uuid": "7c6ee2c9-609a-4660-9adb-1613e435ec85", "comment": "Malware payload (Formbook)", "value": "7ebf35b6425fa1fe83822ed51ffe79193c3e73c13e1bb6646eb44acac69daae4", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535520, "uuid": "edf76b56-8fd9-425f-b2d0-b385bf325457", "comment": "Malware payload (Formbook)", "value": "5774425fddf2ec431edd6f77141c214420149ee0", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535520, "uuid": "55a4f6fd-99f2-4f5f-88b8-e9966c6a20c5", "comment": "Malware payload (Formbook)", "value": "3c33007fdfb9b62a2589162f2ca15fc7f39da95791435ecbdf3cd22474bbbf8ef01ea65096911a22a14586e721d478c3", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535520, "uuid": "f08dcadc-c54b-4cb4-9354-a0f9ff836960", "value": "T14BE423DED54824C7A3F5ABB7A381F7256C969ACE4E1E488D70BA2036F5D1897C002CE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535520, "uuid": "67f45c92-5749-4053-975d-78bb5895e1b5", "value": "12288:oyPWTQtDtjXcq1hKf9ixmksEkKtNnmEktAaokqE4fsfnLX/5SKq5kb+o6DQNba14:oySQ4WWukKrn3kSfkqEJLch5o6Dea1zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706535520, "uuid": "dc25ec67-8295-4a11-b109-3991ae7eb118", "value": 680839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706535520, "uuid": "0abba1af-8928-436f-9e3a-293849df962d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535520, "uuid": "c4a37d3f-31b2-4219-a400-65901d023384", "value": "Purchase Order.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc37085-bed1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1706551932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551932, "uuid": "12c1035e-8c6e-48ec-ab34-add404571e25", "comment": "Malware payload (CoinMiner)", "value": "9b3430f42a0fb00d014c2fa208662865", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551932, "uuid": "dbb0d538-1c94-42f2-b8da-c0842b548040", "comment": "Malware payload (CoinMiner)", "value": "8062eb6eea56d33e35ea32f6eef98636bbd66c2d177c1889c4f0a960b0d14d47", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551932, "uuid": "54c444e9-bdf1-4e6d-bc94-e56d18308d16", "comment": "Malware payload (CoinMiner)", "value": "09a16508bcc0a6da90c272daa2eff627ccd3205d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551932, "uuid": "44df7398-475e-4016-a8a7-2d882e6ccc78", "comment": "Malware payload (CoinMiner)", "value": "c9d2b83e8363b992475cdbac8c5720a419a9ae019e6329d89f319e29e1fa5a63053fe5aa4116ee31166a00904569b7bf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551932, "uuid": "ae8ca55f-9402-483a-9445-c593c7779555", "value": "T1C336AD04A7F0CE16D3BA233D79765215E970E2237B69A34F7A6C516C2F73B604C81B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551932, "uuid": "5ff8c5ec-2dab-40b6-9dca-e2f3c091a7ae", "value": "98304:CdlaF/1RByjAQG/Mul2rq/aReDkizMeQUh:CdYvkji/Mul2rVe4iwVUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706551932, "uuid": "6ac47c36-8ca9-4252-b69a-20c51c7e67e2", "value": 5068288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706551932, "uuid": "8fdc2cbf-89c9-485b-baac-551997cde18e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551932, "uuid": "4ae14305-6467-418a-bfd9-dbaa5a1a8c22", "value": "9b3430f42a0fb00d014c2fa208662865", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee45e3c-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706536205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536205, "uuid": "33137e2b-782b-4b1b-98ab-5ee72b657aa9", "comment": "Malware payload (AgentTesla)", "value": "f4a17fe4b1def9087284d36209e9876c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536205, "uuid": "cb99e29a-c27d-43f9-8069-dd2f77117d31", "comment": "Malware payload (AgentTesla)", "value": "8075c639f0c44540b31297187ed884bee21d86549080ae9c3cdedfcbeb2f9e8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536205, "uuid": "e9bdc54c-9c28-4749-99cf-655a97386b5c", "comment": "Malware payload (AgentTesla)", "value": "e2e5d191b45dd1bddab84718c7e37624e3df97c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536205, "uuid": "c8fe9da6-7944-4b97-a9a2-e90647373813", "comment": "Malware payload (AgentTesla)", "value": "4fd3385dddc0e34e6496b8d3806835e12a5481d2b1f299cda7f95c9a67735b52cd9dfe36e8b397031dfb7902faba6617", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536205, "uuid": "4b6caacd-8859-4201-a25c-1d5a027499b8", "value": "T1F8F4120636BC4B16D4BF83FC88A522414BF5B46BBA01F7581ED532DE2DA77A04B01AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536205, "uuid": "980f4f6b-40f4-4f29-a772-6d59e0aed11f", "value": "12288:5aFvdTKGZrek//yfVTgTQmz7bREQU5VQ2gQ+pB2Rq5ICC5OLqhixx:A/kFgT7baVQ1MCCDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536205, "uuid": "1c837a25-62e5-4faa-9cd0-901a9e8e161e", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536205, "uuid": "38714937-a069-43f8-93a4-8f7e433d2394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536205, "uuid": "c3c4ba2b-3d8f-42a1-a45d-6bb096047047", "value": "AHA0279349 FINAL DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3053bcd7-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706520263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520263, "uuid": "a393c584-ac03-4049-96da-504743b01806", "comment": "Malware payload (RiseProStealer)", "value": "c055a92471875dfe00cf25a56755e4a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520263, "uuid": "e66ff3b6-1cb4-4ab2-bfe0-1bfad897560e", "comment": "Malware payload (RiseProStealer)", "value": "81330cd1840c028ff5d8429c9875927f7ed9f56ad2e19c5585d0d1a56d5b5abc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520263, "uuid": "af8a22fa-7767-4f1e-b120-1a198413e5a1", "comment": "Malware payload (RiseProStealer)", "value": "322a977138a3d745c544231654e66c39dcda5096", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520263, "uuid": "7ba897f6-23cc-4fc7-8313-796a6699693c", "comment": "Malware payload (RiseProStealer)", "value": "ee1f0c785c082d4101d18b26fe8bccb3ab45a5ad90618448e57a818384c5effe6fd5644f7a07cbb8c0e41d7ee0228a5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520263, "uuid": "6598349b-2db2-4d92-848c-97daa958e488", "value": "T1C94633919ED31499D44E52B89703BD7C72F7BE984641DC5B30AA6FCBC8F3AA8143D086", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520263, "uuid": "c6915e49-e990-48fd-b10e-b20426de2191", "value": "ba3f0285d69796596b811640139d3299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520263, "uuid": "9a11fef1-cb3d-4ed3-b221-d4b7f7ea3bbd", "value": "98304:75zJ5PzE6SBFipobXQXVtuLMfs1DdS873M6OhyVy3sI67sRN+xzy8eDJ73N8JWuz:75zJmBTiibAXVM4fs9dSY3M6Ohay8IQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520263, "uuid": "bfb59611-95a6-45dc-90c0-1bad47f4e51c", "value": 5881856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520263, "uuid": "b3c2f2b0-3864-43f3-9d7d-9fddbb053897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520263, "uuid": "ded7c4f8-a6c4-43bb-8341-c1d4345ba259", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc22c98-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706536445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536445, "uuid": "d656699e-514f-486a-8b64-9e58878007ed", "comment": "Malware payload (AgentTesla)", "value": "e5a757d16cca40c02a7e95edc2705f99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536445, "uuid": "ea869ee8-ef76-4bd6-8cc8-46b1d37dcd43", "comment": "Malware payload (AgentTesla)", "value": "8162b511af920d0e256c6825cabebb94a84faf96f2de6ca032fe4b864844ca3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536445, "uuid": "a32d2891-552f-477d-bd45-cb3ca84bf6d9", "comment": "Malware payload (AgentTesla)", "value": "e45ad62296b952c06e4bc096b32854299e3afbca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536445, "uuid": "5b8c5b3c-84b5-41e2-b32f-47a67526d8f4", "comment": "Malware payload (AgentTesla)", "value": "cc3a02a4da1a801414b97a9a7de40d6b4f87f67127e11a6ba034957241f3021c5caadad5906a2f16fa37c37663065c13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536445, "uuid": "be9bd4dc-f537-4780-a0af-25f4f2d192b2", "value": "T1EE557D95EAD04C9EE84E52B1E935613021A3BD8E6B87D31E959C76793BF330214CBC1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536445, "uuid": "77f1e08d-19fa-4610-b517-bad34ee8d475", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536445, "uuid": "d694fceb-794d-4ef1-b9fe-5fffb738f646", "value": "12288:c5t/v7+A/09ZkhGHXqMFa+alVhLNa2BN9hxyk8Sw2zywWEmucx1odCbf9K:9UuWTN+aJLNFR4f+yFNodCbfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536445, "uuid": "d13cbcc6-90be-45a7-86ef-4c991984cedd", "value": 1377792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536445, "uuid": "0d6da1fa-8e3b-4239-b28c-c4ad52d4f6b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536445, "uuid": "f3932002-5ae6-4d42-b383-c3dcb09c0fb6", "value": "\u0642\u0633\u064a\u0645\u0629 \u0627\u0644\u062f\u0641\u0639.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49500f1f-beae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706536625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536625, "uuid": "4de50c6d-6b35-471c-9bf4-cfa016e854df", "comment": "Malware payload (Formbook)", "value": "4229ed67f3e9643bc255735dcfb26a0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536625, "uuid": "b1cd087f-2528-48c4-bcbb-ae7f84e218c2", "comment": "Malware payload (Formbook)", "value": "81b022045b943341e8ac6b18a9398389ce4663a9d53e988b24ba5c2cd58ac263", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536625, "uuid": "85cf601d-ea5e-40bb-9da6-de0441235539", "comment": "Malware payload (Formbook)", "value": "d28d3fedd0ee64c46d0104b243957db1e8ea0af8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536625, "uuid": "850371a8-c6c6-4c6e-8c49-9327d839cafd", "comment": "Malware payload (Formbook)", "value": "3964a38d7322ccb8f8f100b699140411a096fe2df5abce95abce0ae559651be17f654fdd83c8cc925458c90f2d93fcf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536625, "uuid": "7f8d6efc-e3c6-4734-ab60-a2e325fb6dfc", "value": "T13E3529B8A4B84467D47AC6B19FE69433F091ADAF30604C1D51DAB716177B70238CBE2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536625, "uuid": "3b424848-f2c1-4fb6-a73b-3a820a787778", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536625, "uuid": "a24eeb73-0eb6-4cf8-8187-32d65c166cd8", "value": "24576:0NNkeJvlSp/ZeKB+C3+IZOn29T02UG6wy7hzt0XnBT:0NNXvlCIzCOIZJThshzt03B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536625, "uuid": "1d8b8d9e-6421-42e9-af4f-8116e1353f62", "value": 1161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536625, "uuid": "06d69e00-343f-4ff5-a2a4-4a4a4c6e1723", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536625, "uuid": "55c37a5f-58a4-484c-ad77-742c2311921b", "value": "PO PGD77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f38dcde-be54-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706497927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497927, "uuid": "c277035c-6b35-475c-9ecc-a8995daa2bad", "comment": "Malware payload (Mirai)", "value": "78e5d3738823f9570325914a17949440", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497927, "uuid": "8882404d-f8e1-4b62-bef0-978ffb7d3025", "comment": "Malware payload (Mirai)", "value": "83efe54226d2c32574058d423a9cec47c9abf88ba0fb2cee770ea9d96cba1563", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497927, "uuid": "a997ce2b-1fb3-41d0-97e3-81749a0cac36", "comment": "Malware payload (Mirai)", "value": "b9d67a6504a51654a91cf2690f506df1b223dbb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497927, "uuid": "a8511903-73e7-4ea4-9e33-10223ee68719", "comment": "Malware payload (Mirai)", "value": "1695f161c2ffcce3c2564b24eb0d766f516c8fbb149cb4e6ac213fe83f41bdda2dec4ff044dc59a1e016390620394341", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497927, "uuid": "f43d83ca-32f8-452b-a10c-921c09e11dc0", "value": "T1DA732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502AF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497927, "uuid": "7a1e0986-87df-4686-9ada-c7d1a102ab49", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9Wr:927jqCt8v3GI/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706497927, "uuid": "9249a514-d9b9-41d4-a82b-44a65d271bdc", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706497927, "uuid": "1ebfa8bd-c28c-4607-95f3-da7e63a50d73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497927, "uuid": "20d51a11-a7a5-43cc-99cc-375751b43bef", "value": "78e5d3738823f9570325914a17949440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a175c64a-beba-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706541927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706541927, "uuid": "434cd082-480f-420a-bc56-8fea5bac42d2", "comment": "Malware payload", "value": "191d9742e5c86b11bce909ea771b28d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706541927, "uuid": "f4f257f4-f2bb-4fa8-9ac7-83a7d105688c", "comment": "Malware payload", "value": "8414ecd4e38f5e5f78471f37c42861d4ce853f5557057687e72f753203888898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706541927, "uuid": "6d1f1528-3a6e-45db-9757-49feb16d880f", "comment": "Malware payload", "value": "4c15642fafb10188aebcad96a95c9f184680dd63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706541927, "uuid": "2b293df2-dc90-423c-a1bc-8c6c84e1bb09", "comment": "Malware payload", "value": "1ca2f32f9513aae9b0e0b38b6f9829e568cfddc67c2b2558cb58c10de38f082ebd9ae1b6fbb51d50e0ece1430370e0e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706541927, "uuid": "dc5bf484-d3fa-4c87-a342-d887b0cc10ea", "value": "T1F776F111D741C83AF5A30571843E573AAA28B731131094C7E3C86DAEAAF5BE37936B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706541927, "uuid": "e91d9f28-4e56-48ba-af62-b1cedfffd209", "value": "a00bdf8b0c155b19842a6ccdaa82f2a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706541927, "uuid": "8c2a217e-ca0c-4059-9467-1cfdcc17c94c", "value": "196608:K10ipqgrUDITh91dpN5cLCWhvZm60+JOYC4:KyiplkF0RYC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706541927, "uuid": "40b73aa9-c02f-445e-a725-83c6496b1b43", "value": 7798784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706541927, "uuid": "90fac870-9bda-450f-b9a0-09a18245d0c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706541927, "uuid": "d655dda0-0fa2-4da2-9eda-ff950023147a", "value": "SecuriteInfo.com.Trojan.MSIL.Spy.16804.14985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8caab27-bee8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706561723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706561723, "uuid": "0a1bc0fc-76f4-43ed-bf67-a10554817ba7", "comment": "Malware payload (RedLineStealer)", "value": "0cbab2264a80693ca9a5146acf854464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706561723, "uuid": "474aff1a-f740-4f94-b058-f988ccf0e8a9", "comment": "Malware payload (RedLineStealer)", "value": "845231fc603be5f03d153633d0b49c04ab663de186eaec0d9845b458723398ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706561723, "uuid": "f60a9007-cea6-4316-8200-d2675d500cae", "comment": "Malware payload (RedLineStealer)", "value": "6d1c80db196223d593a14c294b2ba005c793371b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706561723, "uuid": "fa7b52c5-8d81-462c-803a-65843cef39be", "comment": "Malware payload (RedLineStealer)", "value": "62f7d56ea9d4262cc4adc17ad58e8a3a41d96bc8e8aca2ca8f697cda212446bebc8e0316c5956ec37fb67862ba0ffc28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706561723, "uuid": "d1ca3d53-3c08-4ff9-b409-97c35e1d4153", "value": "T1BDB6336807988849C59794BD85E242AE4BD5E62D8DC38F0CFC1891BD3DF9F64D3BA2C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706561723, "uuid": "b27a4784-47d3-4921-b864-622f73df6ccd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706561723, "uuid": "fb13fee3-388c-4181-bb80-14210e73d17b", "value": "196608:Iyg3VTgqi3vqMTVfxWxAnxJlme6K86SpHW205EC/7kvkgah:s+qiCMJfxCmJAF32205EegvkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706561723, "uuid": "27e15553-9609-4379-9c1e-2accf29e312e", "value": 11133440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706561723, "uuid": "05c1519c-e57c-4b4a-8e31-126ab1a112ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706561723, "uuid": "94e8acf3-cb18-4b98-96fb-602358eabe84", "value": "0cbab2264a80693ca9a5146acf854464.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55869fec-beb7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706540511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706540511, "uuid": "1715eda2-f1a5-4925-abf4-afcabd140b10", "comment": "Malware payload", "value": "3e82bfeac437e980128a2c4a20ae3476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706540511, "uuid": "d3712c34-c38c-46c8-90ed-e69b0c0ce473", "comment": "Malware payload", "value": "8491cf2b3f890741217a24b70085eaeb44e0fb1569dcbec90068421f6f392b7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706540511, "uuid": "b6db6dc1-3670-4e76-8e4c-c17ad1a4b67e", "comment": "Malware payload", "value": "1c7032cc2bee357e1f9ebaf71e139b2ddef927e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706540511, "uuid": "3fb0c6f8-f481-445f-88fc-80fec98caebc", "comment": "Malware payload", "value": "51edc6af947e4180dd9c1bd635886235b5755d6103de9e4a85af51e437b453ae7c8bfb2a5b4320b8597222e219463602", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706540511, "uuid": "c97d6af6-5f21-4057-bbd7-c045d5ae1bda", "value": "T1EBC63B8412CF82B2F466192434E6FB51053775B3AFDC4E77127E4205CBEE94618AEB8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706540511, "uuid": "18bd3043-d97b-4786-86c0-dfae5b1552ba", "value": "a2f7d5da8de44a360aa79bbf87e6cdae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706540511, "uuid": "61340d7f-7508-4b73-a3a4-2df166ed64da", "value": "24576:X5zbR7a/Wz8zmsOVIWEmepB958wMQqSxvZxBqSf9gOB5HfmNhSLtIQtKIoORyVh8:xyWzIDVDfhxgSVgPhAyVhVHSvFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706540511, "uuid": "95b3b433-94fe-40f7-ab7b-3a7405741fef", "value": 12294656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706540511, "uuid": "3a1b47f4-41e7-48b6-a322-372116e18bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706540511, "uuid": "eb680a3f-b0ae-4006-b117-bfe1f75460a4", "value": "Main_instalador_aut (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6aa2736-bed0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706551385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551385, "uuid": "fb0709c4-cb23-4519-af3e-19dba6870b00", "comment": "Malware payload", "value": "2a00384b6fa60fde55a901744d868a5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551385, "uuid": "fbf55650-c3cb-4e93-9609-84e1f87d2c1c", "comment": "Malware payload", "value": "84cb1813acc6d49a1144b00c568fab550f322d7f51824dc9fcf12fb65552f002", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551385, "uuid": "1e6a74de-0314-4400-b06f-5446dba1f287", "comment": "Malware payload", "value": "66500c07e3e276fbf4bb4f9c40918f261c426f2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551385, "uuid": "3111dd3c-4c8f-41c4-aaaf-a063a609b6e1", "comment": "Malware payload", "value": "dccde85b20427184816c7636d59ad207515e96c04f3ca3a3a670e95e10e4b7e7b880fd5e346739a48e97f99e33cb34a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551385, "uuid": "e0b6d39a-35d5-4a5f-8e11-5993c14da12e", "value": "T1C1F4120033EC570BE4B547F6361686808376B52A68D3D3DE9984E0DE22B5F458E9EF93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551385, "uuid": "6cc7598e-53a3-4260-96bd-a6bbb67cce6e", "value": "12288:AqTKGZrmuAp56MLaMEYQaxJlckdH+wTj5s8rMxArHEm8Z32IcjOAFBruhbC7:JAp5DL1Eu7mS9soHrHEmdvdFBruh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706551385, "uuid": "55398d9d-5f0a-4e44-9f53-ed6f52cd27b5", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706551385, "uuid": "be20259f-1f25-4d09-8323-9ffc290033c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551385, "uuid": "a4e0df96-986e-4851-9bdc-fb04bc3ea7ba", "value": "rRFQARMC-CO-RFQ-1565-24-4500000000000000000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08bd36d-bec0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1706544637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544637, "uuid": "01c53537-7086-4ba3-967f-d559abbd53a7", "comment": "Malware payload (Stealc)", "value": "6af4b8b8c8399fca6798e3f2d7df9af5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544637, "uuid": "fa3ccccc-8d5b-423e-9158-9c2733a90f7e", "comment": "Malware payload (Stealc)", "value": "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544637, "uuid": "ebf2cdff-9440-4a2a-8026-bcea686a06ee", "comment": "Malware payload (Stealc)", "value": "7cc85c826668d6f09b43ea9358ecdc57fecf398b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544637, "uuid": "382c8702-1b8b-41d5-a04f-7e5f8ab97e84", "comment": "Malware payload (Stealc)", "value": "d3495290558ba7f205fcfe7e9ad95a46be18b5a99bdfeb7d613e8f3b6b49cf68292de5608d822f788b7c190a776a6663", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706544637, "uuid": "8d7195fd-dfb8-4884-bfc9-3c6910bc552e", "value": "T17B76F1413CBF351EC2E19F5F85BA45D9CD729D01BD010A270BA690084A4BE51EDABEBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706544637, "uuid": "219c1fe6-258c-45fa-b11a-13e4d5b5e0fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706544637, "uuid": "6f574ee3-4018-44eb-b8bb-117943a49063", "value": "196608:pv8GpkVa20mO8hnsSSU/sYE7m/TV38zQF5srpXh+LyDU:zythO+1SNMGcF5svH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706544637, "uuid": "f2839400-9f29-4e5c-86f0-8dae08a0ef5f", "value": 7656448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706544637, "uuid": "fc62059a-578c-4da4-8378-e8fb3e5cfc4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706544637, "uuid": "6258ef11-ef52-4dfe-a3b7-641835658a00", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4981be5-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706536456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536456, "uuid": "cb38fbd5-a15b-479d-85fd-304b9039ab8a", "comment": "Malware payload (Formbook)", "value": "579cbfeb161f97ad8345dfcea7647585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536456, "uuid": "061bb6a1-5b81-4e7d-9514-c8100e646e0d", "comment": "Malware payload (Formbook)", "value": "86bcb41719eaf10ef517a169b8b11076459e2ba3310dc560bb71296d7cf90d4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536456, "uuid": "a20ac998-a52d-46fc-a2c6-e7f61d301072", "comment": "Malware payload (Formbook)", "value": "ee1f3058611e977a96c68dc3515366a932729eaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536456, "uuid": "add1c5a8-07d1-436b-828e-972f627a52c2", "comment": "Malware payload (Formbook)", "value": "7b64253f515bf9a65683c6090f9143273bb20fcbba6356786a3a5921a51e42c9b590189c53664bf7f78a1fa8199d818f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536456, "uuid": "dca886b2-097e-4bd0-b688-e8cdb6608e90", "value": "T1FD3529B8A4B84467D47AC6F19FE69433F091ADAE30604C1951DAB716177B70238CFE2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536456, "uuid": "cb6a9688-0894-45f2-8e09-25042302db1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536456, "uuid": "a6aa2b70-8d11-4cf1-874c-5e668d850c23", "value": "12288:ldN3ETzP1UZvWzI28YlgQGhrBb40QPI0+CNO550G3rNo9sprxwWfYKZKtbv:bNVZ6P9D4zQPI0+CcTxEurWWfYKZKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536456, "uuid": "63cfede6-cae1-47a4-8d12-a2204a418f5e", "value": 1163264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536456, "uuid": "0c92bd67-3e95-40d6-949e-bce024385ff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536456, "uuid": "b13c2a33-a7dc-41d8-9dee-6ea7400607af", "value": "PRICE ENQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82136754-be78-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.InstallCore)", "timestamp": 1706513528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513528, "uuid": "50266a97-7607-47dc-b3d5-378d3327311f", "comment": "Malware payload (Adware.InstallCore)", "value": "1c6e9d6cb4ff54634ea6cc03c7039562", "object_relation": "md5", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513528, "uuid": "a574a1e8-4998-43cc-ba32-75fad6ffadbc", "comment": "Malware payload (Adware.InstallCore)", "value": "8751db0625064e68f7d24f82eff9d41a898d98c42f4a458b82f00da61600208f", "object_relation": "sha256", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513528, "uuid": "8c2afb5d-4fbe-456a-aadd-ea86f7c4d97e", "comment": "Malware payload (Adware.InstallCore)", "value": "006a45b89ab34ac9a31865f4caa732eefb55c3e2", "object_relation": "sha1", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513528, "uuid": "743d6b02-fe98-43f4-9043-a84b01af953e", "comment": "Malware payload (Adware.InstallCore)", "value": "a156b6f4016cc62dbd50df8271b133bf00c905c66153a47522ab86c6c7f4c6f6994fd8e6e2e751509c4385022942a52f", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513528, "uuid": "754542d6-8750-4b87-930e-33c669bf382f", "value": "T1BA27338185881B74D251BEFE9EE856CA66F7EF48995E8025B5642C4F8F2E1C3CD0336C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513528, "uuid": "0e1a604e-4aab-414e-aae1-d9cf4c2392f7", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513528, "uuid": "db3d02b8-d491-428e-99a5-c976afa49c72", "value": "393216:xPXVEivkMpc3+rRPkPZD+F6MpdBaxqeRLucUht+s1HoaMD2hG:1VEivkMc3URP+ZDa6MitLulV/MSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706513528, "uuid": "73047405-cc53-4875-8381-8340952f3295", "value": 21774296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706513528, "uuid": "40821fd1-35ad-41e2-9f97-9ff5965d45c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513528, "uuid": "99895a6f-9f66-4c95-acd4-5b5756e592e9", "value": "SecuriteInfo.com.FileRepPup.31108.24617", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6868bf62-beb0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706537537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537537, "uuid": "3b6cef7f-5bfb-4efc-a2bd-0f447012ec74", "comment": "Malware payload (GuLoader)", "value": "46c8bcdb437d0fdcce53f6bbf213b8c3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537537, "uuid": "035d2768-98ea-4e85-86c6-84a2b0ed4aa3", "comment": "Malware payload (GuLoader)", "value": "899e783777a260261f8cbe473f52c4059dc7259fda8c3d58318c90ef97796bd3", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537537, "uuid": "17adcfd6-035f-4b60-81cc-e748792e82d4", "comment": "Malware payload (GuLoader)", "value": "fb6ec3c1da27f448e04b454063f5db1ad76c4402", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537537, "uuid": "ad934661-5806-4196-90ee-44baf5ef4bb2", "comment": "Malware payload (GuLoader)", "value": "ba7e806d90b57e5f49a67973dcbe437dce4bd10a29369c593535832605170fcb2a1649e28d9bfe6c3bd968927585336b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537537, "uuid": "722276e5-1f57-4bd5-b8cd-58edf960693d", "value": "T1062308A0EA99C61BC94E3F4DE8B33843D1AD9DC1D1035555BE885B4DA006CBCA3BF61B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537537, "uuid": "257e6f3d-e7af-43f6-8e64-82832ed90c89", "value": "768:WjmHvVB7tMD8mGvdri4lJkPEFvk2nWnBKzgCDcoClGUwc+JLDyfU2yLcsGdEUebK:6mfWWic942fSyolubrD6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537537, "uuid": "77f3b88e-de43-4c14-bc62-453483c511a3", "value": 47642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537537, "uuid": "c1e7d828-ff75-4af0-8061-e91305dda953", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537537, "uuid": "3ec5f54b-0123-4b7a-8e4f-6dc38157a384", "value": "CERERE OFERTA BAT3774673747747637376636 29012024.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522061a2-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1706536211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536211, "uuid": "10e6e157-169c-434b-a808-ab4c2df113bc", "comment": "Malware payload (NanoCore)", "value": "4f6f1efcec692a45edfcc8a0563672b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536211, "uuid": "1222ced9-df1e-423d-b6dc-576a5b139758", "comment": "Malware payload (NanoCore)", "value": "8a29c80b0cd5df46f57f94c8934bccb49663e1c2311670875aa1ac48004fbea2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536211, "uuid": "982fd9c8-9308-41a8-b4e1-de5721c912cc", "comment": "Malware payload (NanoCore)", "value": "d1fe03e95c319da1aaa0019173b01a521a2d0b4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536211, "uuid": "8693a9cd-0912-427f-a219-4d1cad49272d", "comment": "Malware payload (NanoCore)", "value": "8ca770281e52785b51dce9f3061b3b8fdc5a1ccd800e8b42b380ea472bc6c1aedc2b4ff44c61843c2310882aa320fd16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536211, "uuid": "d4f8d8cd-4e6a-4cdc-8ee0-5713fa116301", "value": "T19AE412017BA8CB36C9BE477A16319141A379BA1331A2E79CD889E0DE1D337C1C54E793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536211, "uuid": "6a6dcfaa-6e2f-433d-a8dd-5dbf97c22be3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536211, "uuid": "c7c9c39c-7d64-4509-869f-ae42005bc209", "value": "12288:hMvhIeV6fU3YEc8fU13sz2bLXDHGjW67gE9bxY2dXXX4uehiwbzZ4RQJYI+y/2:hMvh9eJofu3K+LLGjW60ObxY2d347w+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536211, "uuid": "c5f4286d-fef6-453e-b7ee-fbd4a8453c06", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536211, "uuid": "a9989fdc-08b2-4253-a3ea-1189d10ec00e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536211, "uuid": "66668634-c238-462b-b99e-5a31bea6c0c7", "value": "4F6F1EFCEC692A45EDFCC8A0563672B3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee88161d-be6e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706509415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509415, "uuid": "deff0859-af4c-4e34-8f8b-9185d1d95880", "comment": "Malware payload (AgentTesla)", "value": "5d81f7185321f81f604ca44e42330709", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509415, "uuid": "fec8444d-c644-41a8-8b50-7b79cba6b545", "comment": "Malware payload (AgentTesla)", "value": "8bc39a6fc6d44ebcccb05b6ec9e28e30ae0dd779f627b071787a76cf9f95b9e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509415, "uuid": "d0dac061-99b4-412a-8138-d8ac04cfa2f4", "comment": "Malware payload (AgentTesla)", "value": "d4730475a70cfdb15bab69a5ac4df71b04f740aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509415, "uuid": "89e8928f-c7b9-4218-9038-1b8887474338", "comment": "Malware payload (AgentTesla)", "value": "395adf6de148d0291989b1df59eca2848a69e2dfc40e41b4542dae039de0daeb9ff5722ffb497dc429e81520fb9055ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509415, "uuid": "ed9beaaa-91d7-48eb-a35c-ee6e29ea3eba", "value": "T16505BEAC3650B5DFC867CD76CA642C64AA5064BB530BD203A05716ACDE0EADBCF251F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509415, "uuid": "ea8e44ef-cf5f-44a7-970b-3124e7effa86", "value": "12288:s/maWTqkJSmTKGZrgBtEIYhvohtwZlFB4hmiH2hMp1Ocbl7fzHED8lCiK9PbTYZU:seFTqTkegDhPlMhrHSEbVjI8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706509415, "uuid": "9b3637db-b481-423f-80a9-823bfca6db0e", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706509415, "uuid": "b28dec85-3fe6-455e-951b-5c933c76733e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509415, "uuid": "f5b6b610-e7ec-49c7-be93-441f681d9ab6", "value": "SecuriteInfo.com.Win64.PWSX-gen.22152.27647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ccb15f-becc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706549560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706549560, "uuid": "4cbbbfb2-c74e-4e0f-9cf0-13d6e5031b46", "comment": "Malware payload (AgentTesla)", "value": "a6d61b03355321eac1a5a442cc38446e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706549560, "uuid": "64083904-40ee-49f5-8ce8-77c50ec1ff30", "comment": "Malware payload (AgentTesla)", "value": "8c89e4051951ecbcaf76f27359a05ecaa5579ec384be3eb3b8abd09097ff9577", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706549560, "uuid": "d6795cc6-27fd-45b3-b81f-7b9c0f74b2b0", "comment": "Malware payload (AgentTesla)", "value": "cf2f823a3dc858cc7db3f52a9186ad1ca2fff835", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706549560, "uuid": "cd059700-5d27-4d92-9b61-24dc72579be0", "comment": "Malware payload (AgentTesla)", "value": "4c5d31e66135a271655ecf45b8df47ea93b591b5faf5069506fe5a498e35f8e8b2748deafccdb7018b2e9745adbbf31c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706549560, "uuid": "0050e596-6d37-4e19-82c6-b33dddac58e2", "value": "T1D7E4124137FC971BE57623F66264A14007B2AA1960E2F7C92EE060DE1971B044E7CFB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706549560, "uuid": "779c4520-362f-431d-910f-0c789f26aa21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706549560, "uuid": "d550fc49-7097-4bb9-bcf5-0519491347d7", "value": "12288:LVGoIFFHgeg/cBs9mNFU8EQBl/GFX45kZIuII84BifksjvlhAClZQqeUcfKavF+:BGXFxaINF+x4z4BiMsjvluCAzVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706549560, "uuid": "59fff504-fd98-4cb4-ab12-9bd9334320e8", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706549560, "uuid": "1b2565e2-325d-4372-b9d0-880346898dbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706549560, "uuid": "179267b5-69b3-4394-b90f-3ea1b2f4dc7b", "value": "SecuriteInfo.com.Win32.PWSX-gen.4826.5402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a8c2f0-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706520246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520246, "uuid": "2eacddf2-2cf9-4c80-a1dc-70a73f57a558", "comment": "Malware payload (RedLineStealer)", "value": "0c431234b71f3eb8a9021eb2bafaf749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520246, "uuid": "f1e2668f-35fe-4b9c-9c99-36158bd0b6d7", "comment": "Malware payload (RedLineStealer)", "value": "8d0b2813abfdc8fe4a5fedb11037c577075c0d235ffb18231e7ae2b80f1cd9e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520246, "uuid": "06f39aef-ee04-4fb5-8ab5-829b063b3268", "comment": "Malware payload (RedLineStealer)", "value": "39edaf5e18f42bf27b58f6c32d2997ef46ff1a47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520246, "uuid": "61fc7d21-5d66-4a3e-b3b5-e5fdd70069f9", "comment": "Malware payload (RedLineStealer)", "value": "1e80517ba7c66c3546ca358d4d9bd0eea2caa9ce17e48e20ea0059776488080a626e197485f0993be09dc5094cb23113", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520246, "uuid": "9224c5cb-ad97-4e05-962f-60d476a227e0", "value": "T1B855AE02B7C08065FE7E93B36A7AAA11567E7D6A4033D41F178C397979B31B2123E253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520246, "uuid": "0deb7694-22c4-4f1a-afbd-8b285941d55e", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520246, "uuid": "5a960e61-8b61-4565-be73-f814096f33a6", "value": "24576:tAHnh+eWsN3skA4RV1Hom2KXMmHaR4ImXExFSTrEh5:Mh+ZkldoPK8YaiIm0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520246, "uuid": "6b19190d-cd2e-4a5d-84bd-67f519eaf76d", "value": 1370112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520246, "uuid": "a2fe2e70-97af-4a4e-b708-de8b7d7d0fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520246, "uuid": "90c6917d-a69e-45e9-b3c2-731cd8ae2bdf", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604708be-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706536234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536234, "uuid": "86ab5be8-90de-46dc-90f7-da833df80a15", "comment": "Malware payload (AgentTesla)", "value": "915b01e52065ead97fd391de3a466891", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536234, "uuid": "76a8f9a9-bc9d-401e-90df-1a71c60eb76c", "comment": "Malware payload (AgentTesla)", "value": "8dac191856d2684130a6b963bc83e538e2ec12ee43481728693419e885f4ae1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536234, "uuid": "605bb399-14d9-43ac-8ec7-25233b44d399", "comment": "Malware payload (AgentTesla)", "value": "abffb2d5286e8133bfbdd671454aabd38b9cccd3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536234, "uuid": "1a8a7e38-779d-4ac8-b305-5821242699f0", "comment": "Malware payload (AgentTesla)", "value": "90bd3b9622c6f1ce65ee2f916561853fc31e22aad3e844bf4787159dd8cd3d36b11702d0c6d60ee97767e41653c7a129", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536234, "uuid": "ed01fc82-9e03-4c4b-95de-70cc4370787a", "value": "T118E4233E31B81E13C9B806F62422024493F16AA79A52F7C80CE166EF66D77D14F267D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536234, "uuid": "871b7fc5-f379-450e-b9e6-40b70f1c718f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536234, "uuid": "2406790b-40c2-49cb-9740-96eb8bf421ff", "value": "12288:ssTKGZrC0oYjIZXEjAbbz0ZcwW2E73q3sey+uvJeQ/6XHwuQqgdo:H7Af1Aceyr0/XHbMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536234, "uuid": "7dba94fe-1b1a-48cb-be7a-1e89c8b54242", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536234, "uuid": "d12fe007-8001-4152-8f2e-3c5bbaebc70c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536234, "uuid": "a25ef58d-801f-4dde-af5e-65a61607656f", "value": "eFyGWzlTF6vN3FX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d19789-bec0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706544589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544589, "uuid": "9be09979-6403-4501-90f1-548bc45dfcf2", "comment": "Malware payload", "value": "f1c700707adffb52929de6dff72b2840", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544589, "uuid": "6af7f458-3afd-4e35-b203-f37da90fd3bc", "comment": "Malware payload", "value": "8e12fc5aa85d6953ee731203e945ccacc4ded6a8aa9752c7331dcc17da501eae", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544589, "uuid": "dcc2f8e2-2de5-441d-bbd4-6fdaa56d9501", "comment": "Malware payload", "value": "190f21ef796aee07a2b4f906e7b2f7d915b18497", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544589, "uuid": "600738cf-44bf-413c-bb0d-03591ad72db7", "comment": "Malware payload", "value": "0ee39dd688436895fb9ff0df224cb8bf2b117d9376e185bf13ea23299f43702401a582f39d01615b1e0c510b97f1948b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706544589, "uuid": "84d6ee3a-7d8a-4dce-86d3-b8406aa78ea4", "value": "T138E62311A6878536D15D057BE59CEE1E0879BF73473102E377F93CAE48F18C2A2B9A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706544589, "uuid": "74d9f47a-4a30-4a54-a1cd-0755f6962923", "value": "196608:shhhkmqs4WU7FaOO13cdK1J/9V91xg9idpE1Qhv4RF5HVwZJfYabpY78vAdt2yT:sfiY6pg1MKL9O1QhAr1VwZJf9jvAdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706544589, "uuid": "a0c8d413-5c2b-47d4-bb3c-c34cd2e678de", "value": 14688256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706544589, "uuid": "c3d099ac-cfdc-4410-973b-e27e8b054e66", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706544589, "uuid": "73a101cf-f047-4b73-86f3-a7015b4ac16a", "value": "nlg_ns.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c507f223-be98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706527384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527384, "uuid": "b5e87d59-631c-47d4-9f4e-f37a6777175f", "comment": "Malware payload (AgentTesla)", "value": "18d893ed6a5e17809bf05ca38a5f42a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527384, "uuid": "9f15d1ca-1f2f-42c0-9f44-ea61bb187f2d", "comment": "Malware payload (AgentTesla)", "value": "8e460726e55cc361f649b13026117c7a4726ce387a14f6c6ae42db4e521fbcc3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527384, "uuid": "9dcdf0a8-0997-4949-a070-bbfd754e0ca5", "comment": "Malware payload (AgentTesla)", "value": "2d46b5d68c8bb296b3f171b885babeab47caadf6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527384, "uuid": "7f484b21-e881-41b1-9532-6379df1956c1", "comment": "Malware payload (AgentTesla)", "value": "0123486b54c37f5a17d7bdfe142b702603975d8a847f0bc5f342b26349eb51c21d7cdff79a4a22a17a7a75a1c0738271", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527384, "uuid": "55bb8565-d2ff-4d22-85e4-3dd8ebce8207", "value": "T1D2F4122232EC3B13CC36D3FCA0F466619BF8A1163012D3A85FD134DA2976BD14A51AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527384, "uuid": "1466c4d4-8861-4694-bd6b-616c7417b569", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527384, "uuid": "84dfc1a7-1b15-4368-8833-9f6e782071a3", "value": "12288:Aa1DIoIFFHgeg/c4V3xtnY51ouyuqdp8+mZAtAEuCtYIZ0IorTYTIV3Lhii1p/st:vIXFx4V3DY51/yuqdq+mZAt8O0ZrTYTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706527384, "uuid": "7b134ab7-f637-4fa2-8155-e82453061c84", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706527384, "uuid": "134baade-bfda-46db-ba7f-60eb17cc6c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527384, "uuid": "ebc9c7e0-09e6-4db6-96ac-f9f788e50520", "value": "DEKONT.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd14047-be87-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706520149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520149, "uuid": "b5cfd7e7-6828-4306-835d-61bea0174198", "comment": "Malware payload", "value": "3d2f39d88c375a4da6da5da773516c1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520149, "uuid": "34d8e206-5e36-49e3-99c7-8279e30fa843", "comment": "Malware payload", "value": "9065ebf849e9760d8431921c07e372a83850b0350de1545ae1fc82335e13ca9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520149, "uuid": "c36f3425-68f8-4734-86ca-4a943e5bb777", "comment": "Malware payload", "value": "61ffcb6224bf6c8faebdc2c09c753f0663de3171", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520149, "uuid": "2b805cd0-da99-48f6-bfa4-eca2d356cf53", "comment": "Malware payload", "value": "980352a1ff8c0e86405e9bd1f51436df1000b6cc1e00172a4547c537f6bb2009a46312bd1b640529d6dbde4432ab2498", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520149, "uuid": "a5360283-e082-4b50-b4fa-3ba6ac14060e", "value": "T1DA52E78493EC8335EAFB1E392C7255E505B5F6A69432E79C4D9CE1CB1F92B800C22727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520149, "uuid": "2085fb2a-e0be-46a0-856d-9b1d46ba798e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520149, "uuid": "166de21e-cf81-4a6c-9f6d-d484d340dbd3", "value": "192:AVd/lE1CBTJyIz7+iLuAhUxZ+kSiVFG9K/LHdbM+MQmtXOUGat+nWcV1c6sAOw8:EdtyCBTJM+UxEG9KQmAfatk1BsAOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520149, "uuid": "f19c5725-b0f2-4cd2-9364-0ded547b766e", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520149, "uuid": "728417f3-5374-4cce-805e-e9b5bbac0a85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520149, "uuid": "d10e17d0-4006-4008-8800-14ae602e95b0", "value": "SecuriteInfo.com.W32.Inpat.exploit.21196.4736", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfdd646-beea-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1706562618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706562618, "uuid": "b67f7935-d0c8-4325-a512-0754aaf54e91", "comment": "Malware payload (njrat)", "value": "16b465d91f52c1d0f888d99119a7c752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706562618, "uuid": "dbb04631-a194-49bd-bcd4-740e00fec187", "comment": "Malware payload (njrat)", "value": "92e708d23030bbd065df078ad27b17030074857bcc4ea5a297628c794230783a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706562618, "uuid": "f0672ab0-5503-49cc-a3e8-c4e037e8bd4c", "comment": "Malware payload (njrat)", "value": "e056b10a28d375d32ce68b851f1033a2089a1016", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706562618, "uuid": "dc2f9a68-7f76-438d-8dbf-fbec1a8d63ca", "comment": "Malware payload (njrat)", "value": "a72ff615ac1d83dd3bd548c3fdb30ca0bc026ca3f2037bc5e6e10d23fc5ccd63fd695d20bb274ec02765dcd7459757f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706562618, "uuid": "c68986da-65aa-449a-b4f7-75fbb9ff57b2", "value": "T14E03294D7FE18168C5FD1A7B05B2D41207BAE04B6E23D90E8EE564EA37636C18F50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706562618, "uuid": "1ce93189-db46-4129-8c80-b369335113da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706562618, "uuid": "86bd33ec-cf33-4e27-9816-dbed703242c8", "value": "384:eNgKCiMQB63fbw6ZfrZUy8f8UvXRgiN8JurAF+rMRTyN/0L+EcoinblneHQM3epj:rQ0DwODZX8f8U518MrM+rMRa8NuCu5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706562618, "uuid": "ad13468e-0bfb-4771-855b-3cdd05a55f66", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706562618, "uuid": "973bd368-c286-45c3-a696-c8bbfb9213d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706562618, "uuid": "d34cdbcb-67c2-4574-a8b3-3bbf9e895efd", "value": "16b465d91f52c1d0f888d99119a7c752.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68f5a4b-be6b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706508086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508086, "uuid": "8698198a-b723-4785-91d2-e4a9586aa468", "comment": "Malware payload (Mirai)", "value": "e797ea94711828cc244cbb05d630a3aa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508086, "uuid": "5699aa2c-6699-439a-b5f0-a74ca79533a1", "comment": "Malware payload (Mirai)", "value": "93af21ac957be9ec707210e229cb367af0d0bca2c1fec3a72423dd838a442cd3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508086, "uuid": "4f380d79-f29e-4dee-874b-2cadbf2a1372", "comment": "Malware payload (Mirai)", "value": "a0f2ec64a9455f3cc944fcf473aa24bc7dfe46d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508086, "uuid": "e1088ce2-dfb8-46f7-b390-3526be0221e7", "comment": "Malware payload (Mirai)", "value": "f9b094df2ac2dee03862f13dc329395bdd84fde4318e4558fea8efcaed7ee4c0d805a9c47076510d83973ce98f37e78d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508086, "uuid": "4e52a843-71f7-4e4c-8906-d41b17b66893", "value": "T18BE31945F8504B23C6C212BBFB5E428D3B2A57E8D3EE72039D256F64378A85B0E37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508086, "uuid": "ded6cd68-4843-405b-8c09-e5373ec337e9", "value": "3072:i8KXZB/FFoOU11EHH4l21GeiimWoOWVMxc:i8eFuOn4l+GeiYoxVMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706508086, "uuid": "516a6b7e-5c0f-4eae-b6fb-66d69a6c4e72", "value": 146176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706508086, "uuid": "ad6e2d79-4f79-45bb-9f7c-727bc488a91b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508086, "uuid": "4fa2fa35-66c4-4a2f-99ee-66d23f7dce94", "value": "huhu.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a16f137-be6e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706509112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509112, "uuid": "019298af-4142-4d85-a2d0-b516adb720fc", "comment": "Malware payload (AgentTesla)", "value": "40fb0c718118f2e57554ed6ac3baeb9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509112, "uuid": "f5f6940e-dcbe-4ee1-ba00-a57db8960e85", "comment": "Malware payload (AgentTesla)", "value": "93bc53ac6666ec7e8baed9fe226b218b6508260a82ffd3fcd923f7f5b556593f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509112, "uuid": "eebe2daf-bdda-49e3-be67-e328e4c690ca", "comment": "Malware payload (AgentTesla)", "value": "edb470ece953a6b5799cf51bba7fd12b2833d99b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509112, "uuid": "af9ccde6-79b3-43e8-ae6a-78ce63fe14a5", "comment": "Malware payload (AgentTesla)", "value": "2220c2e2b56c239ac2d481fb9805f7e8ff0e91bcf453e3ce53faf4a111a4c3326bae11198bdec225c63ac0520df42737", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509112, "uuid": "765f2fe0-87a2-4614-8a47-d3bead8597a8", "value": "T14CF422263B68BB02C8B99BF8212051144FF4B52A7852D7AD3FA070FE1B67BD14B545E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509112, "uuid": "2659d432-75fe-41dc-a30f-128e9ae1967b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509112, "uuid": "99527b27-ab64-44ec-99b1-7b5867aa1d3e", "value": "12288:ka1OIoIFFHgeg/cGf+rRB6npK6tp+abMLj/TOGy2r65ohzKnkB/iD5H4:uIXFxGW1+btAiMn7Ok6vnkB/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706509112, "uuid": "5e0347f0-7533-46d9-abae-c9339810327f", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706509112, "uuid": "e5adfd0b-05b5-4972-8286-879ad72a37e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509112, "uuid": "bd0b1580-398a-4343-8cd1-cc846e5775d6", "value": "MV TNYK TBN 1 - VSL'S SPEC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5b937a-be3e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1706488638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706488638, "uuid": "87248cf7-4a1a-4632-8465-07406bcfaa11", "comment": "Malware payload (AveMariaRAT)", "value": "835241c48301a5dc36f99cf457841941", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706488638, "uuid": "95bb9df2-6c57-4c18-900c-b7b8543fb639", "comment": "Malware payload (AveMariaRAT)", "value": "94048358360fd46766cdf1d4f487c1c61a391f97ebc10704c388170ae4e66b88", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706488638, "uuid": "4abe6de6-f0e4-4a29-afe6-f452d28a4771", "comment": "Malware payload (AveMariaRAT)", "value": "a7e4ca83dd2f310a5d8eed4f2bf77ed16922c36f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706488638, "uuid": "03f67c85-812b-477a-ba4d-6884e1fdd102", "comment": "Malware payload (AveMariaRAT)", "value": "dbc2756e8522b419a4a6364aa60c19fa16c1f1b5a040e2741af63843aaac909ab1f8de78a6f7a8e6c7a46644a3693639", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706488638, "uuid": "9c22023e-0b73-497d-aaef-55222c27e11a", "value": "T156C3040AB7E80A08F1FE4F78A9B14540AB71FD475D12C75E0AE9A14D1972BA8DD20F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706488638, "uuid": "fa71f7a6-af2e-45d5-96a5-3bcd50e7990a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706488638, "uuid": "186790b0-0ce3-43f2-96fe-0233bc831ff2", "value": "3072:wBompkTyo7nSATq9bac6oYhBJbJeBQK+qwkPr:koLTykTq9ba5oYRNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706488638, "uuid": "5856cda5-2215-4590-a01e-787920add42a", "value": 127432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706488638, "uuid": "b0ffc3b3-65ab-4844-8952-38bc10544034", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706488638, "uuid": "7274ef27-bf81-4839-a4f0-426c4a7c7772", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e33d7a-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706520252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520252, "uuid": "71281daa-a707-4a37-9372-22af0f169064", "comment": "Malware payload (RemcosRAT)", "value": "d960aa523dd2dd3201381fb9277c1803", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520252, "uuid": "b269c690-1ff5-4a28-ace4-474c08fa0654", "comment": "Malware payload (RemcosRAT)", "value": "9495e0f3e772cc191122fe78219f48ecba27aabb814d9c9c5116e019ff37dbf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520252, "uuid": "890e5790-fdf6-4c1d-ba71-f4e3d7d44edf", "comment": "Malware payload (RemcosRAT)", "value": "6262b358b3fad4e989ba1892f2fd3c97ba75103a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520252, "uuid": "2d2f72d3-1b07-4a89-a668-2bbd60a73513", "comment": "Malware payload (RemcosRAT)", "value": "190f52bfacf3a3f13c83d2c838c122e2410b9c4c644054677070dd1165c610e6cf2b7f1592420849e98862122593ee68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520252, "uuid": "db27f281-dd81-4f7a-a862-b71a2e796575", "value": "T13E65BF0273B08121FE769A33DB15AE094E7D7E28183B943F225CF964F976162127DED2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520252, "uuid": "1c36e656-96c1-4672-b539-9cfc12a3c6c2", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520252, "uuid": "37e25349-65d8-4c99-a01d-a74f8bc27c99", "value": "24576:5AHnh+eWsN3skA4RV1Hom2KXMmHa50Pc6SK6Q7/D58dytw7r5Y8zCkIvj1Ro5:Ah+ZkldoPK8Ya+E6mQ7/2sqprm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520252, "uuid": "ad334bf7-5691-4061-92fc-cc62e55166c9", "value": 1541632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520252, "uuid": "1a26c3a8-39f7-4d04-be2b-3c10786d3add", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520252, "uuid": "c144bb98-cc2b-48f3-8146-b68ae6b6484a", "value": "FG6560089000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "459bf68e-bec9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1706548216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706548216, "uuid": "675e4434-2f9a-4458-a36d-604f8819a54b", "comment": "Malware payload (njrat)", "value": "db233ffea612bbe08005d8236ce00221", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706548216, "uuid": "383c7b94-7841-4080-992b-ddb16d34c40a", "comment": "Malware payload (njrat)", "value": "94b4fabc94167b973206a70a2c5f1cee73fecbc7ae3876b817e0cac833325b71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706548216, "uuid": "d597bf5e-9c5e-4b37-80db-b2582eacc81b", "comment": "Malware payload (njrat)", "value": "3e7ab6a547ef1260de5169b9a261ad7441fae82d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706548216, "uuid": "7f790f45-303d-4f88-b75a-8df90bd12393", "comment": "Malware payload (njrat)", "value": "afecb6c19ee99a70153a8e2be12b53c2a9f91d0bd18cd7a95c279c8df84657db1013866cd7a394815efd1c3397a329c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706548216, "uuid": "dd6fcc25-cf84-4b0e-a22a-0c9753e56c35", "value": "T194F3EA6B76888F15DE5428B1C4DFA53003E0ADDB1B32F34E7F48366919423E75D4AACA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706548216, "uuid": "51df721c-b25f-4151-a992-ccb6d41e39f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706548216, "uuid": "bc822838-0fc8-4920-941a-644403990cef", "value": "3072:483rOCIZ1Y0m5Ys/Bdx0i5kQFVspX7iLt1YFAGEwXaqdpj:r10mqkXhkKE7kYFVK6pj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706548216, "uuid": "c33bdf17-6a31-4a42-8d85-8e63b6bb41a2", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706548216, "uuid": "3f8bbdd7-28fd-42ca-aeb0-78364ec95e0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706548216, "uuid": "b0572fc6-2471-4bf4-aba3-f632f04e6af0", "value": "DB233FFEA612BBE08005D8236CE00221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9400867-be81-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1706517539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706517539, "uuid": "f66a1970-b5d9-422a-83f3-426bed74bd2e", "comment": "Malware payload (AveMariaRAT)", "value": "23ca02d6eac5914157aca2a48d95e35b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706517539, "uuid": "68c1c4b0-495d-45a5-b0fd-2cbb1a43c0a7", "comment": "Malware payload (AveMariaRAT)", "value": "94f836d1cd5bfe8a245a0b66076c86506f53b2fae38ed5da7b2f13cfa07b6cac", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706517539, "uuid": "304a2aeb-a399-45fb-baca-78da2ff84058", "comment": "Malware payload (AveMariaRAT)", "value": "ff152a0ee7464732af7eb21f586a1c0f1f5ee929", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706517539, "uuid": "f07f0b4c-c11c-4106-a8c3-ffbb734f225c", "comment": "Malware payload (AveMariaRAT)", "value": "84c1cb47a839d6bd86015dc4ab965acf45bc2b40386f68aba2342f51003569ebf394ca559aa747f61b2730495ceac235", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706517539, "uuid": "e7abe851-5cf1-45e7-940c-92ce6425b3d5", "value": "T1DAB39E13F7E54835F3B201B01ABD7E7ACFEDF9700628849FA394858A2D31946E925397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706517539, "uuid": "afcbda93-d509-4a52-bbdc-37bed2c9ab12", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706517539, "uuid": "c12c8321-6ca3-452f-8387-898c245d7a8d", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706517539, "uuid": "f23dfed9-f2e5-4eba-ab90-cee2c5b37dfc", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706517539, "uuid": "a957953d-196c-4006-aa92-1bd4c375f292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706517539, "uuid": "28d817ad-a103-4eab-ad57-e7c07c7a4255", "value": "unpacked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c568ed5f-bf00-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706572052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706572052, "uuid": "e4bdb440-205f-4cf0-acc2-244f8d1d38cd", "comment": "Malware payload (Mirai)", "value": "1c86e96d5837c5b8f1e015f5e7dbc496", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706572052, "uuid": "da2a434f-ac2b-4725-9ff6-74bc62fc3c2a", "comment": "Malware payload (Mirai)", "value": "9666872d3749fc0af018c73d6f33f41983bc958bedb254d0d84cf66e1d070be0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706572052, "uuid": "d01e571e-b47d-45b6-9d7b-13cb4f210dae", "comment": "Malware payload (Mirai)", "value": "f6314ca573f9fc459bce930a8a7bb207e57cd621", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706572052, "uuid": "7dbcbb0a-24e0-4d12-aa87-eaf1f7e3d882", "comment": "Malware payload (Mirai)", "value": "a01256a8685297e2ec7021bc4228a2c14f15d5635e1a061ba38d1a2790e753fe25f1c5052939539f8e698ff69f381cec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706572052, "uuid": "fcba7f7f-dde3-44e1-802b-d51a21a9fe02", "value": "T18CD2D0AEE4B542C5FD4E5C3EC08C3FA10E1AE581231BDB966721CC4D5B32C5AF16A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706572052, "uuid": "771bd53f-59f9-4337-af86-8325cb9b29ef", "value": "384:n8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orj3obRWGVCz0NvF:8MYHb62x4ahQ3CfdwLja6WA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706572052, "uuid": "ecfe9962-2a68-4552-a073-56fbf62c3ac2", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706572052, "uuid": "90149324-03a7-40ad-8cf4-a7b3e6620b17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706572052, "uuid": "b66d73c9-dfbf-43f8-b17d-cb594438a7f7", "value": "1c86e96d5837c5b8f1e015f5e7dbc496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36719c4d-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1706520273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520273, "uuid": "ce2c931e-c1b6-4104-8876-3de80914949d", "comment": "Malware payload (SnakeKeylogger)", "value": "4168d882eef97a3b96233f5d585a76aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520273, "uuid": "a06cd84b-ed57-4e49-a44e-8a793bacd77d", "comment": "Malware payload (SnakeKeylogger)", "value": "9760f95030f8a3303ea6f028a872f133707ed0d8417768d9db410cd8adaab4cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520273, "uuid": "3ce24320-44ef-47a4-a53e-1890ff720e93", "comment": "Malware payload (SnakeKeylogger)", "value": "9bd9bab17f9da27dbb8431a2cdb34f73f0eff6ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520273, "uuid": "285f4ce9-9765-449a-bea7-d48745743553", "comment": "Malware payload (SnakeKeylogger)", "value": "bd1293d42666b865e3b1a124d0f39fcf78febbfe4605960edf06a37473bccd879c5df9783e0c1bfe5a9cf1ff2d294365", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520273, "uuid": "51b58ae0-53d9-4706-a039-0babd10bd3d3", "value": "T157D4121133B85F66C8BA87F991A051040BF4E12234A3E38C1FD476FE1A637C19B655EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520273, "uuid": "e4c19ae7-70b3-41f6-922f-8869b61f6047", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520273, "uuid": "9eba5b7d-b88c-41d2-99de-d7eceb314c75", "value": "12288:da1ZNIoIFFHgeg/cmLF0b72ulvEWxjxvxXa+WS8yUH6hbKOGkqAE:SNIXFxmB0b72KVjxvx7WOUHIKb7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520273, "uuid": "48ee58c5-d250-4666-bae2-49416b6ed6ed", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520273, "uuid": "11f12568-c2ee-44e3-ab5b-f5d10ddfa09a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520273, "uuid": "ec673b97-c667-4682-b92f-9ef2a9f7715e", "value": "Scan_20240129_174047.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2166cda5-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Neshta)", "timestamp": 1706520238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520238, "uuid": "6fe3830b-da9f-4e84-a82d-35789996aa0b", "comment": "Malware payload (Neshta)", "value": "36fd5e09c417c767a952b4609d73a54b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520238, "uuid": "4668fd06-3e34-43c4-a93d-529eeb6ce494", "comment": "Malware payload (Neshta)", "value": "980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520238, "uuid": "ba67fcf2-5e9b-4be9-8ee0-07f7af5512c0", "comment": "Malware payload (Neshta)", "value": "299399c5a2403080a5bf67fb46faec210025b36d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520238, "uuid": "77e6b8d9-2776-4970-b50f-f99395b8168c", "comment": "Malware payload (Neshta)", "value": "7dee0b708935989eb39e07ec798fc6c05e7e6933815d5ddbd459d0dac7fa5590e35daf3cf721e8124e9deee5c7c5b025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520238, "uuid": "7cb1a299-062f-425a-9995-69e64f075342", "value": "T18C135B56F6E18871D0301EFCDC1A9268D53B7A313D3A2AB2BAE90D4DDC6D3C12D1C54A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520238, "uuid": "595deae7-b450-4b49-a760-7306a27625c9", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520238, "uuid": "9846cc55-1654-4b81-96b8-57ae297a6e7e", "value": "768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ:JxqjQ+P04wsmJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520238, "uuid": "f9fb5276-1d56-4ae5-8345-0e9a939fab1e", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520238, "uuid": "877b0ebb-0a4a-4de4-bce9-6a9f1be01aed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520238, "uuid": "714aa7de-fe2d-4ec7-ac63-457d1244b44f", "value": "980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701fb652-be9a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706528101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528101, "uuid": "f064376e-42ac-4976-ab28-eefb8103b9c0", "comment": "Malware payload (RiseProStealer)", "value": "500c13f40a8c52595a83e0d714184846", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528101, "uuid": "1ea56459-c9a9-4fa3-9e4a-4ef6a12e0048", "comment": "Malware payload (RiseProStealer)", "value": "98d57e3ac4cde0cc27eb00b7fa1be7d1a826f1fb94d9f99da5460ed486c979c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528101, "uuid": "b1c8c710-0f58-4623-82e5-a92ebb57f7f8", "comment": "Malware payload (RiseProStealer)", "value": "5793216ddce7e9bc45678babe8fd669ad5981d7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528101, "uuid": "09aa3038-ee10-4d4f-a068-1bbf858a89a3", "comment": "Malware payload (RiseProStealer)", "value": "6f4f07355f2ad7c5c2e8fefbe00c2999958fe3070c750372538f039dc31f6c293917c02b5e2b3ac5329fd96581c6b613", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528101, "uuid": "3d5aca7e-eb67-4b11-a1dc-d42891b2a059", "value": "T1F4B533F5123226C9D8073F763B514A82D2BFBDAFA5A1A6406C50F1D18B7CE381B1DE61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528101, "uuid": "721790ee-0003-489d-8eac-c03b57e13662", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528101, "uuid": "29de8e17-a1a1-4f62-bc3e-7c62644f261b", "value": "49152:Nid9XS1vO1qvtwaGbDhjHQt73kMBd1FVJWXr1JzDp0w:C9XAq3Phs10MH1CVpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706528101, "uuid": "fbb74779-76c6-4f09-8dd0-2e4fc60ed0c8", "value": 2326016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706528101, "uuid": "d3567808-8507-452d-b30c-a64382f26b7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528101, "uuid": "204ae0b7-e2b1-48af-a90d-dce32f82f225", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8466ddda-be9a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706528135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528135, "uuid": "9a0542ee-8e3d-4361-a06a-a2f791899ff1", "comment": "Malware payload (Formbook)", "value": "3a1c5b80a85e1090db1e3d4c8f01518f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528135, "uuid": "5cd4ba03-b55a-44f2-b344-923e8ae607ce", "comment": "Malware payload (Formbook)", "value": "98e103bae737ea4cefec5080d2197b73e035bcc4bcf1a5bb458d086a4d74dd9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528135, "uuid": "85ff97ba-8fa1-44be-9d0c-9c15e83ae835", "comment": "Malware payload (Formbook)", "value": "b396ff7c26b60925bbddbe0cfc6c988b0885a128", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706528135, "uuid": "2643f90b-50e0-498e-8457-f0da99973199", "comment": "Malware payload (Formbook)", "value": "93fd3a77a7c7c183285c5bd9aa94e1ed31c5713f28b5a392ea687a610c4086bff7994f2fda350b80ac2d68dc93089c84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528135, "uuid": "61e4aa5d-3bba-4768-aece-cae7648cf8f2", "value": "T120E42390BEE7ABBDC09144F6BE3F392085264CABC29537C89197BC55A93E7E020774D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528135, "uuid": "aecabd9f-4aa4-492d-ad47-7ea20954de8b", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528135, "uuid": "4a585ed5-f887-4794-9845-3fc8e325947f", "value": "12288:cYV6MorX7qzuC3QHO9FQVHPF51jgcE/Wpn5Gm+ozys1am8ymAziyTyFU:7BXu9HGaVHHnUmUJmNmAziTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706528135, "uuid": "82191f5d-f17e-4fef-a5d5-56898d0df52e", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706528135, "uuid": "95071195-5370-46ec-8b46-c4eea3a35ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706528135, "uuid": "4a354ad0-6e8a-474b-a319-8f97d3a0d96c", "value": "SecuriteInfo.com.Trojan-Downloader.Autoit.gen.17028.8482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3275e9c0-be4d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1706494926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494926, "uuid": "04a64a90-7677-48ff-87e0-e46825bdb253", "comment": "Malware payload (Amadey)", "value": "3eedb7ab4ab81081e6fe25b117d4698c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494926, "uuid": "a4af9687-3005-4507-8b46-60b6699301a1", "comment": "Malware payload (Amadey)", "value": "9a992de6256ebd4206d07cc5916011ef631d9798161de0a05ff1c114bbf241d7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494926, "uuid": "8b47eb2f-c1a8-411f-abb2-72a0f429a16f", "comment": "Malware payload (Amadey)", "value": "20540442599ee9f254f3b7adfe116c2890cd227d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494926, "uuid": "74a5aa8a-1075-4313-9d78-5387219450ec", "comment": "Malware payload (Amadey)", "value": "36b74f2a4864fef02a11225e7ecfebba45e37f0e782eea6df3b2928c62e6c077c1249b94e5a4cef599ee84a91a98fd97", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494926, "uuid": "79643eb8-c2f6-4c51-8e03-091b2929c12a", "value": "T1D0E58C21B7431066C1920930A969F73AA3ADF7382F3B46CFD6D4BB181B750C27DA5A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494926, "uuid": "57e08aad-8ed1-4a4d-bfe7-7799d6c08d76", "value": "d23c86c9d3ac46531744f2f8aad907e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494926, "uuid": "a3ad88f3-37a5-4a0b-adc1-25247e8f2f0a", "value": "49152:ehsWom5L52gTmt+XMnJO39/34+DCTeenrfQpGHu4HSZWYExaO3s45O7ZdyAbm5NQ:eyPi2gTmtyMJO9/o2CFnTQ2jyZWYExaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706494926, "uuid": "c528c92b-9fd8-4165-a0af-4b51dce3e03a", "value": 3112032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706494926, "uuid": "30594fef-37a3-4d56-b77b-5577878f7e31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494926, "uuid": "5058af70-b8e9-4ed0-901c-d6d498eca1b1", "value": "SecuriteInfo.com.BScope.Backdoor.Farfli.2656.4301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33478c99-be4d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706494927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494927, "uuid": "43dd49f7-1424-48b0-9330-415afa28a344", "comment": "Malware payload (RiseProStealer)", "value": "9efd6bc4b3b7916cb3a851dc834d0d51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494927, "uuid": "57f34a71-7fec-4c23-aca1-28bc0901f453", "comment": "Malware payload (RiseProStealer)", "value": "9bf2c1249f73920b734b831350d0310ccedbea5f926e4a582067a7621701aa08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494927, "uuid": "788acf3e-87a6-4a58-a8c6-87adf8ec8670", "comment": "Malware payload (RiseProStealer)", "value": "d1de7ad7768bdb04887c7a57018b7663dab98f23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494927, "uuid": "f89cf4b6-1306-4130-89c7-4973593651fd", "comment": "Malware payload (RiseProStealer)", "value": "3d796605c72d5e08ac674fc9584ebf4cccf2ea16c7e9ef44877183bdaa156f278c01e8309a7efe2be2e4173aa30686fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494927, "uuid": "53af8e49-235a-4b4d-89ea-b6a5c3d43e5e", "value": "T161B533D2CE7A6519ED6F0778D321C781A0B3FE2B568000252772F489BB7F1B64B06D99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494927, "uuid": "2ae407db-4c2e-4512-b780-81a4bcf08f4f", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494927, "uuid": "c35f5e1e-974b-46f6-b4b7-e4ead6e691ad", "value": "49152:Z50UnAFtdpu0WSz7g3A5s7KbCHvTjbYy3dXMTT2Bum037c45BxgZ:Z50cAFt60WSITK+PTPYy3dXMTT2Bum0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706494927, "uuid": "27d76376-4890-40ec-85e7-3b9c45f5e22b", "value": 2374144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706494927, "uuid": "6f12911b-fafc-4171-85fc-984840c762fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494927, "uuid": "e4144d93-7085-47a6-9d74-9270b2903d94", "value": "SecuriteInfo.com.Win32.TrojanX-gen.14369.14939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7b8346-bec1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706544684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544684, "uuid": "90793a1c-9e0e-48df-8350-71adb6a0794b", "comment": "Malware payload", "value": "4b2e289610400400a87a347ac2010c59", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544684, "uuid": "63d34256-f7bb-4390-8028-a38322c5b5dc", "comment": "Malware payload", "value": "9c71b3dd94329b2649fd36ccd5f0df919126284883543cff573e103076ce3506", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544684, "uuid": "e71886c9-ef93-4e32-9aca-c82e17c81bf4", "comment": "Malware payload", "value": "b8ec5f89be7282a376e1026afdf68ed46753b978", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706544684, "uuid": "282173c9-e95e-41af-a5ae-eb7057d25f26", "comment": "Malware payload", "value": "298e59466d73fd4e4458d461f0c12ce61765b61fa31e4b59b52a0fcec90ca826e9cdd6bab6834256a5ae48227305fd25", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706544684, "uuid": "b058723c-0404-4c92-bf3e-b48b04e5e370", "value": "T148067A3F6E808429C53E823AC3928B0C953367695B72CCDF839015B95A57FC25F3AB56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706544684, "uuid": "415c3b61-484a-471b-b11a-acb9c2d8f76f", "value": "49152:9pUPW9qhCxzT+WKjSXVRzLVI4s2kF6Wua/tB2KJP9C9/q6ZXc5vpSOCH7p76yTJF:9prCQVNLe6kcL+j2CP9CaCbp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706544684, "uuid": "b5300254-4ce0-4958-b319-aaeb5769b45e", "value": 3936256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706544684, "uuid": "012e0adb-5013-4c3a-9c8a-325efa3a8c5c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706544684, "uuid": "601fd959-9a8d-456d-bb90-2f1d6ded2274", "value": "reincarnation.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c45920-be96-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kaiji)", "timestamp": 1706526551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526551, "uuid": "ac1b7ffc-03b5-4635-b01f-97061c5acee4", "comment": "Malware payload (Kaiji)", "value": "5c4f7d5d95cbad84fba3fc3e31610ec0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526551, "uuid": "99babe23-1860-4967-b7fb-e7a62227ed22", "comment": "Malware payload (Kaiji)", "value": "9c947ab29aeb2861da8f609549e2034c55ba35ba21456ea8fceb494248466e57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526551, "uuid": "604c2f6d-f991-46b8-af35-edcb7d3fc4aa", "comment": "Malware payload (Kaiji)", "value": "2856db08e898a1c0b5123eff87e2f695084bffe6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526551, "uuid": "b4258e0b-10f8-4c21-b953-28e690785bda", "comment": "Malware payload (Kaiji)", "value": "40703e48922ae08c32c527741a89687428bbabbba70e42c22af2a28aea5e76658fa1c005c5bb3e5fb2d79a544487cae8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706526551, "uuid": "e505df70-c34b-40ab-b07b-c26a96bfc7eb", "value": "T13556E815FCC82BB6C06D9B7585FA8E6163701D085AF14B262254FAD8BC762B4BF07C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706526551, "uuid": "aa59485f-d281-461a-9c7e-5871cfa2e2be", "value": "24576:6JrAMcOevzvfoahgV72qbQo5eDX5Wx4s3Y5iTNC2MUjV4E3oh2Dcay52jnxtavae:hDzvxsXwAf2bwPZcG00w1I1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706526551, "uuid": "f4cb124a-55f7-4274-b089-7b102dc1b4a2", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706526551, "uuid": "34715af7-6e54-42d2-8797-d68ab805f1ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706526551, "uuid": "a8919e48-1ab0-4a2b-81db-74264db683bc", "value": "5c4f7d5d95cbad84fba3fc3e31610ec0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b40c1f2-be54-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706497893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497893, "uuid": "8467a46a-66bb-482d-ada4-b1b556e12bc1", "comment": "Malware payload (Mirai)", "value": "d3ef8a75fda13adc5988a2db300c79a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497893, "uuid": "76b4bf12-6d61-477d-be82-381de71cb934", "comment": "Malware payload (Mirai)", "value": "9cd48280a1f022e6cc2929298706f347b2520954d5f441cb67a1ecbeb42084c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497893, "uuid": "c63e06f0-475c-4f13-a70f-434adeebdc86", "comment": "Malware payload (Mirai)", "value": "55d253c9a9bf943893e1c232c02c8668fa77e4b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497893, "uuid": "1eb9fb7f-b99d-4ddc-a52a-86cd6215162c", "comment": "Malware payload (Mirai)", "value": "6e75c6ad76cba2d57e9502162ca2f7c20211d9dd0ffd74a2ff07ec67b70a65eafb7828cf03ba528163e9336dde01dbfe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497893, "uuid": "378422d0-dec3-40b7-ba7b-5026f908dff1", "value": "T16E33F1B6529B9D72C57042F7152D64AD64162738D3E5F00356224870EACB1F35AFE7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497893, "uuid": "ee13bc1e-15f7-48eb-b07f-db4eccf762c3", "value": "1536:ICoqsGR4eB3g0Vmh1IxIpC8J1L9VE8amFZP7R3v:loqs2Twh6P8J1LJ9ZP7R3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706497893, "uuid": "b6e86061-7ced-4998-b4bf-514b1428f114", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706497893, "uuid": "631c1d19-3ee2-4718-9d60-586c6c1dd68d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497893, "uuid": "74feda9a-6941-49c9-a392-0ef019c97067", "value": "d3ef8a75fda13adc5988a2db300c79a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7761928-be77-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706513295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513295, "uuid": "b31c1016-edff-497c-b87f-adf7638d1be5", "comment": "Malware payload (AgentTesla)", "value": "36d072de5fc8e8587a8281499e719839", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513295, "uuid": "44234f98-8823-4484-aee5-7452327dbc48", "comment": "Malware payload (AgentTesla)", "value": "9e82a25804d3becbd7d5df0ca0e92dca04192c27292b5dd17d5780bbb15b1f60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513295, "uuid": "ce825eac-65c1-4dfe-92bb-9f04549fe29f", "comment": "Malware payload (AgentTesla)", "value": "42f6317f6edf7e4912c8b33b4125d507d1f668d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706513295, "uuid": "b8240cf0-aaac-45b0-9393-8618bfff0551", "comment": "Malware payload (AgentTesla)", "value": "5bca1e0c39ca14a5ed09dba26065f0f43c37a4dcd5b69852dc85e5457295f3ebcd29b656730d02d577961302d2c20807", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513295, "uuid": "9f694161-5a22-48db-8f6b-ac3b0263bed4", "value": "T1AD33F1A080F9A036615A91C8EB9E184CA8972AEF33509B7167FC5FD3A35B327571500B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513295, "uuid": "d8870641-5df6-419c-b549-514fce6bccf9", "value": "1536:IVfssb9byU7zny+SXiGOBaP10HfhuhO80H:Iespn7zy+SiBs10/huQbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706513295, "uuid": "218e2217-e399-4a41-a04a-742b44de9e78", "value": 50462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706513295, "uuid": "5084e294-1f6b-4eaf-875c-c344d953ec59", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706513295, "uuid": "a242160a-501b-43f5-81d2-4ef438ee2d24", "value": "CaixaBank _ banca digital CaixaBankNow45450-09898965621.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b889b4a-bece-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1706550319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706550319, "uuid": "2699985e-b399-4ab5-9937-63a96d4d70ec", "comment": "Malware payload (AsyncRAT)", "value": "fafa09cf1f3108f157c5959a5f083485", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706550319, "uuid": "c5e28431-0e59-4b7c-96a5-7e6c7b7cfe7e", "comment": "Malware payload (AsyncRAT)", "value": "9ee21d23bc53d83537bc82985ddb2aa9a7ea80b254b35a361ab122130e962417", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706550319, "uuid": "696a5c17-1fc6-49a9-b850-1e4776f9e4f0", "comment": "Malware payload (AsyncRAT)", "value": "05904ef251463df254b6834af85a924ca4a01640", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706550319, "uuid": "5c26e146-010c-41e6-8c9d-82bcf0f87d3d", "comment": "Malware payload (AsyncRAT)", "value": "a92dec0f6b5b791e51576d2b9ffa7e20841995cb458813e3ebcdabdb1e849fbf5712d786156e070b24c48f165c8ba19f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706550319, "uuid": "6717cf1b-5294-4f2b-90e9-5817efa03cba", "value": "T117143A8972A431DEE467E5718EB85DB0AB227467933F820B905B109D9E9E953CF103F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706550319, "uuid": "38fe4c3f-637f-4553-9fb1-919495ed6c44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706550319, "uuid": "b23ab449-96fd-4918-a904-3a1f1a1e60cd", "value": "3072:FfUgCiOyegJyB0M3AIFLyIG6tV69eXmyr4DOiiiWn+CmW82G0J97vI0HbqLBBT:FfDOy5JyqM3r9yINtV69eX34oiWn+CmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706550319, "uuid": "3553fce6-658f-4ed0-a33b-5216d3969aa2", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706550319, "uuid": "a34e6a8f-8750-4b63-8aa7-32b58bce2aa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706550319, "uuid": "ed5e5c61-eb4b-4edb-a949-ba4c409bdbb8", "value": "FAFA09CF1F3108F157C5959A5F083485.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf660655-bef5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1706567318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567318, "uuid": "a5cfba32-37ec-44a1-b1bd-ced3d1c11df8", "comment": "Malware payload (Smoke Loader)", "value": "5dd758d30a2785553e5dfc6692cc972e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567318, "uuid": "8b4bab44-bb1d-4e32-b743-6e71e6143edf", "comment": "Malware payload (Smoke Loader)", "value": "9f5447dd37ee7e006c9978bde29ed18d51a29af6fa7cc1fcfc6cfe5f32de6b8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567318, "uuid": "bcfce223-12b7-4c77-abeb-b74bc1e935a0", "comment": "Malware payload (Smoke Loader)", "value": "a73cd082530358e3dce0f60329f8da159c053045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567318, "uuid": "bbc143a1-c639-44ff-8322-0474a77764b8", "comment": "Malware payload (Smoke Loader)", "value": "9ff7df96e9f6b13e9d56fb11587ecf6a64adce53b7ae9f3a903a997754580d53a39454d4a53722c0428201ac3e3c23f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567318, "uuid": "e01424d2-14b6-43f6-9c63-7179233ccd67", "value": "T1F4649E117AF0C031E2B359354930F7A40E7BB8A2EA39D98F6BD51B3D5E246D0C6217A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567318, "uuid": "629770c7-2143-4bc6-b77b-592853f0975a", "value": "743724ba5bf8272812a9dfe2fdd351c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567318, "uuid": "a7dd1b90-c2c3-44ca-b9da-9646065f5aef", "value": "6144:UoQ0tRPNZz6MgCNc0uSm3BewpRKv/mXGGpYj3:JRFZz6Mgu9m3BewhXG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706567318, "uuid": "c443216e-3526-4fc2-a46d-6493086e6128", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706567318, "uuid": "40acf1a5-0a24-4364-bf58-ffff92462fd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567318, "uuid": "87863cda-6b24-4723-9408-2483479ff07e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525ae200-be73-11ee-b7ea-42010a9c0006", "comment": "Malware payload (TeamBot)", "timestamp": 1706511300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706511300, "uuid": "0ed6db3e-1c0e-4a1a-b704-184045db36b4", "comment": "Malware payload (TeamBot)", "value": "01fb175d82c6078ebfe27f5de4d8d2aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706511300, "uuid": "1fe040bb-a1b4-47ba-9dad-60b8ac31c52f", "comment": "Malware payload (TeamBot)", "value": "a07112e236e0136b43294b31a43fb4456072941a135853e761680d04315841c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706511300, "uuid": "91555cab-5760-443f-a312-68cc8041e850", "comment": "Malware payload (TeamBot)", "value": "ff655d5908a109af47a62670ff45008cc9e430c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706511300, "uuid": "0c066e53-b695-44c7-b499-0e923e9d8635", "comment": "Malware payload (TeamBot)", "value": "e645358fef0ee71cbbeb1cde2061bdda851344f8422bc7fc11e82556d919606647a833e6e23637f265806287f767d8f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706511300, "uuid": "e745ef32-a8d6-4875-bf8a-7362b351f70d", "value": "T1E704AE217AF280E2F6B785715930DE906EFBFC626BB5808F22D4265E1D31DC08E59367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706511300, "uuid": "8e816fbd-1e12-4874-9196-12cdc0f75a55", "value": "276a3b4aae05383c35839d49f458cd7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706511300, "uuid": "dd14f357-731e-4467-a428-5851e8a35456", "value": "3072:5L2LlDhVsiwlCCoXL0DtOryT1us01HgdeHy5TORxmVF:gLlDhVsll1obotYq1ihgd+yem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706511300, "uuid": "cad2d83e-02ef-4ba7-8df6-7223a3df902b", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706511300, "uuid": "cb425755-0938-4ac5-8aee-f3e4935720ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706511300, "uuid": "e4ecb74d-b460-4814-a3d4-de710c98d351", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c8f80f-bee1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706558530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706558530, "uuid": "63d42874-16f7-4e4d-ab33-884c694aa2ae", "comment": "Malware payload", "value": "cbfff998a4be8f2026f39ce497cbc1d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706558530, "uuid": "784be086-4c2c-417f-b357-87a25fb3b4ec", "comment": "Malware payload", "value": "a1e161a7e1abd92a9583ae35945d25ac910df6f60129ab8e2b9527fa64cb7575", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706558530, "uuid": "d4162a1e-de5e-4a64-931f-c9708f14e82d", "comment": "Malware payload", "value": "43ce818c13badf96b3673b68c37f8734e565e4ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706558530, "uuid": "510e9fbb-1169-486c-a7ad-88d325559a47", "comment": "Malware payload", "value": "b3ea3ef78238dfd85e30876ed6198d1496b1211ea85dc10ee327f0fe953f5c38d326476ca425c763a48147d884654827", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706558530, "uuid": "7f438203-4d3d-4c4e-8ef5-1edc43125f90", "value": "T12B66CF7F6290D16DE529C13AC2A34F80A53374B51737C7EB91E0A3681E2BAD2CE3D615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706558530, "uuid": "b0821122-d01e-4787-884d-e52f19e47dee", "value": "35269389bf1fe91690af41d193a862cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706558530, "uuid": "18e53376-77d8-41df-8982-4e37864ef471", "value": "98304:jloRkt3Ho6mxEzTkHtjz62MLnciRfXsNYUm2v+axRxy7:4klI/sQ5zHMrFRfXsc2v+aHxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706558530, "uuid": "982081b2-484e-4259-83c5-8a11fa078868", "value": 7055872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706558530, "uuid": "935a1905-ad32-4700-946d-4b8b4dc2d09c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706558530, "uuid": "b08a1e2f-26c2-465c-b433-5ea3fca47b3a", "value": "einstall.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3faef98b-bee1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706558514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706558514, "uuid": "22abf5bf-aac7-43b4-affd-c438b3f26411", "comment": "Malware payload", "value": "b29959fec067137098d4780aa62cb89a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706558514, "uuid": "4eeaa45f-a0ff-438e-903f-79d0cd1579df", "comment": "Malware payload", "value": "a2507638a6233a497c203575e189eaf5cc79745a653897b7af88dcf6c920d38c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706558514, "uuid": "46de28d3-8fa1-48b7-ba17-998a2a058155", "comment": "Malware payload", "value": "20ef66162b8c35727aa031a426caa58051ef591f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706558514, "uuid": "e88b83b6-3e11-47f8-a545-3beda2639a22", "comment": "Malware payload", "value": "0c1ffffa090f7c869b3168af1e4ea313c8334fc56de00268fd1b2ff091713bb91badc070114defe4509ea6b98e777a9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706558514, "uuid": "0109fd11-7f04-4a49-a034-a6fedd3cd533", "value": "T18DC533559F83A5F0F091B43E21ED36359CC7BAA2CB3010DBDD560E614B2A9D6693B383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706558514, "uuid": "fbc15066-7cb5-4e14-8f65-3225f1558e0e", "value": "de41d4e0545d977de6ca665131bb479a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706558514, "uuid": "3ed3dfe8-dc85-4154-8628-73ef0a7dbe6d", "value": "49152:+sWok4q4DOeWROGLNP44i084HdHMDRtZYSR/NuaHkozW4/+ng:+sWokv4ChRO6PqedMFtZYeJ2s+ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706558514, "uuid": "014c8069-7de7-4695-a3ab-ee58a795c192", "value": 2645504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706558514, "uuid": "d4ae69aa-4807-4474-9b7b-53c4add89d51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706558514, "uuid": "379e3885-0cbb-4629-b01f-19e4330b991c", "value": "ei.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340bff14-be4d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706494929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494929, "uuid": "785e4415-c820-42d6-aa32-97248c977962", "comment": "Malware payload (LummaStealer)", "value": "346af4de7028712103ce1278c01b17c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494929, "uuid": "2781e1fb-41b2-4752-95f2-7db64e7e3cfd", "comment": "Malware payload (LummaStealer)", "value": "a27f747390816539214b01ab89b998ada272d51a42b89cb1a448122815bb981a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494929, "uuid": "cbd96964-a22f-4355-ad51-78648db2d03f", "comment": "Malware payload (LummaStealer)", "value": "c69f08ca579ced082547195aeff96aee885397ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494929, "uuid": "87c6722f-1fd4-430b-972f-1e8870edbea7", "comment": "Malware payload (LummaStealer)", "value": "d4d87f347ac0299076b0f8f9cd7feeae1350e911113a2018a3f3246c82e202f0d91eedf6f9dc176d6019631c78cf07d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494929, "uuid": "9d4edbbf-334b-4bf5-861b-6381d90f132a", "value": "T10F9439D176DDB036D7A114320A34DB7F446D6D2C0B2505DB63D82E2BFB301D29AF2A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494929, "uuid": "6a8480e8-2ca2-416e-9407-108414921c1a", "value": "45aed3de6b8dd424b7404c35c1a47fd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494929, "uuid": "0bd001db-4563-4581-ad31-becf4279797a", "value": "12288:97YdTxU6pYylQno/J8mU4kusVxhmxXsqVQ6q:9auyink3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706494929, "uuid": "b08fcc77-2f7b-48e7-a413-81f5a6c4ae08", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706494929, "uuid": "2e3f35ab-92d4-46e8-9153-9773a3ea437f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494929, "uuid": "b0ef951a-c4ac-47e5-ae44-993ed5c28e61", "value": "SecuriteInfo.com.W32.ABTrojan.DOBG-7303.5125.24686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0591ab4-be6e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706509337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509337, "uuid": "6c3d147b-af7a-4842-93a9-0201aa65401d", "comment": "Malware payload (Mirai)", "value": "4496d1ea9d76cf31602b51c42b3c5214", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509337, "uuid": "fdd1655c-c129-4509-89d9-1b79f6755e8b", "comment": "Malware payload (Mirai)", "value": "a29eb5c28b58aa9aaf5b19817c623e4a97be14b3a218f01d20848b7b92133529", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509337, "uuid": "7b1cc3dc-05e3-40be-83de-983958fedf7d", "comment": "Malware payload (Mirai)", "value": "898b20365e1cea596c8ed6883486b99ce68d8cff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509337, "uuid": "b8c3f2c4-15ab-4357-a811-472942c26764", "comment": "Malware payload (Mirai)", "value": "71260a84dc28b2c50afe7ee29f6a3d9b6c03aedb6af584f3ee1177ebbc7a700656b226a26a89d5e4823bbdb17ecc8ca9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509337, "uuid": "d298f55e-8d1c-41d5-8b27-43cefef94775", "value": "T153F33BD7F800DEBEF84AE33648230909B130B7D111925B376257797BEC3A1DA0967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509337, "uuid": "bc2af4d6-3704-4525-b16f-13e8b70d584b", "value": "3072:0np1tFL9eLXvxWFL3TNeWqW3vSkcxX4BVrjbizL6FRqgyJ50Gu:opxZOibqW/SVX4sL6FVyJCGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706509337, "uuid": "b81572f8-e7ca-4ae5-b856-49d6d66e6af6", "value": 165472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706509337, "uuid": "fbf9e545-6453-47df-9ec0-4e563a614f7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509337, "uuid": "1ffcdbd8-51df-4371-9dcb-7d6a04d376fc", "value": "4496d1ea9d76cf31602b51c42b3c5214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52f5016-be55-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706498554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706498554, "uuid": "a3fd5a6b-669c-4dd4-bd1e-a579b034c65c", "comment": "Malware payload (AgentTesla)", "value": "bee12e5e8fa5ee590b697bb3ada0ea8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706498554, "uuid": "0e6a91a9-8c55-45da-a8ab-2643c2f419b6", "comment": "Malware payload (AgentTesla)", "value": "a3268fd103ce714411b447c75854565ddf366535c6f47641893f0d78f0482bb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706498554, "uuid": "5b36856d-e528-49b7-ac57-2a256f5ef7a5", "comment": "Malware payload (AgentTesla)", "value": "84b2532e77b37e83641def708228e60a1749c852", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706498554, "uuid": "c1ccad69-e887-4831-95bc-994eb3d135f3", "comment": "Malware payload (AgentTesla)", "value": "277aeafa81aa664774a4d0aee5c950e3f9fe66f9cfbb9a92fbd97caf663484410f43b9507f9afe34b3faf72105ce2d3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706498554, "uuid": "f41f3db9-5491-4474-9311-e29e82196a28", "value": "T12CF4120B39685713D8BA6BF821B092C99FF825237192F38D8F4435E515A6BC05790EF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706498554, "uuid": "6d6dae1f-f72c-4836-aa65-b3cd22348dcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706498554, "uuid": "9d7f1f96-fdf0-4152-84ec-791a4f835d6f", "value": "12288:na16IoIFFHgeg/cSCp8tSHKV4Sq0BcIkGj6+G6Hwqp1OoBUTaI5Ot7KVZ:HIXFxzp8t+7LI7Wb6QewBfstOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706498554, "uuid": "ea4f6bbd-c913-42b2-810f-b5e25d1e9d19", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706498554, "uuid": "16eb1b88-558d-4868-b1d5-72b8087af045", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706498554, "uuid": "d7ce012d-294b-4f79-91c9-ca9a053e5b5f", "value": "SecuriteInfo.com.Win32.PWSX-gen.9878.25300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad145ea-be54-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706497919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497919, "uuid": "50bb339b-5e6c-42fc-aa43-5cb16dfe8609", "comment": "Malware payload (Mirai)", "value": "a3dd632f99474cbb65f49c5cfc3ea318", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497919, "uuid": "c3824203-a991-47ff-aa3d-f93d4b941383", "comment": "Malware payload (Mirai)", "value": "a476f1f8c8b4f8e7b850a0c53bee8f30b296e6cca6505d70ba39d7f0cd3932de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497919, "uuid": "878acb4e-887e-4107-a9fc-d61b7de267ee", "comment": "Malware payload (Mirai)", "value": "2efaa834036170d16fdd91aff10431d21f852eb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497919, "uuid": "2ebc9ff4-d5c2-45a9-98e2-16b4135b1f72", "comment": "Malware payload (Mirai)", "value": "7ec4a0014fb1a86c3d90ca544995d059dfdbbc65e5a9c6a6d6b78064cb20400047870cffa456952f0304ec0e72adecbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497919, "uuid": "455c803c-f0a8-479c-a8dc-5983ca99a713", "value": "T19EB2E161A1863E62D7B0213FB97CCA0157AB57FCA0EA72712524B6AC4BE2C47647814E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497919, "uuid": "65a57741-9fc5-4341-a9d1-ca72024aa2ba", "value": "384:vZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdHahymdGUop5hK1:yX1De9kONQG5xD+jHMDzu6s3UozY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706497919, "uuid": "36e85e8a-7586-40b2-9000-444dd3181797", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706497919, "uuid": "0962b5db-1f34-4cdd-b095-b5a72ae1fa2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497919, "uuid": "13b6b093-6337-4b2a-9176-bf54f4284f66", "value": "a3dd632f99474cbb65f49c5cfc3ea318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9f40ab-be7f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Guildma)", "timestamp": 1706516396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516396, "uuid": "0a2c9c7f-cde8-43c6-bde7-ce574054ae54", "comment": "Malware payload (Guildma)", "value": "a974dda42010c2c45b1790f2082e256f", "object_relation": "md5", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "autoit script", "colour": "#BB811F", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516396, "uuid": "56f09d50-2059-40a6-9798-bc88aea56c07", "comment": "Malware payload (Guildma)", "value": "a4a92f1ba26a5a0e527839a37363fdd57e82ac77538bc09c71f9e4d8a7415b74", "object_relation": "sha256", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "autoit script", "colour": "#BB811F", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516396, "uuid": "cd15fcb1-4d03-4808-9515-56261c12595d", "comment": "Malware payload (Guildma)", "value": "e333f1570a7ef7508340bd7b7f6294c5853b9bba", "object_relation": "sha1", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "autoit script", "colour": "#BB811F", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516396, "uuid": "1c8cf0f6-4835-4bb9-85f4-ad024d334d56", "comment": "Malware payload (Guildma)", "value": "763c6b9d257150b183b376d05371474d0043c63fc97834af53e8c0d7ff20b75ece5fe514cfe6842e289a8510030a97c2", "object_relation": "sha3-384", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "autoit script", "colour": "#BB811F", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516396, "uuid": "82342c68-88f9-4532-a195-590b1ff3fb24", "value": "T1DF06331AE476920D10E016CF9D88CBD64B1402F99B5DEB9863412BFEFBB69ED1D700E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516396, "uuid": "27f36935-7aff-494b-a712-00814a546745", "value": "98304:Jhg8CHOgWCdGWWuapLVeXpbYHnmswL3iRzt:Jhgxxl4kJYGzitt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706516396, "uuid": "859db929-2794-4d4f-8028-4b0d033b877e", "value": 3779053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706516396, "uuid": "f58c52e1-5a13-4cca-bff3-4838f879eedc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516396, "uuid": "35500db0-0383-49e8-ab39-92de74e8cf32", "value": "TempData30268010203.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a1e197-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706520277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520277, "uuid": "24043d26-9de5-4703-bc6c-3d0fcc8cc1ef", "comment": "Malware payload (Formbook)", "value": "2a63c7d093ec7a63a4fabf61452e2206", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520277, "uuid": "1a7c62e4-4f0c-45a3-a755-eb7a12f801d5", "comment": "Malware payload (Formbook)", "value": "a51862c42a347c96969bb5e511b81d1beb31d50f850acf4fbf041087911c92f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520277, "uuid": "531c2831-1c93-4a0c-83aa-41a04605e374", "comment": "Malware payload (Formbook)", "value": "501c0f22803da5b0ce77f915efac3567644c47ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520277, "uuid": "f703ac6d-ff7f-46e1-9589-6455433c936f", "comment": "Malware payload (Formbook)", "value": "493f62b72d0e8e4ecdc5ed2fc55d46c1a7e51a610eac191671cae7e099430f039a59fde13fa279873c669e5e6465a98c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520277, "uuid": "e6101445-d674-496d-a572-a956aee99c3e", "value": "T1491512943E70C51ECAB49D362DB8EC35AF786E050C24AA4B3310F7CDB579E550B18AE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520277, "uuid": "e677a2eb-3e4b-4cf8-9ac3-9d5a17e96428", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520277, "uuid": "2b5bccc5-61da-4118-a895-95276d28f654", "value": "12288:lRrzL0BkOhDPswBw4nP/CBx21t+TZY44s2WvbcWqOOav/qjqPaK:lJzpOLi4m0fCZsNWpOaHqDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520277, "uuid": "abea584d-bc58-4b4a-a1d5-7c7380aeb183", "value": 910272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520277, "uuid": "9a6b9a79-e9a4-4ee8-bbc9-57504ff6378f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520277, "uuid": "3a5def22-efa2-4c87-be5b-31b42931e6c4", "value": "STATEMENT OF ACCOUNT_xlxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d91c46-bede-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706557240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557240, "uuid": "9d09a601-1777-42de-ad9c-7306141de2e2", "comment": "Malware payload", "value": "f6cb65fdde885fac7e9d9cc27f5877c0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557240, "uuid": "5d7f3287-ac20-4844-bb05-42aab8aa3563", "comment": "Malware payload", "value": "a542f6d3184b4450e6e762785f53a2994b9badea252620469659c85ffd6b2963", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557240, "uuid": "69029b11-bf4b-4076-b8b4-ac0f424e30a8", "comment": "Malware payload", "value": "12e4749557fdfb22ea2f78832ae1c3ee381b25c4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557240, "uuid": "8a8477ae-23a0-4b11-af43-6b0285b20c5e", "comment": "Malware payload", "value": "418e7b7f970752a07864902cc5f1c18ab2e9f7ea6ccdd4b5bd83d1da1eb1fa14fa864b1be80b030c096ae131d2a81666", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706557240, "uuid": "6bf2116f-18c8-4316-8a6a-6c9d4aaf127c", "value": "T1FB67333051F59F87CE49D13B0125B923B3F35496159CD9F9360EA83B2482AB92F71A8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706557240, "uuid": "f8906fcd-a18c-446f-98fb-cb45ae9914f8", "value": "786432:wEOe+CHJe5Xt+i1Ghaseg6SJ5g4xZv3Qn4VZ7Mt1T:wq+y8X4DTeg665g4xmS7Mtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706557240, "uuid": "509b3389-d366-49ec-b416-91bb68f91aa7", "value": 31167828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706557240, "uuid": "5c035b7e-b1f2-4671-bfc7-78ee5f1d0bee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706557240, "uuid": "06ef245e-6772-4f1b-81de-adf680119151", "value": "RAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4542ea0a-be54-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706497964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497964, "uuid": "550b6287-c21a-433c-8e46-b0cd134e2a31", "comment": "Malware payload (Mirai)", "value": "aae0e369a1abbd993453607253a61a45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497964, "uuid": "026a78ea-400b-47a6-8c94-b24ed4f80c86", "comment": "Malware payload (Mirai)", "value": "a8c029a655d57d259891b94bcf70e947f0bbd1cd7c65cf22efa37ba4d848f2a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497964, "uuid": "ee04a065-aa7f-4a60-ab33-2a5116dfd8f3", "comment": "Malware payload (Mirai)", "value": "264ef5fa4d3526e7d79407fe1c1987c2ce3f191f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497964, "uuid": "c19e9739-0ea3-4de7-8303-d693c37ebac4", "comment": "Malware payload (Mirai)", "value": "c9d37ae3f13bd6bd069c52c1033fe1444ef4d57be611f35048b32e17e4e9b1f300852177be630f15f69aaf69fea2eb82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497964, "uuid": "9fddfdaa-aee8-468d-92f8-74d07a98d092", "value": "T1CFC2E1A285F6CA17C863437D2928157361681C55D34DEE3D172BEECC53C84E22B7AC93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497964, "uuid": "b826c2a3-e8dc-4446-8311-7be06402332f", "value": "384:Ms59WXUx5+bkbRaliVErjrL9VD9jPwrSaf5bwIB5/8x2BYFydHY0sNDZvzbSNHcn:t5+Kcrb9VDJef5Q2PdHuzb8HoEPbdDYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706497964, "uuid": "0bd17bc7-201b-409d-ad0c-6a86db76c961", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706497964, "uuid": "316bb688-102b-453e-8ae3-fd1689ec9aa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497964, "uuid": "33bbc161-fd48-410a-bcd5-9f10644fbc31", "value": "aae0e369a1abbd993453607253a61a45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1b5cfe-beae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706536662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536662, "uuid": "b133a581-4012-4813-9d8d-32dc88b6182e", "comment": "Malware payload (Formbook)", "value": "e77cb7912aa3095485e40f6dfef39530", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536662, "uuid": "10e83e85-d990-44be-9f57-1c0ac13b5d8b", "comment": "Malware payload (Formbook)", "value": "aa67e97d78ff7f40692faf0daeec16c397b70583ee63cf47d087c9c5c4151b10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536662, "uuid": "8a895626-2c85-441c-b001-fc4928fe025b", "comment": "Malware payload (Formbook)", "value": "7f0988098d0baa025f1876e4e233e807b6e87027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536662, "uuid": "f4d5c794-4ee7-4e5c-b4fd-4da5ffa5ede2", "comment": "Malware payload (Formbook)", "value": "2e8979a29b7d56b7dab350519b37ca501ed4ee8ade80c7e00fa1fa01ee7cd8c252f5276665c651d38c073ce3ea475db0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536662, "uuid": "5bb6a19f-7719-4573-a958-f65299789a0e", "value": "T10D25D43C58BE2A27C076D7B9C7E50563F250983B3911ED2A58D3679A5372B8339C321E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536662, "uuid": "5c2a3c63-aac4-436d-8398-7fa8a6a0a006", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536662, "uuid": "6ebea486-d672-4e55-9e34-3b73b8c44afe", "value": "12288:QHWDIAeZycFVF8GBIXJFymfCREC9hfCIbuE5EAmD:ICI5yEVZeJYyC/C2uE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536662, "uuid": "366d4927-e16c-49b1-b6be-7517a42bdb44", "value": 976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536662, "uuid": "39911dfa-9f5f-42be-94b0-25a7dba70060", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536662, "uuid": "7b8d0d58-5bf9-48c9-b493-b45bbd3dc009", "value": "PO DEC 654312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb303df-beae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706536631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536631, "uuid": "6a6d373e-5878-45c9-a166-662c2f72db4c", "comment": "Malware payload (AgentTesla)", "value": "c7e19a4d7ea34083227355a0032fd9f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536631, "uuid": "98b5d1f5-c806-4098-b514-dd6fc5b15081", "comment": "Malware payload (AgentTesla)", "value": "aae30c2042a799b0495a301e127c47c8e27742bb84cf6e3851bf2beffd0824cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536631, "uuid": "d9b699b6-df23-4fe1-a2e0-baf2e4093b8c", "comment": "Malware payload (AgentTesla)", "value": "e6d96446706d9f2d735ac2115436c5c26b09efc6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536631, "uuid": "977cf0e0-c96f-49a9-97ae-e09d53ddae6d", "comment": "Malware payload (AgentTesla)", "value": "2af735431234050dd9b2f3fb79e1dca260ee2eeeba106e01fa56b66b19a978beef6de32e2342d618aa66581b9d6bf8ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536631, "uuid": "39580509-0f64-4b22-bef9-109e34ede89e", "value": "T167156ED1F150889AED6B06F1AD3AA53014A77E9D54A4810C5A9EBB1B76F334220DFF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536631, "uuid": "8a1442ae-c833-453a-a491-17c0916f3b18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536631, "uuid": "14964763-b847-4a0e-b380-ee70a53cad0d", "value": "12288:1ebObjiVwtR5bWPQ8rzNkINDHflCDrPBZZNp9v9bI7TKskxJkN8h9Sio8k85U:QmjioRGbrxLtfWPB7NDv9b/bPh9x1kr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536631, "uuid": "8a6a349d-10b8-40b2-8145-d6cfa643bacb", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536631, "uuid": "f8a802ab-d914-4f8a-89d5-6c7d65cd00ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536631, "uuid": "68384ec8-dca9-461a-ba52-ad09592d565c", "value": "\u043a\u0432\u0438\u0442\u0430\u043d\u0446\u0438\u044f \u043e\u0431 \u043e\u043f\u043b\u0430\u0442\u0435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5207d6-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706520259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520259, "uuid": "e90d3e27-0f14-4a89-a1dc-867c262e7838", "comment": "Malware payload (Formbook)", "value": "f9bec48a37ed98a974077a4f6afb4516", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520259, "uuid": "68e223bc-8785-4bb1-88f8-5c5ce02143dd", "comment": "Malware payload (Formbook)", "value": "ac0b1f47f36bdbc8974390d8473d74f6e71d5219a338796ed9d0582f8020f8c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520259, "uuid": "4f108f75-5c9f-475d-a0a2-727e55334824", "comment": "Malware payload (Formbook)", "value": "4bd259f7c707aaee689c29ffe7bc38776b275737", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520259, "uuid": "0903f3fe-4934-46db-8a6c-063a07a2d392", "comment": "Malware payload (Formbook)", "value": "994f29e0f1b173c3024962da365e0edc96d6948b07c0e33877a8087e3527006cae41b7b986853cad73f679882f7daf5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520259, "uuid": "25692512-b5f9-43ea-987c-f9aedf213a3f", "value": "T146E4128037EC5B66DABF8BF4195180508B7A3A277AA6E30D4DC260DE0D72F0157A5F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520259, "uuid": "72958da2-2a46-461b-91a0-8b9910f6b25d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520259, "uuid": "7f344fb4-7feb-426f-914e-936ba58e33b3", "value": "12288:+yTAoIFFHgeg/cAJt7l2ycDhisk1b893U5ib8vjYM9G4ZRUGY+rddsQuW:+yTAXFxA7Qy6k1g93wd9GkRScHs7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520259, "uuid": "e48140cf-85d2-46d6-ab21-cde46b5ab9fb", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520259, "uuid": "3ec33475-7433-4aad-9b4b-e667323d602d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520259, "uuid": "deab6942-bf1b-4b7f-a954-b294c2df48ce", "value": "MT103 SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c846aa-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1706520221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520221, "uuid": "0bc68c06-8057-462e-8741-5a05fb5486d5", "comment": "Malware payload (DarkTortilla)", "value": "7dcdecdb8d904e4884e2a55306715e5f", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520221, "uuid": "f2567844-51e0-4dc6-ac05-0a840e50e908", "comment": "Malware payload (DarkTortilla)", "value": "acd2f4ba73a01853f0f0b03a40afc965cb609df1945f699e135b2ac3fbd6c8b9", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520221, "uuid": "ddbc4c0f-510e-479a-bab5-0be3264ca33e", "comment": "Malware payload (DarkTortilla)", "value": "535ef6f57a57aafb6e93e88a032841c9732c957e", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520221, "uuid": "c5024c48-69fb-4956-9bb6-ffa49fc5a152", "comment": "Malware payload (DarkTortilla)", "value": "c2e76ace871fede8a37965b08a7c18cfb48989cc5451605a7883eb404ec8a20f4517dbf433d8f38bf64ddb40927a6f88", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520221, "uuid": "82fca18a-0942-4d0c-9cad-87ed39e37572", "value": "T1FF95127327E9AE11D03DA73C7261516047F2E956C332EA1F7CA810DA6B71E82E677213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520221, "uuid": "adace9e2-d569-44f9-a3bd-af806b7f5b9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520221, "uuid": "9816085b-503c-4a42-a2dc-67f90cb7b339", "value": "49152:fC/bc/tENtpdl3aZhN/7MiEbN9c45BkI8ldW8UK2oz:fC/bc/iNJl3yhJ7Mx/n5BkLW5+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520221, "uuid": "711e5c77-e5f4-4361-b5c6-332cb45166e3", "value": 2020352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520221, "uuid": "29abb8be-dacc-4cd2-a0e7-d85dae8befbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520221, "uuid": "2e3a9dc8-589c-4051-b5b6-046f6d68e3e5", "value": "09728292839283727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f5c3de-be80-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706516922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516922, "uuid": "bf0f259f-64e9-400a-9b6e-344f1fea9e5e", "comment": "Malware payload (Mirai)", "value": "f36effcde464d955a70b30db46ae037c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516922, "uuid": "6625c5f6-d6e8-4db3-aaa6-bc87f07e4b97", "comment": "Malware payload (Mirai)", "value": "acd64831abe65ab67ec3140e664bceae1ad9ea47af8f8e7e91d738951d1fb074", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516922, "uuid": "0b3d6d9e-f8fc-4f4f-9542-d9d2599abd97", "comment": "Malware payload (Mirai)", "value": "72ba055e4ae9d4ea393e91ff875ce80f8ea320f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516922, "uuid": "0e51bf79-88c0-40bd-92d0-2c359f01975b", "comment": "Malware payload (Mirai)", "value": "742aae38d50640385b04b0f2c7e53b1486be80045e4b34081d3e2ac559e75b56e5c7822ca21cbabc6cbf8842025852e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516922, "uuid": "40b645e1-9403-4a98-a6a3-82f201ba698d", "value": "T181C2E1E2D2CA87E7DB0442FEE159036F647C2C49DFD8A08A6195465EA2020D11E79B7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516922, "uuid": "a6f6207f-2db3-498b-a853-538618f525c9", "value": "384:M+vESEONdjOL+jtbriI+orLz80JGFiVx1eLmgnNYwU5ceKFV1KbUdnByF73ow49y:ES7N1O4BAg8Wt1MpNYLKFHHByF30sTb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706516922, "uuid": "8f593491-25cb-4022-9d2f-08d722280763", "value": 26568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706516922, "uuid": "da5aeeba-bb63-4116-bfde-430a4ebac330", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516922, "uuid": "0e135664-b8ba-4c92-8236-48216e8b2ced", "value": "SecuriteInfo.com.Linux.Siggen.9999.32313.32087", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17aab457-beb4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706539119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539119, "uuid": "fae24238-3e67-4a21-8b91-51183b561c5e", "comment": "Malware payload", "value": "8e8d597f6b496e747e32694bfd7ef409", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539119, "uuid": "056f971f-2fb6-4ba5-a896-c45ba9a61624", "comment": "Malware payload", "value": "ae2e7cc6644fbc8e27d85b4e48b92333644c73acd07bc171e68b336004da1d7a", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539119, "uuid": "ae3d0616-e6f1-4606-aa72-41a67382ab8f", "comment": "Malware payload", "value": "04cbc428ef0cc2a74ef03f06ae9da11d5f17eb21", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539119, "uuid": "36750a7e-d868-4156-92fc-8b090d0ac393", "comment": "Malware payload", "value": "753706294979b7cee22536163f0235af3460326844a8b111ca696dd9ca42557fb8c87b0c1f2b911625a62d181b2d97a6", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539119, "uuid": "dfc93e9d-96cb-45ef-b0ec-16be4250f813", "value": "T13974F167BB00ED1DD1B613B8952EACE6A08D4168A1F3D149BE9CFC4D3B6598307CC49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539119, "uuid": "fb8bf3ce-0b02-4401-8c92-d30eda744d1b", "value": "6144:btcxzsSx1MEBy83AVjY/YnfjIXBe0XzTWliEPV98pVlTLW:uxoSxyEBtQFY/YfkXBeImYEPV985m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706539119, "uuid": "4bb57b85-5564-4738-bc02-a45e6504e3a1", "value": 360453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706539119, "uuid": "2885b7d7-2249-448c-9c58-b67bd64fa8cb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539119, "uuid": "553f425d-c9c5-4562-8997-745d6c139cab", "value": "JPM_EU Oils_4Q23 Preview.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f8415f-beac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1706535918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535918, "uuid": "fb4cf99b-ac1a-4185-a76e-7addaebaa4ef", "comment": "Malware payload (AZORult)", "value": "a4b327279c518e993dfda593e6e7e7a7", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535918, "uuid": "d594c911-258d-495c-994e-ec6701b7a74e", "comment": "Malware payload (AZORult)", "value": "b05f39f081d71f68d4209214f0c44f3f3e0d68e2552c662e3dbe6cd2d788ff65", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535918, "uuid": "5d5e9c29-3d1b-4bae-9821-87d5e79b4215", "comment": "Malware payload (AZORult)", "value": "59edf5766c1b2b2aeace7776b0a8a09321a3ad66", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535918, "uuid": "72926ac6-92a7-4c90-b40f-eb8674c6dd27", "comment": "Malware payload (AZORult)", "value": "c6bd5094bc5ffc96c9e06581fe0a85103f2d2d4192e001a77dcd37cee97e6c16eb19efad2744396fb0f56ba97aa75ef4", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535918, "uuid": "01769b7e-383b-4e63-bd1e-715ac13e6cab", "value": "T150D47C31B79BACE6C4190CF2515E03EF04D0E7AF166457C3E391ADAB7E2A581462B8D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535918, "uuid": "1ca7e7f9-9fa7-4906-8487-164b6d601ae1", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535918, "uuid": "24e5d3e0-5e05-474a-8126-1f3b7da83ca4", "value": "12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLpe4jL:AQy6ONsqLpe4mDZ2KzmXTrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706535918, "uuid": "29f8df4e-2a2f-4f49-bc0b-f1e74c90ac8d", "value": 633646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706535918, "uuid": "41a1622f-190b-438b-ba55-aaf4492b3e55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535918, "uuid": "5e9347dc-c127-42d6-aed3-d48c0a08c072", "value": "DHL AWB#3253606333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3dcd78-bece-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706550537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706550537, "uuid": "37fa1411-24de-4f6f-a28d-4868642c9dae", "comment": "Malware payload", "value": "2dd469d60faf6c3a50640ef3d8c09f11", "object_relation": "md5", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "pw-123456", "colour": "#E2C0E8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706550537, "uuid": "a760ab99-d1cf-4b8c-844c-6039a6fbd7cc", "comment": "Malware payload", "value": "b153fbc170fabfd2227f84865cfac5464e05b28a27937d4f76a8fa63dad37117", "object_relation": "sha256", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "pw-123456", "colour": "#E2C0E8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706550537, "uuid": "0c0ca572-c6da-4724-b250-6c96e5b32573", "comment": "Malware payload", "value": "9ecf65ca02d07fbc2a34781af9b2b09052ccb4df", "object_relation": "sha1", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "pw-123456", "colour": "#E2C0E8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706550537, "uuid": "14080dc8-5e6d-44cc-9a8a-0fba4ebefdfa", "comment": "Malware payload", "value": "60bda7057900621179d90561fc05ccb80498f55dbe1bf95d3c6e2d05b95b074db8fa2c1b0b58a4d498c69bc002e63ee5", "object_relation": "sha3-384", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "pw-123456", "colour": "#E2C0E8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706550537, "uuid": "ba7f2bbc-c279-40f1-b65f-003e815421a4", "value": "T18A352397173B1414CCC37246A2063B2ABD2C4EBA93A263354205A5ADCD87674BDCDBDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706550537, "uuid": "62ea1775-ea68-43b6-b3ce-7fe206b4f36f", "value": "24576:9m6UPHcSpCxb4XoJFCqjyDp2HFJAeHxgkOoLEf7F4FCaNV3v/110:zCHDp6cOjyDp8AGxXPYfZbaNdv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706550537, "uuid": "346fe9a5-3451-428b-83be-6a46dccaeefc", "value": 1071954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706550537, "uuid": "fccc24a1-7f2b-4d79-a04d-da188cf18e99", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706550537, "uuid": "99a9ca03-27f3-4339-982b-1b32958160a5", "value": "My documents24.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ce6c84-be75-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1706512113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706512113, "uuid": "1a3e427b-7576-4865-8fdf-a3d0e95d6c47", "comment": "Malware payload (PureLogStealer)", "value": "a72bbdcafba3b40c6f2e7d86844ac059", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706512113, "uuid": "73b817a8-80f0-4c62-9925-f9dbcfcc566c", "comment": "Malware payload (PureLogStealer)", "value": "b3e052743e942d601719b413754f2d7539be318e8af20de6c476e175dc1bd000", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706512113, "uuid": "aeea2c44-d810-48ee-8ec3-ec9014092e60", "comment": "Malware payload (PureLogStealer)", "value": "c4f3b0e4d2c4e84cfe9b38447910c032ade38aa9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706512113, "uuid": "2248ad16-5635-4777-a695-c7a93deaf0a3", "comment": "Malware payload (PureLogStealer)", "value": "68b9575dd392d482855293d5cf3542977af72b94aca9a641a442d695358ce4bff9f572467153768b92f2f8539432adb3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706512113, "uuid": "21d8cca7-ef5f-496b-99cc-63227f1a8d20", "value": "T1EAE5226373065A73CB956736DAB7A7050320FA672503D70BA7C962A9240B3BF1F92707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706512113, "uuid": "228a2f5f-b898-4b42-89b5-71800bb26ab2", "value": "49152:xKuv6JXD+yHot/1Jl/7dCwBxzqxti+Cz6DWmhknc6ea73GhlfMQdSHmzMce30yp6:Ytz9IttJpTPUGsQc6ea7uNMQdSGFis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706512113, "uuid": "62879fb5-e017-4c9e-9229-9b0acb0f343d", "value": 3263488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706512113, "uuid": "da17c75b-0378-4a27-81f5-b1056d31d24a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706512113, "uuid": "78a0da80-ee13-4798-8bdb-362d73e5b6ab", "value": "a72bbdcafba3b40c6f2e7d86844ac059", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fef4d1b-bed3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706552447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552447, "uuid": "7925c762-9b83-4351-9167-5ccb46417a2a", "comment": "Malware payload", "value": "440852b3cf0d8d9e3601f0ce75c87d6e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552447, "uuid": "80db4798-5331-4888-ac77-f50ef34853da", "comment": "Malware payload", "value": "b437f2f87cd4c3dcb748157bf0a67d546ec1761237b3064e873324c4fcbd13e0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552447, "uuid": "a807da36-5b46-4f72-9810-1043d52965ea", "comment": "Malware payload", "value": "bcc4ec3b96652ceeb12fe43e0e92c029394fdaf1", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552447, "uuid": "f73558b6-267a-4026-9a45-fbcc33053d9f", "comment": "Malware payload", "value": "23c9ae0a072ee99152b4690daac9b6f0fdfa0ab5e7563b331cc1ca0a8f6837f827fe9624649b230c1a84165de1409119", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552447, "uuid": "8fc5fedc-8f7d-4d1a-b629-099204cf0018", "value": "T10023A45EA346A424D05E7286C8E86A02924575FA62DCE201DB8EF702F4F7C5F4AF0DD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552447, "uuid": "d0d8bf3f-88fa-4235-ba68-890496d5e227", "value": "768:qgTYoac2fQDZhK9c67aAXAT/X92u+vGp1vatp7vWdJpBp7vPU2uEUzCtVZ3vzEDo:Ua/xbmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706552447, "uuid": "3b7625c0-8b54-4cf9-b1a1-23c4a6ccaf43", "value": 47199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706552447, "uuid": "f6ae04e0-b92d-444c-b055-47877f75922a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552447, "uuid": "f761f3f2-e24b-4d07-bb37-6e8af9448db2", "value": "bRZbH.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38c1fdf-beb4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706539461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539461, "uuid": "fd23175f-483e-4964-91da-13149ef622d2", "comment": "Malware payload (AgentTesla)", "value": "136665ccdc5a00ac893337ca535a9b00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539461, "uuid": "3ca7b71e-0f7b-426d-a355-7aee1c586870", "comment": "Malware payload (AgentTesla)", "value": "b47914d632508339a012e07cc4030b35b25a78665513276c26496affefd01b90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539461, "uuid": "cabf3da5-bff0-4cf4-b491-ca8c8bc65c36", "comment": "Malware payload (AgentTesla)", "value": "b711f4996e91585fb28ea367613ae8994bb9dd84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539461, "uuid": "a98ccf50-dd63-447c-a6c7-81ba1b8fc315", "comment": "Malware payload (AgentTesla)", "value": "5e464e8f331a6f1666a4c762aea808380589425d646fc7ed2006e1f7b1b4dc16d12fce251f2db6266d436b9232f94c5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539461, "uuid": "98011c2d-3a72-471e-9c25-7db88a58387a", "value": "T119D4F1F2B5408182FC1F24BF553A5D5793E43D3B9ADC164A324CB26EE9B31D24C62A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539461, "uuid": "d564db9a-fc20-45f8-9c6c-f6202075a607", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539461, "uuid": "42da7591-b567-4fe9-893f-4e0c2357465c", "value": "12288:jhNMKBSfLJ0/OXH3T42AqwYVi8oin1f3EnYb3xl4mrofsMWFsyS:jhaRfKYXTjDVhoA1fPrTMZyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706539461, "uuid": "b6009725-587d-49f0-b03f-daad12a4fb24", "value": 637912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706539461, "uuid": "2b0aa577-0c47-42ac-858c-88bd5ca4fb60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539461, "uuid": "11b7cf09-521d-488e-b8c9-2820f89994ea", "value": "JKL-764-JPL-93873637BNSS.SCR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57841247-be86-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706519469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706519469, "uuid": "6585789a-71a0-4dda-bc12-09d310a77f4c", "comment": "Malware payload (AgentTesla)", "value": "e854913ededc0980b726fa7e2ce50c12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706519469, "uuid": "004e379a-605c-4f71-bb10-f08c5a1fa117", "comment": "Malware payload (AgentTesla)", "value": "b4e2e4f3b77444e5842ef2b48fd76d93202c3d598b1276aef4d79c75044b8d60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706519469, "uuid": "dcd85e30-4913-4765-9916-0764a74dc21f", "comment": "Malware payload (AgentTesla)", "value": "f4e92bd82c77b2d2f3f561c60907bcf4558b4b24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706519469, "uuid": "744eb39e-ae07-49f0-bbe7-a358f17ce8da", "comment": "Malware payload (AgentTesla)", "value": "2b98d68705603370d3fd8501ddff8641c96866db10330d971b1028da223a7708cdb5bb955f733c85070c07af199a4a54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706519469, "uuid": "70acc47b-366f-4471-bb5d-5eb01e6be39c", "value": "T1FDE4334801D62C9C22562AF07A74F4F71D36F2FC1D8854E7CA6D21D142AFAA7F08F869", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706519469, "uuid": "f1d9c835-c957-46cb-af6a-d63921c631a7", "value": "12288:pbj/dNRTQtDtjXcqvhRg8FJjhuuAQkzQ+/vFMeS9n0hVoa3rzcxW6CbLCu1aoQ:pbj/xQ4czzuuVn+trVTbzUWTbL19Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706519469, "uuid": "80391586-0185-4e80-8320-d4909e61f7d1", "value": 681414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706519469, "uuid": "1ad20738-af92-4d5d-87dd-eca7b2d54354", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706519469, "uuid": "111a13b6-793c-4ff7-9fb9-b463248d56d8", "value": "URGENT REQUEST FOR QUOTATION.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ac70e7-beab-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1706535514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535514, "uuid": "1b68daa4-af4c-4b5e-9041-2636967f1ccf", "comment": "Malware payload (DarkTortilla)", "value": "32dc78fb6404ea208664c36a7861bceb", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535514, "uuid": "f8355802-75a3-4104-9d51-7a7307d654b9", "comment": "Malware payload (DarkTortilla)", "value": "b568884238f4544d67983baa7649a0591338e170d7b310c98fb1ae1d43599100", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535514, "uuid": "49b8863a-aa70-4a35-893a-6d9d6a2fd4de", "comment": "Malware payload (DarkTortilla)", "value": "715f20755af58b2d9f8c9e713c42f3315178d216", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535514, "uuid": "3bb4429a-3239-4dc9-a42e-9594f59d8349", "comment": "Malware payload (DarkTortilla)", "value": "4c69c6e67acc6926644613896b0168b3c69d3d567d3275fd6383f03a3ff064c893d760e9fce27e9588e7c93b8f2135b9", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535514, "uuid": "57c091a8-e714-44f4-9bcb-d4aa1263ced5", "value": "T1C78533F187DDC2026F96A98DB38699813AADFF2C4615447A461F0CD5401B0E379A6CFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535514, "uuid": "b2cf38d7-7813-43f9-8914-b4416aed98cb", "value": "49152:v/U7gztj7o0su7+o/jysGbJ9uKamo8yElvlH8Fi:v/U7gzllscjyfzFamo8BlH8Fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706535514, "uuid": "0ec73661-0773-4240-93af-d316424846fb", "value": 1782557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706535514, "uuid": "7a57c41a-73e7-4dc0-a123-d01984d776d9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535514, "uuid": "b1a45296-a8d6-41db-82b1-e037fa794f11", "value": "29012024.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51933f08-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706536210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536210, "uuid": "6f134b03-accd-4e63-8f68-2d7e5926c15a", "comment": "Malware payload (AgentTesla)", "value": "2be961ccac9d079860175447b244cd0f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536210, "uuid": "eec50b55-0336-44c8-a4a1-563d6714fdf1", "comment": "Malware payload (AgentTesla)", "value": "b61573047a84a9c5a588dc74e37c558a1c86506857578b48f5a5d1f56ea4d316", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536210, "uuid": "95819154-228c-4bbf-940b-08c38e78bce5", "comment": "Malware payload (AgentTesla)", "value": "d27cfbb079300c610bb25bf67babcb9b9ea6f36c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536210, "uuid": "bbe4af09-9e68-4f9b-b735-5955372a2fdd", "comment": "Malware payload (AgentTesla)", "value": "bb71e3c806254a1de38e1a9982b39ba8a1675181cd4a426b59833fc1a2a507e53538f454767f284299bb445ed4dc49c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536210, "uuid": "b0f5428a-6df7-443d-863e-8c82ffbccba8", "value": "T1D8F4121225B81F17E4E79BFD8461E1804BF174A77600E7594E90B2DF2EAB7928F04AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536210, "uuid": "b7d0021b-2009-4c39-9e26-11e03a826103", "value": "12288:waFpZdTKGZrf4OCJMYvHa6v7reF9ZXMHzT+xjrDUT0u+pCE5:tZ/XQ/OZ6216lc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536210, "uuid": "c3f8d7a4-06d5-4d53-8b30-3d67c81b3ec0", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536210, "uuid": "cfb5cfc6-b07b-431f-b1d1-ababf54af62b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536210, "uuid": "11e5dc4b-c06b-4f42-82a0-d116887dd863", "value": "P0#364868-2024-Order.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f9743d-beca-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706548837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706548837, "uuid": "bafe678f-3628-45f7-8a7a-d05a8f7bf995", "comment": "Malware payload", "value": "1f4659b969ce4af415f22a23d858982c", "object_relation": "md5", "Tag": [ { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "WHISKEY", "colour": "#947A0B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706548837, "uuid": "203c031a-0d1b-4e62-b991-614592e195c2", "comment": "Malware payload", "value": "b670074aea442993154d48682a50491eaec45489d23167368934b60ae6c19cf8", "object_relation": "sha256", "Tag": [ { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "WHISKEY", "colour": "#947A0B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706548837, "uuid": "a4a7f316-c640-4fcb-9644-d84bc5682aa4", "comment": "Malware payload", "value": "879a673f6c08c2f1590c3fa78b78813d9742c47e", "object_relation": "sha1", "Tag": [ { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "WHISKEY", "colour": "#947A0B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706548837, "uuid": "d4ab45f9-7d00-46b1-a984-40e33d3581d8", "comment": "Malware payload", "value": "6afb9a1dea8b1845af8fce91ccd3619eb091ba5c10b854ce1204d7d54293f25f4769e4517f4dba09023928c1ae2e9e1a", "object_relation": "sha3-384", "Tag": [ { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "WHISKEY", "colour": "#947A0B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706548837, "uuid": "6dc4425b-98c8-4250-8c3a-80aa053e565c", "value": "T195D533DF6DE230049FBC487A359F650B54271EDA80A32D819C2EDB5C17C762918EB7CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706548837, "uuid": "2fcd0463-f58c-43f3-996b-defb87d1b827", "value": "49152:R21Nbr1hXQ8XRXIQwhpwbggUTsnt3odO49/ORDbHF2BsXh:6NNhBXIQuOggks1GORRPgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706548837, "uuid": "356368b7-d33f-455f-910a-8c97cb958b06", "value": 2805902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706548837, "uuid": "3e1684d8-fb47-4697-8a5b-1f2197c68fe9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706548837, "uuid": "aa84a10e-b5ed-4280-924e-e5f7700d5d3d", "value": "File_Setup-4455_Ke\u00cc\u0081yC0de.rar_b670074aea442993154d48682a50491eaec45489d23167368934b60ae6c19cf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc304be-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706520257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520257, "uuid": "66231a67-050f-4996-96b0-949e585bbaad", "comment": "Malware payload (AgentTesla)", "value": "632f5cd9c8e66aea271ec50825d2d4be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520257, "uuid": "9d2d4a29-2ef7-4b5d-a7da-9c9677256314", "comment": "Malware payload (AgentTesla)", "value": "b945c49316cbac0a99ca74373a19990e69578e853b5eb52b9500298ccaebdea0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520257, "uuid": "64a1f01b-0aff-4e45-9708-6f7577b8e12f", "comment": "Malware payload (AgentTesla)", "value": "4861446dd256b3d656e2dc1d76189a916fbf96fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520257, "uuid": "1373c567-eec2-4ebf-80df-c105881ace0a", "comment": "Malware payload (AgentTesla)", "value": "90ce3cedbca3e25ecb9ae5327219ca0988027b9f124b9ab8fffd4a90c17acc39878db585a3c7be3ab569753f064e84f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520257, "uuid": "d74f0250-1aab-400f-9360-d0f9c010f4b3", "value": "T19D94F7E131AC8383E1A09DB14FDB467076F139AD98F0520C75F89B6E97D2351488DAEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520257, "uuid": "6ce210b6-9efa-4c18-b999-969ba665c63c", "value": "6144:d240mF1UhI01zUNcaJwA+Bdnh5FDvVaY1U6QUxgiVS8UOKi:YmmiwAo9ttMDULVFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520257, "uuid": "f3bb770e-337b-4d11-afa4-e5ba670efda2", "value": 427008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520257, "uuid": "075997ef-1f46-4ba9-a856-ad57ac3620d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520257, "uuid": "6265dc8d-08a7-4d1c-ad4b-f1c6000940c3", "value": "lista de empaque de factura comercial.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d6bf90-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706536249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536249, "uuid": "568c46e3-90d7-4e4b-b6ca-a833243adb91", "comment": "Malware payload (AgentTesla)", "value": "3806ccf25a1730ed9ec9be66ad7d9efd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536249, "uuid": "0c8fa786-20a1-4547-998c-99b3650b62b3", "comment": "Malware payload (AgentTesla)", "value": "ba91cf97e39cae67db5593850f05d7a9fc978b44d7d6a04ee4cc6add8649d4b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536249, "uuid": "26782603-b6c6-4fe7-bf45-9f1cc89888e0", "comment": "Malware payload (AgentTesla)", "value": "5c2e9a4150c1f08bacbfb485aa5c3d220017f780", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536249, "uuid": "33780c77-26c9-4132-87af-3c9dedc3617e", "comment": "Malware payload (AgentTesla)", "value": "47e37a37f30672f94cf69c874e3264baf97a7eeecd22d97227dfb5c790abb6232093122a1d2b374eb2c48eb49859f0e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536249, "uuid": "ffd99c75-d785-4e35-9191-6d76700a2e1e", "value": "T1F8E4133DB6743983C87504F854061344A3F1E06B9E8BE7D8ADE17AFA22E2BD15B161D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536249, "uuid": "74b09b7c-f0ac-42aa-8e19-77f079e8055c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536249, "uuid": "363df51f-0f39-4c8c-a504-7526536c7eec", "value": "12288:ttTKGZrJGgzxMK1eiheLtlrFjq92aNOMMxylTLEmOAtpD:9X2KEiheLJuPnHlHHtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536249, "uuid": "d1c76cd6-f35a-402e-b42a-e5b909d1aeb6", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536249, "uuid": "14364f44-0a44-43cb-afa1-2f7c46c7eab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536249, "uuid": "bf21fee3-292e-4468-a273-89e8ec6690a7", "value": "Banka Transferi.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60fff94-bef9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706569127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569127, "uuid": "c39b86f4-b3d8-4dac-91d6-2e266e8800c0", "comment": "Malware payload (Mirai)", "value": "2f11ec818b0a2b39e3953e85b97feef7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569127, "uuid": "9dc74e8c-7ae9-417b-8d85-8a81086128e6", "comment": "Malware payload (Mirai)", "value": "bb55547ae5f7e9d473997b09da160f20ad84998e199c79e055771fc6444a4b9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569127, "uuid": "bfdabf2d-5d3d-4b5f-9322-af793e934c74", "comment": "Malware payload (Mirai)", "value": "7b8258bbad7a13b4e75143bdc20d29514afb1375", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569127, "uuid": "c99e5991-30dc-4923-8488-220e43ebf03b", "comment": "Malware payload (Mirai)", "value": "c17e571db256ae85fd107a962e25e253a7b34e82a85a246d773ade20a6b88e2cf762acf000e504ecda75f4925c633287", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569127, "uuid": "6e7604dd-a316-4809-8fdd-8c86f0ce9f62", "value": "T1EEB2F171A1863E62D770313E693CCA01576B97F8B4FA71753624B6AC4BD2C4724B814F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569127, "uuid": "32592978-e37e-4233-82b2-766998b836ff", "value": "384:vZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdWhymdGUop5hK4:yX1De9kONQG5xD+jHMDzuWs3UozY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706569127, "uuid": "7312e0ec-8f2c-409b-b139-98b9118cebe0", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706569127, "uuid": "2872b230-903d-4653-bc2a-3dbeca8f5d8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569127, "uuid": "8f4cc816-b6f8-46ba-b8fc-3a6c43190234", "value": "2f11ec818b0a2b39e3953e85b97feef7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ce6c42-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706536433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536433, "uuid": "1a38d867-9599-46a6-9679-e587af71c8b7", "comment": "Malware payload (Formbook)", "value": "36ea6db46ef73a976acb19d17e82772a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536433, "uuid": "3622e7d9-48bf-4df8-8425-a1b0ad4cee93", "comment": "Malware payload (Formbook)", "value": "bdcdd28430ef388c3d1041d245057104f79eb91a03ad4dc7f587f8c22f36506f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536433, "uuid": "dee87b03-4c8a-4f1d-9616-bf70ccc34325", "comment": "Malware payload (Formbook)", "value": "d38429b72e4d71035be20c4d485512123be76231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536433, "uuid": "8e566ff8-cc35-4f8c-9b7e-9f92aa13106b", "comment": "Malware payload (Formbook)", "value": "e8c4408cb90b30b2eebafa1c7949ca47e670135186af98e76fd73d272c64fd088fcb92547a56d417c76277bc94400b93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536433, "uuid": "a5c6bf31-0ea9-4843-991f-b85c24688650", "value": "T1D5256DD1F15488DAED6B09F1BD2AA53024A7BE9C54A4810C569DBB1B36F3342309FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536433, "uuid": "ab0fdf84-9b50-41d4-aa93-0b536d2bd4ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536433, "uuid": "e9e0d2df-4317-4ab8-afca-c9733fb3f19e", "value": "24576:wvJz/IIHFv9HNjU64mWEqWsa0tQ5jgjjZ8:QbXvdNnl+DtvHZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536433, "uuid": "e9dcd1c5-a9b0-46d2-896a-28ec464cd4fe", "value": 1028608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536433, "uuid": "06561188-2b6c-412a-8a2a-1e53a3ee1d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536433, "uuid": "dcbccfcd-ea3f-4d52-909d-0eb67de8f570", "value": "04251452615625625.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb33286-be5e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706502194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706502194, "uuid": "a08db217-b101-4c42-8627-74e08346c060", "comment": "Malware payload", "value": "4a1775224398235d1e35cff50e3e10df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706502194, "uuid": "d6848a9a-0ea7-47f6-a8f4-505762f0e2fd", "comment": "Malware payload", "value": "bfa5a9d333c2de8b30f35941eb33301a1d538db24ccaebe155300e3e9395ccfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706502194, "uuid": "371e12ed-021b-43f3-abeb-886f1811d8f5", "comment": "Malware payload", "value": "fa95d9dea27f2f0a23163568b28063c9126a1682", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706502194, "uuid": "d542dce8-f708-4eed-ad1c-4c602965619c", "comment": "Malware payload", "value": "4c71ab657d6471d58c87ea0def2cf6c59cc2344d03f717170cbaa14c8a59b3c7c09f30a079b619af99b5994056aee562", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706502194, "uuid": "f16c2603-c1d0-4780-98fb-c372294c388e", "value": "T116A46D66F6E48837C1631A3DCC4B97A89826FE502D6898463BF43C4C9F7E78178192D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706502194, "uuid": "3c8fb6d3-5b05-4d68-a906-050cab89ec37", "value": "94ae9d208fc90ae5f8f62b2d3ed3287c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706502194, "uuid": "396bab4b-683d-495f-aeea-aa295c0109bd", "value": "12288:9RZUYBBuq5umIj63CWPjDnEy1ZQYjwXf:9XzZ3IjuYKeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706502194, "uuid": "25f080e5-470b-45b8-962f-d1f3aacf956c", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706502194, "uuid": "5e9a194d-d28b-4d30-a7b7-ad69074e4146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706502194, "uuid": "c6f3a750-4fa4-400d-b95e-1f2d12c0dae9", "value": "SecuriteInfo.com.Adware.InstallCore.53.27602.25215", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c2abcf-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706520275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520275, "uuid": "d8dc66df-b1c5-415e-9567-bfdb9901b86b", "comment": "Malware payload (AgentTesla)", "value": "968a9fe4fccd0723b5eb8bac04dfb668", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520275, "uuid": "3a91c256-ad93-4daf-bbfc-73865d6bcb34", "comment": "Malware payload (AgentTesla)", "value": "c20765742b6d22e16299239e960d1c4e851fa9f12bd1b0696d4195f8890a6bf6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520275, "uuid": "c8287a51-7181-4c0e-bffa-109edd3ed801", "comment": "Malware payload (AgentTesla)", "value": "b6ff6d9c28755b38c25c1fca3abcfdb54142aa56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520275, "uuid": "c0385ec0-7184-4361-97f8-80859ce8a51e", "comment": "Malware payload (AgentTesla)", "value": "07907e88e3b6a7dca175eff1a0882a498ab778c8171ab007ae19d1e63829bc74e986f329becf573fd4ab8e6934159ea1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520275, "uuid": "fe725723-0b42-486a-9a19-3ac389d32c91", "value": "T1FA459E0273D19066FF9B62B39F0AF9416A797C295433852F23643D7EFA711A2123E217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520275, "uuid": "0bc9b180-d432-4cab-8cf7-ddc785d043b4", "value": "bd3825b6e0410966f0c31f64b6c7644a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520275, "uuid": "146a058c-6578-424a-8cf3-1c34a99daa8d", "value": "24576:HAHnh+eWsN3skA4RV1Hom2KXcmtc611cIV4uDSnX:6h+ZkldoPKsac6ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520275, "uuid": "ba325c78-8606-445a-97d0-f438c0a41032", "value": 1234944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520275, "uuid": "d37fc2d1-84fe-4060-b197-c3cd7d469d77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520275, "uuid": "299d0d33-d7d5-4b51-9daa-e6d09f55eb67", "value": "solicitud de cotizaci\u00f3n0089.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bce1cd-bedf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706557871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557871, "uuid": "edda9dee-634d-4f4c-a3aa-c937e7f7ca8b", "comment": "Malware payload", "value": "6317dc78b751e7dd6e5cf23d72be5acb", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557871, "uuid": "1a32dc76-c853-47c4-9bc6-69fc82520b68", "comment": "Malware payload", "value": "c3ce5878dd7c8ce91ebc79476c363bc0c505d5dbf199d695c54523c651da5e3d", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557871, "uuid": "54812564-6b6f-4797-a647-1681b0c45190", "comment": "Malware payload", "value": "21ee34568a6abe92699e8941168abdd78218cf5c", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557871, "uuid": "33ba7a08-3a55-451a-8814-e067cba914ae", "comment": "Malware payload", "value": "55e4b3b814dd0d4c746fe8a197f80bdde495263e03ca09efc23980b4bc67b5dce02e2b6c99e0549ad8ff5b42bcc2d68e", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706557871, "uuid": "bc64c3be-45ca-4388-8173-d57549cebdd3", "value": "T1CC951271E4A340D9CB24B6B58CEA0F2067722D4D622263129771F56DFDE73ACA19D0CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706557871, "uuid": "672f2de7-b489-4ae5-a702-77f42ab0fea3", "value": "49152:KVdYPe5bqvQP2bUcnbkW8kmkNsuDAgyy6nw42fQWfxt:kmPe5bunjbkWrmLPgArAZfxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706557871, "uuid": "65866e50-80c7-4b58-b94b-0ac6e9bcf216", "value": 1887477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706557871, "uuid": "2c89337c-089d-4193-b5eb-3809878be22c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706557871, "uuid": "abbf8d4f-5e14-49ed-a752-7e3fbfdc3fd4", "value": "Buz\u00f3n 98710989 Informe ZBNAghrd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aade77c-beae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706536628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536628, "uuid": "6eea767f-528a-4765-95ae-01b902ce0cd1", "comment": "Malware payload (Formbook)", "value": "ecbfd514f4c2e49d00cfc028f79b8de9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536628, "uuid": "5bef5286-e64d-4dbe-960b-d517e17ef9b1", "comment": "Malware payload (Formbook)", "value": "c5f12df3ea1a353211d78d2fee55c7efdf9ff6ada6ec21ffb513661734072543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536628, "uuid": "d6d15247-14d8-48e1-98c3-480b6a859147", "comment": "Malware payload (Formbook)", "value": "c6fad2f3781b734690d9fb7cc3e44c5ae6ce16dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536628, "uuid": "709b5f79-34c2-44e4-b886-9baf6dec044d", "comment": "Malware payload (Formbook)", "value": "46715e9e552dd7bc4459114df7411f32f0b50d1b00d8dfeb47bab79deaf3c7d48dba0b33b13143920c0ec3e7ef9bfc5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536628, "uuid": "6fa4bd61-1b53-4dd9-9407-d7296d00bfab", "value": "T11F3528B864B84567C47AC6F19EE59433F091ADAF30608D1859DB775213BB70238CBE2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536628, "uuid": "5c4de4ee-1f6b-4bd2-b760-bdd1302dbe16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536628, "uuid": "a4bf1609-4b94-4e6e-8329-cf8288c11567", "value": "12288:vETzHr7FLOYmpEzAZ3wSCB93O7P+qnAivnyo9rMS9NaWoH8J5s1pkvgV:KNL2+zAaO7P7nAEyo+S9UVHmuog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536628, "uuid": "a9b31104-aa0a-458b-a301-eee52fa45a9e", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536628, "uuid": "e85b793a-505b-4a3f-8271-4c6284140fda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536628, "uuid": "084f3241-c2a9-4445-968e-46ff51a81e0b", "value": "PO SENDFAFE600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c5d7ce-beab-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706535517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535517, "uuid": "0980da36-5589-4f7f-a102-f66e100e071a", "comment": "Malware payload (RemcosRAT)", "value": "5e5c4d53d4c51e067287b3b2c5a0ccb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535517, "uuid": "4ad0b59a-558e-41f0-8c3f-efaff5fcb5e8", "comment": "Malware payload (RemcosRAT)", "value": "c6190f275806fbc359dfb1ce50790b29355215fa3b9671ea5a81ac35293b9de3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535517, "uuid": "950934f1-1220-4015-ba24-b4c22a5712fa", "comment": "Malware payload (RemcosRAT)", "value": "cd2a82ebb5e573cd01c0b708a249401d35b9424d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535517, "uuid": "6a5d6c52-20ed-41a2-9f60-0ddf9e6cf1c4", "comment": "Malware payload (RemcosRAT)", "value": "6f35098523d2503b6ee3e9503f4e3e1594730d68086129df278778abac3c66e3b089335336865969917a813f2cc9668b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535517, "uuid": "013f8dbd-0ccb-4d8b-8679-420a62b254dc", "value": "T1BBB40243F72C876FE7C94F71383A0235AAA99F530950A845B7C9FE1D443239D9D026E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535517, "uuid": "bcba893e-c73f-49ea-bda0-a89ba982d11c", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535517, "uuid": "dad7e13a-2be7-4b1d-9948-231c8c242694", "value": "6144:XGC7W7BUJEflHwJVUesOjc3kv9MNfvfUuAhbLCrJHvg+JEVV8nU/uwtzSEdyS+tZ:Na7rNQJJpjcgyfvfUPs2PD4EdaMAboDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706535517, "uuid": "70132fdb-1a79-4cb6-94df-475be64332b0", "value": 494664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706535517, "uuid": "b0b5b7b6-1569-4c10-b091-0fb9246c1070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535517, "uuid": "d116bf05-c83c-4395-a40e-347c9cfc249f", "value": "ORDER#4510093083_PO_NEW_MATERIAL_JAN_20242.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac1fe50-be67-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706506053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706506053, "uuid": "7d1a55bc-6fd3-4d56-9053-e7f62b529e21", "comment": "Malware payload (GuLoader)", "value": "1d6deff19f2f9338d04b813b854bba94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706506053, "uuid": "78e2b956-d376-40da-b330-0332c0a59aa5", "comment": "Malware payload (GuLoader)", "value": "c61fc49f3c2ca475a85c75db00efc5c25a549dae22546fbc8c85c56f6f40277e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706506053, "uuid": "366fbe40-e4a6-440e-9e2e-7920d9b5d371", "comment": "Malware payload (GuLoader)", "value": "6f664a2a1f48ef7f72be65d9abcf00b60218dc48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706506053, "uuid": "b2d5d8bb-81a2-46c4-b7ab-c5945c4b4ee2", "comment": "Malware payload (GuLoader)", "value": "fd3ae0adf44f626d6c39614b39dcc23d280f3e00ebb7f5811ee287d5542a99aa9a0336eaf15bdf0021fe9fb49f6e75a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706506053, "uuid": "0e0a878f-9744-4795-8719-a5b2d43f38da", "value": "T18AD46B31B79BAC96C4190CF2555E03EF04D0D7AF165497C3E391ADAB7F2A481862B8D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706506053, "uuid": "6a32ea65-1535-42e5-af2b-3298aa436e57", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706506053, "uuid": "019befba-de7d-45a3-92a7-e3fe8eee9cd3", "value": "12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLE8p89:AQy6ONsqLENbTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706506053, "uuid": "c95f1138-4417-4f16-9731-ebda32bc2ab8", "value": 632762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706506053, "uuid": "886adafb-8edc-40af-ad7c-4a380e50ef2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706506053, "uuid": "29003761-84f6-47e6-b98c-7cd8c2ef92fa", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1337932.6163.2826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db67b679-beb4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706539447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539447, "uuid": "76c0713e-18db-4283-8b19-e4229b075d77", "comment": "Malware payload (AgentTesla)", "value": "51a173329624ef987e15ae3c0cf6ebfb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539447, "uuid": "5898a6e1-e1d4-4fe8-a165-341874ad0ba5", "comment": "Malware payload (AgentTesla)", "value": "c6aabca4f47471641b63db1009d086e651703eed4d1c0da3bc2b810669760714", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539447, "uuid": "a23e6296-bdb4-413e-9c6b-562c826dec29", "comment": "Malware payload (AgentTesla)", "value": "c3fb4db8278a68237eff00d7a2e69b55a171f69f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539447, "uuid": "c1cedd12-eeb4-45bd-9e30-8e007b137a0d", "comment": "Malware payload (AgentTesla)", "value": "85722783ec96f3acc241d8aa2589548654f3af2e0b84494e915b231d13860362f5dcfd5e583bbe2e3857aa7ec79e684f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539447, "uuid": "217b7745-ae36-42f6-9729-a23084af6631", "value": "T18FC3D603B6BA8AAAC389573ADADB41141375D597F723E70EFA8F33D604033B66941607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539447, "uuid": "d9a40d3c-9f3e-4f8a-a38b-7782ba95161a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539447, "uuid": "ea703876-d15e-4e98-a7f2-0defe6d4b460", "value": "1536:muG1RC1I5ZJwhuaEig3NFs8zhp8vgIsxUQPMJT5m8Ni7P5hLG/7Us:mzNZJmI15Egixv7Us", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706539447, "uuid": "12e4c6b4-076f-4905-a562-2220ffde0737", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706539447, "uuid": "e179553e-d9cf-4c13-b00c-0acca8ca46b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539447, "uuid": "f7df5e0f-f61d-439a-90e8-8d0beb5c221d", "value": "CaixaBank _ banca digital CaixaBankNow45450-09898965621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97957ba1-be95-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1706526019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526019, "uuid": "a9d06abf-f1f2-4148-a9ff-543e2122df84", "comment": "Malware payload (AZORult)", "value": "5b8022f1ccd09dc5587cdb6dacf2c988", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526019, "uuid": "af95d5c1-4b19-493b-8bd4-73ed5aec2747", "comment": "Malware payload (AZORult)", "value": "c7a507037034269e55954889151a0ee1e6e87cba15ee857d7e25beb088a28f4d", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526019, "uuid": "d1b72c98-a723-498a-86bc-621c30d8e285", "comment": "Malware payload (AZORult)", "value": "69a19b82000cd013d34a2ad179ab0613d0369748", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526019, "uuid": "4c20eb8e-b628-4fee-a545-d4a5066a221c", "comment": "Malware payload (AZORult)", "value": "9c9bd13fdde1dd8a16e8d724400d0ad802573128395193a8c7a62f14d37e6069ad919225c28ced050b9349d8737c9297", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706526019, "uuid": "a53b0f53-5ccd-4cfc-9b81-f6ac491ea028", "value": "T17DD46B31B79BACE6C4190CF2515E03EE08D0E7AF165497C3E391ADAB7F2A581851B8D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706526019, "uuid": "051f2160-7d8b-4053-b406-8a66d87aa14c", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706526019, "uuid": "173a1eed-26f6-4285-8f20-3f9ccab65ef6", "value": "12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLVEaeR:AQy6ONsqLVELQDTrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706526019, "uuid": "58fe0342-5534-49d2-896b-538d18d612ca", "value": 627650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706526019, "uuid": "73bac07e-08b4-44e9-9014-ac3cbc49d41c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706526019, "uuid": "91ec6f23-a192-4210-803d-2ad0104cb667", "value": "KPO0770147-Doclpo1178890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d405c9-be7d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706515812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706515812, "uuid": "ed9a47ba-7ec3-49a3-b62f-4efcc584c133", "comment": "Malware payload", "value": "42321c34329e4e433d01804f0acd71fc", "object_relation": "md5", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706515812, "uuid": "1328d822-b4b8-4042-b065-fd71c464a606", "comment": "Malware payload", "value": "c8a76f419f7c2ce4c855aa2a961ac0e7e4377bd8a6d33f76f61b8f99e0c9a5f7", "object_relation": "sha256", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706515812, "uuid": "cc69a1db-588b-47be-9ee9-25715cc55c70", "comment": "Malware payload", "value": "95e674635920e66377660921b4a9e23700cbc7f0", "object_relation": "sha1", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706515812, "uuid": "1779d1c3-3421-4717-85e8-4d434a1e14e1", "comment": "Malware payload", "value": "08bb39836fc6aaa4a89ac7a5eb0ecf24ff368784607ca9ae166d44f84696650b4f1aa4564cf3c581dc454e908a8ce028", "object_relation": "sha3-384", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706515812, "uuid": "890345aa-e6fc-474b-a5ad-7f483fe649c8", "value": "T133110EA0CBA74E11D75D85F1921B2291CF4A3785A940DB8C311C07B3BBD50C71B8A3B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706515812, "uuid": "ca4aec76-79c3-4e32-b3f1-6d5029d1c7c1", "value": "24:9ULN+Sek478LaUzZUPV0S+D73cJYu2oiCjwLcefl:96je5DUzyt05gwoiEwLDfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706515812, "uuid": "37de319e-2511-4436-828e-f24e30b1a4e0", "value": 1075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706515812, "uuid": "af6b4f76-2aec-4c23-8e4e-2a1f3cc0e114", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706515812, "uuid": "365ccbcc-8531-4422-a923-508b8f7c7c6a", "value": "RLDTLLRLDTLLRLDTLLRLDTLL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1dde171-bedc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706556638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556638, "uuid": "2af23ce2-6193-42e6-b748-dd05f1aee1df", "comment": "Malware payload", "value": "9a3de5f21dc906517a9746a03e536a7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556638, "uuid": "6f167861-6fe7-4597-83d5-a4bdba9045ac", "comment": "Malware payload", "value": "c982a5d47606ddca1416655a81de6ddc4c55e01f9f573144a1ddcf9fc621081e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556638, "uuid": "d27f7e7c-c9d6-4e5f-bdfd-50f7d6c7e8e0", "comment": "Malware payload", "value": "2119c184829366b36f80641c98fa2d095a2dcb45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556638, "uuid": "5c214d7a-5a0c-4cd8-b608-88083e4fb9b1", "comment": "Malware payload", "value": "63bca19aee259645524863385e0ed721335d93b849ed27dfb05775de22038d51eb7c45bd40b82f112c6c823e9c734c7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556638, "uuid": "71b105f0-a3cd-4cc7-a9fe-1f59eadac276", "value": "T1FA75DF12B3D1C035FEAB92735B66F64156BD7D650133852F22983DB9BEB01B2123E263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556638, "uuid": "8dade727-edb0-4429-82d7-a576702f5c8c", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556638, "uuid": "0ae00463-3866-4132-a11e-2cd711139335", "value": "24576:8AHnh+eWsN3skA4RV1Hom2KXMmHaGY+5TnTavf9KrphJAXbPMWBANv50:bh+ZkldoPK8YaGY+5TnTavfcrQAWyn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706556638, "uuid": "3b7fe9e8-6cab-4a6a-80b7-ef65faef4a82", "value": 1580192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706556638, "uuid": "1f5de810-3261-4aac-b956-2fb0a741c14a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556638, "uuid": "fe52f9a5-72de-48d6-8267-f2e08af54e9a", "value": "SecuriteInfo.com.Program.Unwanted.3484.6218.26573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b20a259-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706520281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520281, "uuid": "065c0012-aae2-4d00-a5a2-042f1bf89fbb", "comment": "Malware payload (AgentTesla)", "value": "9a44f36caf11078eb7abd74748f16a54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520281, "uuid": "de1d8ca5-b904-426e-8131-0b6c4bc392bf", "comment": "Malware payload (AgentTesla)", "value": "ca78cc22c0e49a75cc75a733acf0b088c3bb74375056872590bc71356f03c6a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520281, "uuid": "3fe37285-3ad9-4e31-8d2b-dc52b752fdff", "comment": "Malware payload (AgentTesla)", "value": "7801376c1332b904d12675a9007a4c12866db860", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520281, "uuid": "a3965a7e-500e-491d-86a2-af9310631bbd", "comment": "Malware payload (AgentTesla)", "value": "e0ae53937198cc914ff8575868c8337a6b656fdac96c0160bde19807333f93e8f81c312bb4c71419b37b66442c75239b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520281, "uuid": "14e29bfe-84fb-4740-8943-3858a1964cc3", "value": "T129F4124936B89712C8B94BFF59B062941BF1B5526490F3EC0F8032FE1DA6BD18B10E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520281, "uuid": "deac0ac0-a3ca-4e60-aa8e-051ceb809703", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520281, "uuid": "2c0f0ce0-1adc-4796-8539-9542b1e5897a", "value": "12288:Va122IoIFFHgeg/cVLrDkld4st6QxkNII9CiqJ+Gz/dM+PJw4Yrc14LrGi:H2IXFxFrDytjoCiqJ+GzpPpYQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520281, "uuid": "c261d33c-8f6e-40d7-87da-1a4373c5d74d", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520281, "uuid": "78145d2f-b097-4d2c-b5ce-1295fc67a377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520281, "uuid": "5438bf89-12cc-498b-b09d-a9d42af32ffc", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50e6cd8-bef5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706567354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567354, "uuid": "9d12d4f2-3fc9-46f3-8a75-93e4ed12bd33", "comment": "Malware payload (Mirai)", "value": "f9b1d3d96d80dd9869638708d5d779f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567354, "uuid": "02015eae-408d-431c-b9ca-14fc5f88b659", "comment": "Malware payload (Mirai)", "value": "cab1862251c0fb98ba222ccfab4930f0c2f4bdb436d2ad0bc3ac02796156fe6f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567354, "uuid": "e640c1b6-959a-44d3-aac9-3c1fba8d6188", "comment": "Malware payload (Mirai)", "value": "c8f11282c771cee490eb2b70ce87d685a1fbd180", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567354, "uuid": "b4b0c2a7-0c19-4d64-ae2b-b496896aa88f", "comment": "Malware payload (Mirai)", "value": "58239a471454be13815b9e279698dab0b2330006fc0453c12d3d5fe751acdcb91c6a91a0143145f00fddf7b39c5a25d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567354, "uuid": "e25b5be0-c698-47a0-9974-3e8d130ea0c6", "value": "T19AA37CC5F28BD4F2E90704B06136E73BAA72D17A612DFA42C379D930E8D2540D627E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567354, "uuid": "9c2ffe0f-415e-4fd8-bdb0-550caf32a1e1", "value": "3072:DU/iDiDH8031cP8kHMPc9h/JK3zTi7I5:DU/iDiDH80Fcvtgi7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706567354, "uuid": "31c14966-5817-4c59-80a4-ec9498574c1d", "value": 102824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706567354, "uuid": "671e9063-e4f2-422c-9487-25bbd3eca2ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567354, "uuid": "86e9044c-ba61-40ab-a2c1-ca454eea6948", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ad0397-beaf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706537102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537102, "uuid": "7973bfdf-d5a6-4c8c-81f9-3e561a2b1e67", "comment": "Malware payload (Formbook)", "value": "d793c9362f14455064a1a874e9521351", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537102, "uuid": "19a55a49-6780-48e2-b785-707cf7f5ba79", "comment": "Malware payload (Formbook)", "value": "cd1757d02e0105ab6ab8876f32671af2911d34f84fd437a68a3c5c6639e11725", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537102, "uuid": "f3aca457-c857-4a2b-aeef-8953287cb671", "comment": "Malware payload (Formbook)", "value": "7929b8ef5d718fab83733fe3fe2f77d8027f79e8", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537102, "uuid": "330b0bbe-abe3-48e5-b2b0-bedf0b9ec8d8", "comment": "Malware payload (Formbook)", "value": "b806c86915fc125048736a05439b462f84d13c16df80bdba9a33a56ee44ac046e52122ddf393203181a76b8aef085bb0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537102, "uuid": "5167514f-476d-4ca0-a5c7-3609de1d0aa8", "value": "T11FF4221733A89723E8BA8BFC116462904BF8753676D2E38D4FD070D92D617E08B197A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537102, "uuid": "96704235-2317-4cd8-bfd5-f60fbf13eebf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537102, "uuid": "db5833e4-2e00-4137-96b8-9a4aeb8cbd57", "value": "12288:va1zIoIFFHgeg/clNPnEr8jmaMIIvUvjKhXXkVOiVVRhziyfAaegtgNO9dMQ:aIXFxLvEAdM9vLun7zhAae6SRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537102, "uuid": "bcd64d7f-def6-4af1-a85e-3a740d902fcf", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537102, "uuid": "2d48e1c3-c08b-412c-9b1c-de1500dc26bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537102, "uuid": "a8393738-4df0-42f5-8813-3538f359c442", "value": "DHL-CI- Shipping Document -DOCX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61724b1e-beae-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706536666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536666, "uuid": "378f5d08-94e0-4e79-b639-3bb34c03798d", "comment": "Malware payload", "value": "75a67824a0cf78502131c3f49e1220d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536666, "uuid": "9c4a8dd1-50ca-4a61-bb34-e571b52518c6", "comment": "Malware payload", "value": "cd396d7645b566460ce1984d1588120e04f0480747eb8c9e3e4941f9d793f33d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536666, "uuid": "f094739c-b950-41c7-a203-dacba93e7c13", "comment": "Malware payload", "value": "05b418414025733906a5ee1d363d2428fde1b4c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536666, "uuid": "d046584e-ce69-426c-aacc-a98e424fef8c", "comment": "Malware payload", "value": "858299cbe6369e279ede4be1c245fcf5bc19f4d688609dda2e690afb063efd3a2d7cf44c5139a5a70b7716354cff73f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536666, "uuid": "9b4398da-c9a4-4218-a960-c70a2ca20969", "value": "T1E9A68D56E2F900E8D57AD1B8CA5B5527F7B23845173497DB12A08A292F37FE06E3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536666, "uuid": "6d384a53-aa97-444c-b51a-350a4b663fdb", "value": "7af8905ab7039f33ca630f366d91a67d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536666, "uuid": "7a185262-932c-42dd-8a26-88962331fcea", "value": "98304:fm+AGgXb4UXTyXRybIKzCUD52VpPd11VGG5/wobJ:fmXXTYoIKX52VJjGEwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536666, "uuid": "d694ca95-a4a5-4354-8a17-9a1891ac5cc4", "value": 9563648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536666, "uuid": "848ad573-b6b7-4006-b63f-987c97f75d17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536666, "uuid": "de065a18-a72e-4e51-a204-161535327849", "value": "PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da97b074-be6b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706508093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508093, "uuid": "7e329373-038d-4b74-b11c-cafbe330bc2f", "comment": "Malware payload (Mirai)", "value": "f8c1a08f6fcf91afc160774a07df470f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508093, "uuid": "8d217a52-27bd-4878-948f-44c7087ea3ca", "comment": "Malware payload (Mirai)", "value": "cedea57f6a6b6eaca4c7cf9b477964987ebf9286f526a8bbbc947e99b7e110ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508093, "uuid": "a4d26c48-b86e-4122-8808-8dfc6cc504c9", "comment": "Malware payload (Mirai)", "value": "9573a649c26e68bcb29420ec718f35b029bf5b0b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508093, "uuid": "30a1c37e-84bd-46a8-ba30-28ca4431f34f", "comment": "Malware payload (Mirai)", "value": "f3c24a47ea2c3b1c0fcfea36740a8f48024e6778199be225f3bb5ee82ed905a1843d295cf8286117966175eb9e60d617", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508093, "uuid": "ddc03124-4d31-4cc3-92bb-9d5517937ea6", "value": "T141F30A46F8819B12C5D111BAFE1E128E37131B7CE2DE72029D246F747B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508093, "uuid": "68d8ad01-96f4-44ea-9e3f-afbd1426156a", "value": "3072:o3wz+tJg3WwUuBET0XDe0qw/abT+DEY1/gqCPl05Nxwr:ogzl7lq0XS0qyaPY53ul05NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706508093, "uuid": "0d889603-ee02-48b6-a3d4-abbfc5e88162", "value": 157756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706508093, "uuid": "bfd82f81-2c8d-46e6-8b74-11cb08416255", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508093, "uuid": "b7498b84-dceb-4ccf-ab2f-0488fddd8138", "value": "huhu.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bad7d7-be4d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706494930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494930, "uuid": "4ecb4968-26ab-4013-b2f3-f2db6d681413", "comment": "Malware payload", "value": "52f46ced3b06b19eac3369fbdb4ee2ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494930, "uuid": "51d87121-9b9c-4a65-91e3-5779c4a6503a", "comment": "Malware payload", "value": "d0685e397486bd9f54eda33133e87e3970dedf5038ef0e4d058de34d796d72ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494930, "uuid": "3958e6ce-558f-4f72-abd5-23f96870397a", "comment": "Malware payload", "value": "1bc549fa770b1bf3925248a3853a87af9948381f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494930, "uuid": "69e49c45-763b-49ed-8b76-412edc866cec", "comment": "Malware payload", "value": "803c5c1a18d2ba5eab051653b406c821cda25118d985fc02124f35269280551cbeb882eaa7402e6aa0d2e0b53333157b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494930, "uuid": "64bc94e7-8c48-471c-acd4-0c408c2b60e8", "value": "T1D2B405D5E6EC30F4D36681388876C52FE6727C5D032186AB23E46E1B3F266E05DFA611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494930, "uuid": "f04fddc6-37b3-4438-bdd3-9577e04fe4bd", "value": "8a30acffa5d4e68c6f30f1c14d9a5f09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494930, "uuid": "dae2a8aa-c7bd-4316-9efa-8157c1de0f26", "value": "6144:9nsLTb6hU1R1IDT3nn/b10WyIZUdA8CQ3mAg0y0Noh+p9NWRzbX:6TbgrDT3n/b6qiA8CQqvYogp/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706494930, "uuid": "5ebcb8c2-2d9d-42e2-93b6-1bf4496f4ca7", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706494930, "uuid": "aa74f76c-d2a9-41d3-8d16-a63b2c7a56d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494930, "uuid": "b4fe9a8d-11ae-42bc-8d2e-c3f9bb84cad8", "value": "SecuriteInfo.com.PUA.GameTool.2765.9606", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d306ae-beab-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706535598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535598, "uuid": "c634e862-a668-438b-969a-ee608aac8193", "comment": "Malware payload", "value": "fe3cd6350dc75080d7ef1b2746ea187c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535598, "uuid": "df63158e-b485-4f40-ae92-00894086bce4", "comment": "Malware payload", "value": "d17502e10cb658f6f56e564f48140d748280841183ace189ba3363241b7bf40d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535598, "uuid": "d1160ab1-8151-4394-9e2b-1a374c9ef7ff", "comment": "Malware payload", "value": "df0a6408584af515992300090c94d67e2574afb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535598, "uuid": "a513cdbd-da33-4774-a50c-ddcdfa98f841", "comment": "Malware payload", "value": "deca0ef362bad3a327613962d3d07dd25ae5cd1b59398d68b918d04a6f6abd9389315d355fa482e40ebfacbe8dfe479f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535598, "uuid": "8f3eb378-f1b1-4436-a968-b34fb733adb0", "value": "T17EA538626385F03BD1721A375C27E640783EBF517E11E84B2AB43E4D0E396426CFAA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535598, "uuid": "76a6e673-5a7e-4d76-aba5-3c12994dd33d", "value": "e59f9520de6858703bcf0e54681650bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535598, "uuid": "91ec35c9-1656-47a2-bee8-234d7ca1e6f5", "value": "49152:eO+TpLR2vSu+ZcGo8rJBbaM+a4dwXTxTpr+l5+:YTVpcGo8r7H8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706535598, "uuid": "aaaca933-17bc-441d-b613-d10365b79bca", "value": 2247168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706535598, "uuid": "93a73ba5-ed97-4ccd-a70d-f0807a84c102", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535598, "uuid": "f70ec0d1-d73c-4b83-9144-e084462c9828", "value": "SecuriteInfo.com.Variant.Jaik.179214.24630.4406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b65876-beb5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706539817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539817, "uuid": "7d9a9d10-102d-4d93-b94c-8d047760762c", "comment": "Malware payload (DCRat)", "value": "93bfc04ba439d2be09bf86f8e99c74bb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539817, "uuid": "f2306ca3-3fc6-41c1-b45a-7264a4f32112", "comment": "Malware payload (DCRat)", "value": "d2a2ae30988da5b110e5d4b42870a73e89a3a50fef8841413a92461ab6bcd11e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539817, "uuid": "43451831-2dcc-4ca6-9f4a-8ef01724ba2f", "comment": "Malware payload (DCRat)", "value": "86ba33219d1195ba61c09c6bec286007fb594e95", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706539817, "uuid": "d78d8ad4-fcaa-4160-8a7f-c280c0fc2aad", "comment": "Malware payload (DCRat)", "value": "c0f10b875a08fe120fabbd02410ae5825d5d780f5372a5d0c8f2888a639711c12fc883e65905e5d0c9ea53aa1813ba3a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539817, "uuid": "b822de7f-ee60-492e-9cd3-9066eea1bf28", "value": "T1AEA5BE01BE44CE11F0191633C2EF4A1487B4AC506BA6E72B7EBA376E55123977D0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539817, "uuid": "061e54ce-2513-4610-8b16-e90b533597c0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539817, "uuid": "6f7193eb-2c55-4806-b8a2-b68e042f5ac6", "value": "49152:UbA30PbM8lxkaG5dNowMOootby+Kq0tLFG:UbrRxFGnNowMOooBy+atLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706539817, "uuid": "61085ca5-5d2c-4f95-9733-0939a022d5bc", "value": 2197598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706539817, "uuid": "c9bda7c6-d568-4e53-8c7f-8e5d7f1c8df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706539817, "uuid": "05546729-866a-4732-b6c0-c6dd831f50f3", "value": "93BFC04BA439D2BE09BF86F8E99C74BB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a0d124-be93-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706525269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525269, "uuid": "87a47d1c-72e2-451b-acba-ca5ce54eb38c", "comment": "Malware payload (AgentTesla)", "value": "84a3c4f22249f767729d1a1ac60d5ec2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525269, "uuid": "6bb72488-d355-4ca2-a107-c82b5c4c7be3", "comment": "Malware payload (AgentTesla)", "value": "d4ce99bddbf7352ad97482052b01754e5aca502213aaa3c06242982fd5a42c34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525269, "uuid": "a8aee04a-d018-4d13-bc18-828f83e048e9", "comment": "Malware payload (AgentTesla)", "value": "8857eb9a9fff7788b022ed9f7daa092c2a198b5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525269, "uuid": "84c7b839-7292-43b7-8d33-eb0d63455db0", "comment": "Malware payload (AgentTesla)", "value": "a9bb8698bf987d731eadafe46a75c5cf06b6b94f69ef8656590abfdc991cf04a408b820f66897fad42b899b93b7af5c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525269, "uuid": "f221b8e5-6b8a-49aa-92ad-2300ed36ebaa", "value": "T10D74120AB499E15EC46F5A7C0DFB52CE0296FC125F88630F38A4BB0D01797D7851A7AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525269, "uuid": "0dffd4b8-ce2a-492a-a4a0-2ab22bc8ad79", "value": "6144:m5funCBC6QREchwS+wcMtNpW6OXhsYOeChb3BfhDy0BFWQB:m56CBC6uEkrPcMtPW6a7O/htfFy0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706525269, "uuid": "821fca4f-97ba-40a0-a20e-13d88a790559", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706525269, "uuid": "1380af20-0da7-4033-afd1-43f33b559f29", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525269, "uuid": "41f934b8-d319-48c3-9e9c-b80a06d8da09", "value": "Remittance Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0815b4-be54-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706497952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497952, "uuid": "6b975db4-c599-49f3-89b6-7f45fed46377", "comment": "Malware payload (Mirai)", "value": "a7b244122adbd09a2381cc8ef80b346e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497952, "uuid": "8fe1dc3b-501c-4d8c-9e15-aab830640015", "comment": "Malware payload (Mirai)", "value": "d5259266c33b3d897a7d5e7702d99e207c1f8d6d3cbed402e08f51779e1eef28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497952, "uuid": "2aa43c66-ccf9-48b0-b4de-003ff56b810c", "comment": "Malware payload (Mirai)", "value": "ff08b4d129b3323c9f2211ca9f5ae0e34a43c0ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706497952, "uuid": "5ea347fa-59e6-495e-8c33-fd8c9628be85", "comment": "Malware payload (Mirai)", "value": "674f65b9745c42e692abb101b80fa70f1afdb3b9ad48e0ecd4aeec884c125bffdf060e2916fb9c79d42f321a109a2bf4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497952, "uuid": "2a0287e6-5548-43e7-bc34-8be7c9829109", "value": "T1BCD2D0AEE4B441C9FD4D5C3E808C3BA11E19E681231BDB9277228C4D5B36C57F26A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497952, "uuid": "57fd98b1-7c4b-4a61-9c90-e6ba353c7fed", "value": "384:n8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orj4bRWGVCz0NvO:8MYHb62x4ahQ3CfdwLjhWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706497952, "uuid": "acbbf87c-ec82-4adb-a3c9-2feb8a55e74f", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706497952, "uuid": "f7faf915-cb0f-47c0-a5c1-05b419866401", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706497952, "uuid": "adb55b94-23fd-4995-a856-a703afebd66b", "value": "a7b244122adbd09a2381cc8ef80b346e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e74605-beb1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kaiji)", "timestamp": 1706537900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537900, "uuid": "bf6c0772-8235-4844-bd3a-e8fc1d6766f5", "comment": "Malware payload (Kaiji)", "value": "6fb4b937e6068507abdf90c6a9f3c1d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537900, "uuid": "27916bb5-4544-4ee6-8171-363ae54fce42", "comment": "Malware payload (Kaiji)", "value": "d6c38313163ffd61acbfa0acfd8d79d945542cdd8e934da7275709213cc6ea87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537900, "uuid": "d9be65a5-99c8-4c32-b9c3-8b6fcfb6b1af", "comment": "Malware payload (Kaiji)", "value": "6c9199dea8dca0238ddb7d9bcd8cf09a27b2e671", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537900, "uuid": "f630c7c3-b679-42c4-9c9b-7d7e83272e06", "comment": "Malware payload (Kaiji)", "value": "9a307750d3439acdf05ddfc684d515bf6e33c5a1efa96ec17f6a870c52b8c505780d2482c64f60d9d92e2e7ca2159ad8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537900, "uuid": "caf871e3-512e-4d54-b041-329418ea5f1e", "value": "T1AD364A99FC1DB862EAC87AB46F350194B739FC499F4183277518BBAD6AF13148F21360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537900, "uuid": "4b1ce5f8-4a60-48e6-ba24-ba6a7939259e", "value": "49152:+w6IWGDZYMvrffr3WFNJNq06gPRxr5EUAIYFD5YEEeKeI1:d6IWGDjvrffr3Wh6gr9Ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537900, "uuid": "d384a1bd-4def-4150-ae82-fda6a9d6e99e", "value": 5046272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537900, "uuid": "39b382e0-ee51-4575-995c-ca311a3abeb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537900, "uuid": "a1d8f48a-59b6-490c-b2a8-71b92fba890b", "value": "6fb4b937e6068507abdf90c6a9f3c1d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dff6fce-be90-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1706523883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706523883, "uuid": "b62a3273-688d-46b6-a08c-49db19c8c91b", "comment": "Malware payload (AsyncRAT)", "value": "08f9037d06344f674d7421474b93c961", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706523883, "uuid": "518a7b21-6ab5-4fd3-b52d-425daa22304b", "comment": "Malware payload (AsyncRAT)", "value": "d7c10d32cb504d7d434ebb1afcc819c6cc572f810e4bfda19bfecb40e59a7f8c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706523883, "uuid": "31318366-6b2e-4ac9-8c41-93c9e3be2493", "comment": "Malware payload (AsyncRAT)", "value": "094ce673ebfa8d021bdf42631af0e4e96bb3f5b4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706523883, "uuid": "0fcc62a1-e4f0-42db-aa5f-52fe864e81f2", "comment": "Malware payload (AsyncRAT)", "value": "3a788882663ffbd7f6f0acc925618f75321e020900a072df5c957bbb06466d666fb010229e79770f452c5dbc10609a15", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706523883, "uuid": "716906c0-e31c-4164-ba22-c720d23a5295", "value": "T1A714015A7A880B10CCB439F798F94C3943D2B8F3D722DAAB5B1047C5CBF65E14A34689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706523883, "uuid": "9812b142-cd8c-414f-909d-3530e6e6575d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706523883, "uuid": "5a9e0d0c-c66a-4e34-b3d1-b91c7eb7f47b", "value": "6144:16OuMP2+2qXyMkyzzJQW4UvCs2z3LGO1s:16ObP2+2tgzzJQWLCjzbGOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706523883, "uuid": "6f620e51-9c48-4dad-aebd-de0ce75c12ef", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706523883, "uuid": "6b7e8430-edf8-442f-a0c4-6adbde72ecab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706523883, "uuid": "bae94b30-6eef-4bf3-8c32-e8742ff2c405", "value": "SecuriteInfo.com.Win32.TrojanX-gen.27270.19098", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff6fd29-be94-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706525470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525470, "uuid": "0254c778-de5d-4760-a830-80586adf667e", "comment": "Malware payload", "value": "bcc1eef680ac0afd71677e298fdeca2e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525470, "uuid": "82a07c80-b265-4b9c-a008-f1ad7f1e08df", "comment": "Malware payload", "value": "d837757c6eed6fbc25f49e4fbfdae9d6527aca800ee6b0c01471bdcb943a6e1f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525470, "uuid": "73abfba6-2f74-4aab-a9c4-de79b1a1b0a8", "comment": "Malware payload", "value": "db9034b2fe94cb9ae16de40fe0e9ced91fe76a26", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525470, "uuid": "0dafc368-b964-41c6-83ed-b2dd982f9df4", "comment": "Malware payload", "value": "bd643fd9d0d05bf4698eff0d2a44a4a19226ae1d33339259dd1dd220a618e77a7736949279b722990f45062b0c1e42fb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525470, "uuid": "1158762a-c2b2-4402-9a34-82ed5e66e3b1", "value": "T18666193521E3EF4A354618ADA7A8C4C11D7E6C61A1F58B438ED23629EBC8560D3FDE34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525470, "uuid": "4e01febb-11e5-42e4-81e4-6d65c2eb1522", "value": "24576:scNo4Bgfu/G4kidBxefr2cv1rmFXI+Ri43di7ApbK6kGUKJ+iLtPSk0zny/xa7ZG:HG45js1AdD6KJOj8A9Po9ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706525470, "uuid": "10b63692-9c88-4f18-b6b1-78c9ac642f7f", "value": 6726006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706525470, "uuid": "a9198bee-ee09-41e7-85c6-1c68989de8be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525470, "uuid": "befa82c2-985e-4ba2-abc8-c825cb6ba20d", "value": "18812569614168.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c3c2e0-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706520245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520245, "uuid": "d1c3bd0a-477a-488e-b6d4-85312414ef80", "comment": "Malware payload (RemcosRAT)", "value": "03a990a0725a83c497acb19e16eaa005", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520245, "uuid": "2b80c140-bd56-4d62-8d5e-4e5112389ee6", "comment": "Malware payload (RemcosRAT)", "value": "d91ca08771428f595ebf33a992eb67424dbead04f10cce8c3c51e283524278d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520245, "uuid": "46a5847d-c489-4cf5-8146-4e4c5503f55c", "comment": "Malware payload (RemcosRAT)", "value": "1ba58054f4de8b8a8c6a39d2385c8404854ed54c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520245, "uuid": "a45ab1a2-6ec4-41e3-a3b5-defe10138f87", "comment": "Malware payload (RemcosRAT)", "value": "db15873871276338f1b97a83a4049ceab7b449a7b74de61630881e09a89532fe726f47d1c6b9754930b87ae1fa3ad987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520245, "uuid": "05dbbbfe-21af-4f0b-801e-739ecda18e17", "value": "T1F6B49E01BAD1C072D57514300D3AF776EAB8BD2028364A7BB3D61D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520245, "uuid": "57f465de-f0b1-47ae-938d-a767b3aad432", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520245, "uuid": "f457af6c-48bb-4b09-87e6-7f4daea4fd19", "value": "6144:cXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNs5Gv:cX7tPMK8ctGe4Dzl4h2QnuPs/ZsJcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520245, "uuid": "a3d7aeb6-f96e-4cef-a371-63bfcb02531a", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520245, "uuid": "3fb1b12f-d0e4-4353-9974-58caaad633ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520245, "uuid": "8cc1f374-8a8e-4a95-bc5d-8232b2455ae6", "value": "d91ca08771428f595ebf33a992eb67424dbead04f10cce8c3c51e283524278d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb40f00c-be98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1706527394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527394, "uuid": "d5173dd2-5c93-413f-bbc3-b2d562865937", "comment": "Malware payload (DarkTortilla)", "value": "dc581a5fc627f79c69474baf63b1202d", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527394, "uuid": "83b0bfb8-9870-4c37-84d3-0359ba798f8d", "comment": "Malware payload (DarkTortilla)", "value": "d932e7fd4c14fc039e3ab72a35e738065d1261315545ff33fbbbf75fe5cf05fe", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527394, "uuid": "98ef728c-83fd-4983-959d-e96952dec9dc", "comment": "Malware payload (DarkTortilla)", "value": "ea79b6ebb4e5b32f6e4dd72e0dd6d1311d79c188", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527394, "uuid": "62be1743-4ece-4b3d-a89c-a48011177915", "comment": "Malware payload (DarkTortilla)", "value": "7990ee7fd77769e56b8c707a94941c5440c2e67148bf4704af1feaf50cefb092eefc443b8247cc0e69babb35cd8812f8", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527394, "uuid": "f1e1492d-7d88-494f-81b7-cef86617c7a6", "value": "T1E0B5D0E2F3A0DC96D86B09F1BD27653015F2AD9C54B4C20D19E9766A26F3342249FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527394, "uuid": "aa99da17-37ec-411a-abd0-70187671a25b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527394, "uuid": "fda72b5f-2ed1-4119-81db-de0d1c90cff8", "value": "49152:ji9C/bc/tENtpdl3aZhN/7MiEbN9c45BkI8ldCoih:u9C/bc/iNJl3yhJ7Mx/n5BkLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706527394, "uuid": "ecbf4483-906e-48b4-91e1-b7401dbbb95c", "value": 2414080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706527394, "uuid": "e12816d1-cd52-4652-8836-19a3ae522297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527394, "uuid": "6c611944-7036-4b7c-9228-3ec6962047a0", "value": "\u00d6deme Onay\u0131 Kopyas.....exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5847039-bedc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Fabookie)", "timestamp": 1706556644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556644, "uuid": "5555e93d-52f5-421e-8f0b-eaa37eb53820", "comment": "Malware payload (Fabookie)", "value": "d7c215d443e28dc0fe78c36909d1356a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556644, "uuid": "d71fe227-4064-4763-adee-4eed4a9f6bee", "comment": "Malware payload (Fabookie)", "value": "d9cba8aea678e19b497b36f3d5f9869dbd042e45759039444581a5234c59ee7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556644, "uuid": "7939159d-7fdd-4044-9f5b-595bace9efd4", "comment": "Malware payload (Fabookie)", "value": "eceedf94f82d252f20ad8eb3dd64fcb9a6c09495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556644, "uuid": "40921c93-0d9f-4ddf-abad-d07c07efa345", "comment": "Malware payload (Fabookie)", "value": "7df090fa114404e51e1dfc0a4b4fd2a9616f2166630c3e3d431c6605795fe086cad2872abb1ca2fcf50a2d9f0462f6ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556644, "uuid": "3d6b5bac-fdc5-4ead-afb3-b41da238b7df", "value": "T158F41B56FBBD4272E051C135C9A6E7B5E6B27C855D30970B2345EB2E2F335118E3AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556644, "uuid": "82bee57a-c195-459a-90df-39c807aab69f", "value": "f2fcd0efb031ebebeaa83cd4cd21090b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556644, "uuid": "4d668de1-a1c4-414b-9e98-d2741232bbec", "value": "6144:nA01NdBRvxQWQSYYaE57iibdoaxQ7cUBmCUiJbc77ZvfuYuEdGxTC2MWf7xLUnwa:nd/5QWJGibiFShtdGxTC285JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706556644, "uuid": "d83bcf3b-31f2-49da-bee1-30319f3a4daf", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706556644, "uuid": "16e4b7f1-69f1-46ad-8a97-01c6172bdc58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556644, "uuid": "05c02b67-4eb2-47fc-8911-9887204e5080", "value": "SecuriteInfo.com.Trojan.DownLoader45.60881.19407.13659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7c33e7-beea-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1706562317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706562317, "uuid": "4770e8c6-d392-404b-969c-c0766b1696e8", "comment": "Malware payload (njrat)", "value": "122dc4a6c772fa667ba75b0ce2495180", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706562317, "uuid": "80910c30-b141-4d53-8f0c-bda948573251", "comment": "Malware payload (njrat)", "value": "d9e5184b95239d667a50459794ec0068f7c80e120668c6bedd5ce433ee5703e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706562317, "uuid": "73bf2cde-ea26-4d91-8d61-35f643f98baa", "comment": "Malware payload (njrat)", "value": "65fc43b6e6e056da8ad52da66f77c051cb74981e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706562317, "uuid": "ab81f6c8-3f55-4566-8580-5ba8c0309dae", "comment": "Malware payload (njrat)", "value": "2bb21a3d6374dc60175a536938a8cdafa9bb42ee45c48e84feede45d0aba9cec013c50fb876ae855c6bb12baad717ba0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706562317, "uuid": "5be9aa69-e985-4f89-a1fa-814146f676bc", "value": "T17906330B83DA9066E431477609F704C52579BE6237B4E5EF9AA7D5AB0D727C02332B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706562317, "uuid": "ff905e3c-38d9-49f8-a6c8-10a10f0d5af5", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706562317, "uuid": "53b2e0d7-b045-4ef6-b702-3e58eb9a233f", "value": "98304:xvO9SmRGjQrP5IB/8Aqj8ZN4v5kJguFR1DA:c9LRGjQ7i/iKev2Jg80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706562317, "uuid": "f29c32a0-4d6d-48ef-b405-ebc80bbe7945", "value": 3833856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706562317, "uuid": "734c5bbd-ba2e-4dd5-bd63-1732a870e162", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706562317, "uuid": "3c03975f-93bc-4e86-8a50-a0e43e0834ac", "value": "122dc4a6c772fa667ba75b0ce2495180.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73fe1f6-beab-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706535521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535521, "uuid": "e21e7938-30e0-46e0-8e9c-37ad80d2dc5d", "comment": "Malware payload (Formbook)", "value": "52063152571bc86e8ec9c87ddc81dc98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535521, "uuid": "307dacd3-c2ef-45d6-ac0e-0d159a82f11a", "comment": "Malware payload (Formbook)", "value": "da539b625ca9e065c0cfe7b482eece781e32b1b69659b7d3a1d835729c903eb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535521, "uuid": "9de91f79-911c-4dac-94a6-8fc94c8c5b94", "comment": "Malware payload (Formbook)", "value": "d1bb332f95a37b61d33b803862d18e67878c0848", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706535521, "uuid": "f7ab79c2-bd15-46f9-9b8b-b52b2244d6f2", "comment": "Malware payload (Formbook)", "value": "78663b7283d7473390b7e5137c7d462a3088918313d7a57ed4472d64fdd778fadfcc4fa1dc7b185fe98c61745fcd1397", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535521, "uuid": "2e1fbecf-c350-49d0-a4ef-cdd75203e60d", "value": "T12FF4125636B8AB12D8BAD7F86070626517F878237451F7AC4FC071ED1A32BA58B10CE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535521, "uuid": "e8ba08ad-3033-4ee7-8071-df4746fd7554", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535521, "uuid": "a87fc4f6-7db7-4a8d-b6ec-68c161d3f2df", "value": "12288:aa1OIoIFFHgeg/c7uHOsb2UDDTx0wfusQmTjQ1CDM8fM6Ac:cIXFxmvBvTKwNQmqCDpfMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706535521, "uuid": "d93b8a56-4af1-4c91-94ec-98a09bf8b2aa", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706535521, "uuid": "6b67a0c3-1b52-4f45-9c6e-95b0e7cd14c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706535521, "uuid": "f5161f66-c91b-4c00-96b8-852f2dc748c5", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdcd41c2-befa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706569463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569463, "uuid": "8ff6c2f3-3683-4e50-b43f-dd85260e52bf", "comment": "Malware payload (Mirai)", "value": "a2f3cf7f529ae33fbbbb75d79d5d91c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569463, "uuid": "41bd3fcc-b125-48c8-8ad3-388cc811885a", "comment": "Malware payload (Mirai)", "value": "da97cf34ed4862a9ad43cebe7a6304bf6bc4dcc03be13801170d0c5bb9f13f9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569463, "uuid": "b687a3b7-414b-415a-bc7c-1889bac1621c", "comment": "Malware payload (Mirai)", "value": "b6c724fb27ccb4d0c9e815a9cff9b0a7e729bbcb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569463, "uuid": "cc4a6697-5cf6-457f-8296-a7e3ff5bc9e0", "comment": "Malware payload (Mirai)", "value": "cdef75fe5e5f2d247f21cdbba724cf7b547dc75258aa0f06a8bbd35e4bd5a674f3f5c25b38dd4585021045a69cd486b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569463, "uuid": "e8c9f111-ff71-4746-8a77-c202425e84f0", "value": "T1B0C2E06952288072B1B45436FDBF41036776CEF8CAEF362A22144735E087D2696B5A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569463, "uuid": "7b3eae3b-4bf5-4e91-81d7-822658cd41d8", "value": "384:KBH2HEdV7UQDoYQHXxcjllK5+AWaFmK0MF9lz7X6AGexXVzonBY6plNKrhymdGU0:byNUQUfhQllxlaH0MFjlOnGsys3Uozn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706569463, "uuid": "77b4cffc-a444-4ef9-99f7-0035bcd0c273", "value": 27344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706569463, "uuid": "2bd8ee75-23c4-4a09-a71e-a3d9132c52a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569463, "uuid": "4e3be12b-ea4e-459e-8c25-198a6fbc9368", "value": "a2f3cf7f529ae33fbbbb75d79d5d91c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb83ce21-be87-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706520147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520147, "uuid": "2882e069-ed4f-44d7-901b-8edf7a7cc455", "comment": "Malware payload", "value": "4d0f5f7943aac3e76b313d726aa78ddc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520147, "uuid": "95b1c12d-9edf-4404-8b09-f2e7911f5c8d", "comment": "Malware payload", "value": "daf897dad3bb0e9996341d5d556662254c035a6141e8de65ed60c52bf0d60d84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520147, "uuid": "c14f7a2b-9aaa-4992-8379-dd0ad2966fdb", "comment": "Malware payload", "value": "7f7b237e2ad1a0bc15a28c1b0d7cd240426a23f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520147, "uuid": "b4c47104-03eb-4e2c-98b5-179314d1f0f1", "comment": "Malware payload", "value": "2b8516ce7c57c22a7f96be70d01435b27ef423deaa353b1d77ba8b0f01571c7d45e67821aad2d457fae384a858fa63a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520147, "uuid": "474f9a27-26fb-429b-bd04-95f2e535dbff", "value": "T19BE6333B487D969BF82D39735A031ADC3B9CE2ECF9A880D470CEDC41B3505954B96EA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520147, "uuid": "9a09e966-a73c-4083-ad9b-154d4d07e185", "value": "e0793d7ac5e2e0a88f80b8afcc84f3b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520147, "uuid": "5c0ddc61-5f28-4f42-91d3-1f7334399c64", "value": "393216:oVP3yKpIFQjO5zaM0WBnbR+QCVQdQP/aI0LbtsvmtuvzP:oZdO8M0Wh9+QCSdQPyIGbtsetub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520147, "uuid": "01ef8975-707b-4557-9e5f-19429d9ca9bd", "value": 15106576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520147, "uuid": "8d6eac7d-0c47-4c71-8485-5a45759e83b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520147, "uuid": "255f70f6-92b9-4971-bb8c-62ac43f0596b", "value": "SecuriteInfo.com.Win64.TrojanX-gen.17119.20886", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91387bf-beb9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706541537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706541537, "uuid": "979b27b0-d692-4c85-8b05-b25f01364436", "comment": "Malware payload", "value": "fb2677951d2c5f5541ba5a3a094e437b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706541537, "uuid": "2c1c6bb0-17b7-4229-aa5e-8e6aff76628c", "comment": "Malware payload", "value": "db14a7741f65bdd249b2fa61cd69bc958682ec9652542d879422ee0af7723833", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706541537, "uuid": "5698ee42-143c-43b5-8b47-cb7634765499", "comment": "Malware payload", "value": "ae7be5dc1fbd09755d28aa198adb4e1b093fce92", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706541537, "uuid": "88ebf262-5ae4-40f9-a915-965ff5e575cd", "comment": "Malware payload", "value": "943b2ba0e2d87aa426004b5f680cf32855be9abefc7a0cab0422404d6d26db3212cb8f7beabb496b242c5af20fbd1ec5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706541537, "uuid": "cbe6263a-48fe-4ebf-9aa8-030e0c119e58", "value": "T15C971283E71C4D1AD67A13F1891E0A2927251D19F6826EC7B4383B6876F73D60E0AFC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706541537, "uuid": "1bb79413-39d9-4ff9-b2e6-ce16afe2a831", "value": "786432:rDwws60WbNHY6EKKF4/yj2gdmNcEivYnEyxGRCntb97O5RW1C/7uHQbr:rDwb60WbN46BEegU6vY/Gm97OAKRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706541537, "uuid": "a5e0ed6f-43af-4c05-ac11-2124cc14ba88", "value": 42794832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706541537, "uuid": "f54b94e1-d8f3-4ad1-90c8-d989b3b9a530", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706541537, "uuid": "27bf2219-a578-4070-b30f-c25f36636687", "value": "TVELA_mobile_4.1.1_20230922.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901db1f8-bee7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706561225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706561225, "uuid": "dcbcf377-79df-41ab-8daf-1e0b78d5e257", "comment": "Malware payload", "value": "11a03edd815fdfde672df5e0c9db1ecd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706561225, "uuid": "d2d3160c-68fd-4818-8e9f-43a6f263d713", "comment": "Malware payload", "value": "dc0ddb5f676959234ec39c703187a741af91d8e6e17d084dfa256f3770336366", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706561225, "uuid": "ffa96cd1-eee6-4087-85c2-e6ec25fb1db5", "comment": "Malware payload", "value": "3612f55ae04e0f937d797f9c818a507e5b46011d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706561225, "uuid": "cf2ebe8e-6a76-4f6a-b2f0-e84535e4c51f", "comment": "Malware payload", "value": "6659971758abdfd40fd142d7cb11175ec803271fa84a7737b8d9c4aa0e95ca7c2edfda2544fa65befacbe8e4b9ae817a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706561225, "uuid": "2f97173f-81ef-4979-93c4-b77ea09c96a8", "value": "T1C2E4236916C1DD8BFC59477226B3EAB6C973C8A52227F3A753D11E1B3F14AC74C18182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706561225, "uuid": "0183a572-2acc-4dd4-b8b5-c7f3721923c5", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706561225, "uuid": "5c279bf8-7cf9-4771-a366-b6c2ccfc66c8", "value": "12288:pIgDiFFpPrscKgZIZeCUjHavW34Zli3ArUw+NSMVTVCYo6XrZMHT:pI6QpPrNqcCU+5gEuvTV5rZmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706561225, "uuid": "5b8fc238-6fec-4744-900f-d59da322c052", "value": 665024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706561225, "uuid": "43a04edc-b529-4c7f-8b13-e112862121ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706561225, "uuid": "bbf893d5-6dc5-4668-a555-b4207b70044c", "value": "SecuriteInfo.com.Trojan.DownLoader44.64905.4004.14264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa796017-bef9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706569135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569135, "uuid": "e3d74051-c5c1-4221-ac5c-12dbc3598f98", "comment": "Malware payload (Mirai)", "value": "ffbfef5414bdf42a9f6a3809eb8ee7e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569135, "uuid": "a8a91b60-7e2f-44ee-aec7-a35c3f8c5ce6", "comment": "Malware payload (Mirai)", "value": "dc505fb4a6e00547edef35b62537cc5df5372887b3defd65d0a9d68154ede70b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569135, "uuid": "c2fb01af-f92a-4c9a-8cec-71c27b079857", "comment": "Malware payload (Mirai)", "value": "eb93b9322db0a98cd643ddebe7f42e747c65ea41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706569135, "uuid": "0b2ef781-61d9-46b4-90fe-cdc5ed3a12a3", "comment": "Malware payload (Mirai)", "value": "6e9bc2354a971246e7541444d0153f8cd8257db2cfed4fa4214723c4d2dce91f567642ce2a439539c5924d30a4061774", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569135, "uuid": "8f2f141a-5030-4d9e-8ca0-11d8cb9e7004", "value": "T100C35B73DC766F98C655D0B0B0B08F796F53A98182472FBA25B6C2B49043D8DF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569135, "uuid": "08988131-f4a6-4ab4-8c71-80c609bb88c0", "value": "1536:Oa82094A4H+33jTohbCmK299saOUz2gSHdW2OZ37Y64H6i:Ok0uu3abk2Y0z2jdWHZ37oH6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706569135, "uuid": "2771bcaf-6edc-49c8-94c5-efe20df0f480", "value": 121632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706569135, "uuid": "a86eb07d-f6d5-456f-bcbc-ada2a3d88da3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706569135, "uuid": "f5de9136-dd83-4048-92bd-e0a828aae2c3", "value": "ffbfef5414bdf42a9f6a3809eb8ee7e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc77ab1f-be96-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kaiji)", "timestamp": 1706526537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526537, "uuid": "37ff04de-299a-4484-a1d4-2d8685d0da55", "comment": "Malware payload (Kaiji)", "value": "f775ee721e1617d1341feaae86008919", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526537, "uuid": "5f02d3fb-c98a-44d7-9449-909a3d69daba", "comment": "Malware payload (Kaiji)", "value": "dc6ae33315259d4dff4fbd651406c25614e1ca4977925a0ffd78ed8a9d77f3a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526537, "uuid": "8ef40257-3cef-4017-b355-f0535e4b1142", "comment": "Malware payload (Kaiji)", "value": "c7c87fed4f5bbd3f4f7081327ceb0490d22cf5c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706526537, "uuid": "e160c68e-1567-4af9-8e7b-428178b24503", "comment": "Malware payload (Kaiji)", "value": "e34b5e24bbae5055f59800d30a7104b72c379fb2a38afa1cf0781a95640b8505c1d341bd6a3daba2670cd1cc9ae84a56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706526537, "uuid": "705f86ed-d762-4a90-91b3-0b28aa9c60fa", "value": "T1C3363C4BB8924682C4E4367ABC7D81D473B34EB99B9713666D04FE3C3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706526537, "uuid": "690d733a-2b28-4fcc-8af2-b9a70755a126", "value": "24576:44v9ubX4NnJ+VWbqyUcN1Ib4zJqDu3WZZ+5YAKQqN02EXS3vUM6j0AJfuD/s3TWd:+VmmsDjfd5uBbTpHqGfwmFp8qOTVI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706526537, "uuid": "699255ea-804d-4b5f-aafe-8dd1acbc10d6", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706526537, "uuid": "f5e7b30c-d30a-4943-8829-a15916088a62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706526537, "uuid": "bc0630ea-bcb3-4e17-be44-e12903a381e2", "value": "f775ee721e1617d1341feaae86008919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf1f836-befd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706570721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706570721, "uuid": "823370b4-66ef-44c8-8791-2fd15c53f138", "comment": "Malware payload", "value": "c88d011278288ef1c603349c2c21404a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706570721, "uuid": "5e3e8536-9f69-421c-b6d0-daa6dbd308c1", "comment": "Malware payload", "value": "dd2cac57fc59222ad0e4ee696c606e8ab0f9d876fed4a15ad778d7ac12471420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706570721, "uuid": "4f21ef1d-ada8-436b-b889-9f4597a86fb9", "comment": "Malware payload", "value": "797a27d834252f23bdc7370e38bf96f5ac5a41d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706570721, "uuid": "a3a5beb4-bff0-40f2-a0b2-116449420b70", "comment": "Malware payload", "value": "43c78e3ecf2f9e6ea884a7780a947302cdb2fb69d08495d08812fb0aa8af66501e2939f9db418d9ec10661edced0447c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706570721, "uuid": "f6dad36b-3d0f-4a0b-b71e-7bdad25bfed9", "value": "T1FAA533324545165AC818173248F789A8DCB8A1CBB9F30F4D879C7E4E893777AECDD42A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706570721, "uuid": "8fed2440-3eeb-4a1f-995b-23248183a9f4", "value": "565a4583d65d19084c11772396603ddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706570721, "uuid": "b2305aa6-d90e-436a-98de-55ecdaa9c6ef", "value": "49152:NID/Y7hDmv+p1FIU+mmL37X4dKkvs4b/JSWC8eZawefCfps:6/chvFIUgL374d+4b/J5C8eZRXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706570721, "uuid": "082e4b0d-de97-43c1-a4a6-b2a9369950f9", "value": 2159520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706570721, "uuid": "7666af90-67cb-4a10-9741-a3847c478cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706570721, "uuid": "8a269ded-6795-4c90-a7f4-5e791b386f3b", "value": "SecuriteInfo.com.BScope.Trojan.Ditertag.21566.14014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef28d0a2-bed2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706552365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552365, "uuid": "f41e355d-e8ef-49c4-b658-53a69abddba3", "comment": "Malware payload", "value": "1b2472cb08015baccb376d4f222df582", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552365, "uuid": "3ba2d473-8ce6-4be2-bc3d-b7f738c76311", "comment": "Malware payload", "value": "dd3b172d9b97c81877d0753eae4939a2d585b1bb63cac05a017ec419b62bddba", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552365, "uuid": "50a87bbe-7f8e-4c91-989b-90765a7c7a38", "comment": "Malware payload", "value": "598b18b84af1aecdfc9b93b7861049064e546f26", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552365, "uuid": "b82c8b4f-c723-4ff5-9e1d-0a1440771c13", "comment": "Malware payload", "value": "2008f7fd3f2c01c2bf7de57c3f8bd87bddcec845bb9e3cad81a62453bb56f9a5e7e87061d90a9d993cb6c58fa767eba3", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552365, "uuid": "bad5bfc3-c7c3-4dc9-a280-2a5b44ede038", "value": "T19D920C2035FFE00872B37F712FE975E54A9BB7B2257AA0AE1044061B4B63A45CD95B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552365, "uuid": "443ad80f-6380-4469-94fe-64ca6dfd9d49", "value": "384:qYhnhDTj4JJ/XC8QPQyCQrQTQHQAQrQHQ1T8KQHQIT8EaQHQbQHQkQHQoQHQYQNB:ufXCiwNwcQNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706552365, "uuid": "bd025408-f7d4-4e26-beac-7e616c98fe8a", "value": 21146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706552365, "uuid": "45319290-3d32-4bde-9641-1c50e71a4b12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552365, "uuid": "1d4a5a91-6a13-4799-ba5c-9785eab4a59d", "value": "BARCLAYS BANK SWIFT TRANSFER (008) CMSWT24019000690 docx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1f555d-be8a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706521415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706521415, "uuid": "a0880a06-c656-4113-b048-50f7698d658e", "comment": "Malware payload", "value": "76ed908e14fced8512c3979445f83d82", "object_relation": "md5", "Tag": [ { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706521415, "uuid": "365d6564-47aa-4496-bbca-4111f7f6b327", "comment": "Malware payload", "value": "ddb4e7bd2fe1117d13547d715edc5578f01741d16c4bcd8a2ecb6d5836f4b94a", "object_relation": "sha256", "Tag": [ { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706521415, "uuid": "dde07d5f-a7dd-4dbf-90c3-6d97270a036f", "comment": "Malware payload", "value": "1f04df524703f5a034993e9dd5bd07b6a0899f8a", "object_relation": "sha1", "Tag": [ { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706521415, "uuid": "7a7bc799-6fa9-42e3-bf68-1886e23fede2", "comment": "Malware payload", "value": "b6f6a54497aeace70de6fe7d03d34606ffd62306e02fa8415bea7086bb50f739d6966c1cf491722a539d98d92f19f94f", "object_relation": "sha3-384", "Tag": [ { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706521415, "uuid": "1ae42afc-a802-4def-82eb-10ca456f13d3", "value": "T14525AFCB702D54D58C00AAC6AE7889C3EB25057BC6754880367BAA496E374FCC72FE75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706521415, "uuid": "0b717b46-8b02-428c-af08-3697341c2569", "value": "12288:jrMfTmC0fo+/VNihkHs+JuxlS+A/qwA29O896N+A:P0mHomiWHsv3K/qwWk6NV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706521415, "uuid": "22f3dbc7-911b-407c-bfb6-9c7c2e61c08e", "value": 1017996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706521415, "uuid": "4ea6b106-ccc2-48a1-b7cc-597c6ffa47b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706521415, "uuid": "064783f3-8ab3-43c2-9b6d-b20b6537afac", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc55e90f-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706536443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536443, "uuid": "47cc3845-a184-435a-b6e2-d6841ca2a797", "comment": "Malware payload (Formbook)", "value": "0230103d88fc4446732570869056cb82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536443, "uuid": "fd631a86-e99d-4a0e-85c2-27f81c9d3788", "comment": "Malware payload (Formbook)", "value": "de8869cf9b1e4881596e9b4a9cb6351228260dc42ebf0a91ec471f4e26b0d2ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536443, "uuid": "b3670724-f862-4383-b663-7e9d4e398b1d", "comment": "Malware payload (Formbook)", "value": "4ac4e34c9a80d5ca6e65c0a711e1b9f00dbb2d13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536443, "uuid": "739439cb-853e-4cd8-a6bd-e33474956fd9", "comment": "Malware payload (Formbook)", "value": "29259a2afe8dc574195c90657922636e629e442715bd004b1e77fb5a33abe888d26da86f2b8fb64d168bdad76383f297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536443, "uuid": "7e89763f-39a7-4c04-a5c3-beed1dd75c52", "value": "T1BC658CD9B3E05CE9D94E91B2B8261A2110B2FD4D5197D31F39AD7A793BB331010CEE1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536443, "uuid": "d9de370f-fa12-42d2-bef4-3aaac91bc3ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536443, "uuid": "71224b5b-c5de-4cc4-96af-1201ea919909", "value": "12288:awx4PnhWEl8Iq+alkg0KvPOoBH82T9A7nnH/X/Yzdc/Z77yRdkBBB:ZCoEJq+a50EPOoBjMfv5/ZCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536443, "uuid": "7586f83a-579a-4c20-a04f-3fe44f0ace90", "value": 1457664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536443, "uuid": "ba942fb4-7b3c-4a27-9abe-e976e27bb294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536443, "uuid": "ccf94b65-0c50-4f9b-9046-f7303fc1af2b", "value": "PO SUNS788.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697a6ab5-be57-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1706499313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706499313, "uuid": "5119d9ea-f534-404d-ad57-91d63b6edd67", "comment": "Malware payload (AveMariaRAT)", "value": "e9c78cc0569b16b1e332cd86285620a2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706499313, "uuid": "8f1f630f-bd85-4cbb-bd4d-0d3575698caa", "comment": "Malware payload (AveMariaRAT)", "value": "decfb2acfa48419eb5c32541e8b99aa142ed856a2969012374c2a30f8bd7db70", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706499313, "uuid": "cd965d41-5c76-4f33-b651-6f820983cc81", "comment": "Malware payload (AveMariaRAT)", "value": "f7c0db3e8139345ab87fb624a1a86274b7bcbc9e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706499313, "uuid": "b538c2d1-71dc-4c14-83c6-1dc99b63535b", "comment": "Malware payload (AveMariaRAT)", "value": "0277ef7bd544c28686d9d31072783a28ce01718e5a08eb604d83ab3df33dc38e3b0c534f5b747176885b3613b4a83db9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706499313, "uuid": "fc45f926-417c-4fed-8790-3425c6f05767", "value": "T160D4120622BC6B23C4BE97FD60A051014BFDF1167293EB680EE175EE19737D08A25AD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706499313, "uuid": "f661096a-7396-4629-a882-02efea70ba91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706499313, "uuid": "5a378393-41cf-42fd-a399-b2027ef1700b", "value": "12288:7a1rIoIFFHgeg/cNyyffsZAulwt34bmctED1BrCtWZQVRA4Uo9nuLwW:CIXFxN8eUsobtEZFZyVRA4b1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706499313, "uuid": "01ed9e55-d4a9-446a-a811-3308ba3d5c05", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706499313, "uuid": "b891b36c-ee3b-4ace-a13f-397a2486873a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706499313, "uuid": "8ff045a9-372c-44b0-98ad-e10fe8ef35b8", "value": "P.O 4700009314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d56546-beee-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706564408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706564408, "uuid": "2d54c19f-da17-4eaf-81fd-283705d20b9b", "comment": "Malware payload", "value": "b48e7188a1b7afde2ef2532006bc0559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706564408, "uuid": "e6428281-57a3-4009-9622-90448a547ae0", "comment": "Malware payload", "value": "df3e46522407218b8fffd030417c3fdc8db57d441d1711f44cbd1356d8c3921b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706564408, "uuid": "ba28c378-3057-49b1-a30a-37e03e8d4a78", "comment": "Malware payload", "value": "01d71feb6ff38a29a5ad378f2b0058517007729c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706564408, "uuid": "007d2a56-43a5-47fd-8118-ce6f5fcb78bb", "comment": "Malware payload", "value": "3160c86486757246b892fb05de70263ebb9eb97161afefb0f9a92cf57c7f7d9ff21f2f0d1b28b8279dadc737a4b3f2aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706564408, "uuid": "73896aa0-3bf7-4767-9a6a-0a667466c459", "value": "T17F173381D3C459F3D7D3D132862A4617F732F9506370D5AA23B8B1A51AAF146CE3EE28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706564408, "uuid": "aeb68188-110e-43bb-bb17-64c9eded6b7a", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706564408, "uuid": "61154ec8-0c33-4b01-b170-ecd7d76ab7a0", "value": "393216:o/OL3/dyD2nTBfFZNRwSo67W+eGQRZMTozGxu8C0ibfz6e57Z1bbKXiWCUI:H8DaTBfFXR667W+e5RsoztZ026e57HF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706564408, "uuid": "31eab01a-e39e-4e9a-a3dc-e88a968bd680", "value": 18799401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706564408, "uuid": "417119ed-d445-434a-9c17-d233774d5608", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706564408, "uuid": "e4a73f61-ce49-4230-b65c-1c159f73acf4", "value": "Zsolt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9cf060f-be7d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706515796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706515796, "uuid": "8068a419-91c4-49a1-879b-96091f4b273d", "comment": "Malware payload", "value": "30d76a3ed9a0b8a11762c491b171ac2d", "object_relation": "md5", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706515796, "uuid": "07440362-730a-400f-8351-3e341e6d60e6", "comment": "Malware payload", "value": "dff6ea4c43b4f1cc13068b204a9795304cd3db3bd7f35d8be26b6f149d744744", "object_relation": "sha256", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706515796, "uuid": "0faf6e18-d692-42d8-bb03-7596ff981bd6", "comment": "Malware payload", "value": "ac8f3e59c182616f51689f92998be097fbebace3", "object_relation": "sha1", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706515796, "uuid": "04442416-71e8-46de-8ada-e3a6653ccde9", "comment": "Malware payload", "value": "27d6d59a421014a7b4bfff8bbb85174ba222132c0be8cf235a298eb78f8e0c36e03393a0214ab804a384cf3d4a7b5e00", "object_relation": "sha3-384", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706515796, "uuid": "2338d196-7e8b-4b88-ac05-169dbd6b804a", "value": "T18E016BA653690D7F84B36685CC34AD4C84BACC730E5F90ADE9233584C9291E11FD0758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706515796, "uuid": "b2b33b1a-ad58-4d0c-ae0b-a1d262f8c768", "value": "12:+VZPRVZPAVZPeaXuUdpaR6AicadEuGNSVZPsVIz87KZIxGITASLVZPsVIEVZPsV7:+XJX4X9VpaRdadENSX940uGITfLXBEXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706515796, "uuid": "e5a3d355-558a-4da9-b3ae-cd0d2c97fa07", "value": 756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706515796, "uuid": "f306a72e-b2b2-4af2-8eb3-cf53ba5f15e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706515796, "uuid": "42c4d05a-c2bc-4d0f-a3f5-af1955479ba2", "value": "ULYKDMFH.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d10db1-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1706536245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536245, "uuid": "3a07baef-4d4f-466c-96cf-0d619b89729c", "comment": "Malware payload (SnakeKeylogger)", "value": "a16eada76f5aa6c06c01395bd6772d17", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536245, "uuid": "3899efb8-77b5-485f-9cbf-c923ada23937", "comment": "Malware payload (SnakeKeylogger)", "value": "e0bab39f15dae51e6ee793aec74d0076eb33339776c037e4ad963efc40c49820", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536245, "uuid": "2ce6952b-a984-4037-8f36-6d8cbc595596", "comment": "Malware payload (SnakeKeylogger)", "value": "21119c045fb65080347b005215d6799d739cbb0a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536245, "uuid": "2c5185b1-938e-4288-9973-f8e071854626", "comment": "Malware payload (SnakeKeylogger)", "value": "c91ed955dfa7814c36c3e0ab69ce3e48f99b3115e2b86d00709c30f41ad780515a75cedc079cc346051efcfbb8456286", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536245, "uuid": "5fdf7673-8005-4973-a479-a0784db9b007", "value": "T15BF4ADAD3690B5DFC867CD76C9682C64EA5064B7930BD203A05326AC9E0D6DBCF251F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536245, "uuid": "528a8149-a0ad-4342-b9c4-b739e0731fbc", "value": "12288:ACBWZz+dpaRHTKGZrMq4Er/kNvo1nLIbyx4qJVwpdK7FQiPv42SVmZQLT5gIlODR:1A0QPGEr/EvUqjG7FQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536245, "uuid": "c819f02d-98f7-41f7-8c07-60770b4770ea", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536245, "uuid": "f5d92628-707a-4b0c-ba91-231dd90abe7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536245, "uuid": "9eae7c5c-e7c3-453f-9df1-3b2e22647302", "value": "01 OCAK 2024 HAFTALIK EKONOMI\u0307 BU\u0308LTENI\u0307.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d0c14e-beed-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706563574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706563574, "uuid": "c3db61fe-06c1-4675-97fb-d3c74c734704", "comment": "Malware payload", "value": "587b3a2a943fd5be6f4fe46cbec1bd7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706563574, "uuid": "6b246c5e-03a8-4705-9f42-deb0bc8757f8", "comment": "Malware payload", "value": "e375feaacbfedab9d42574f2ac47160ca4a0cdac2e72d0d4855628d7888f3683", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706563574, "uuid": "f35afbe2-e2ae-4794-a5f4-14adff0c8ffb", "comment": "Malware payload", "value": "a56826086d84a66990098a849ffd75a6b2721cad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706563574, "uuid": "1816bc0d-cbf7-435f-bf6b-bc8e3a53263e", "comment": "Malware payload", "value": "3ebffa99a7fe40a0a162b061c62c97250f17fd66456811285293f6f08b0247be76682d007b57192802545a30f68cd6ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706563574, "uuid": "dc504d4b-2772-440c-b6e3-59e575c84e8f", "value": "T124E44840B6F8C747D37A02B770A2CE0C77B350C6D599EA9D788D73A61AA37006E5216F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706563574, "uuid": "93b7460c-3cb8-47de-85b1-af13d2fe0d74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706563574, "uuid": "32f46fce-73d4-4a44-add2-2643c2a04efc", "value": "12288:3ymCv84LnkguJQnWK45Ehl3qRBKAfdcPvI6J:3Iv84LnkguJQnM5Ehl3qncPhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706563574, "uuid": "0a11360f-2de6-4286-8b20-61601b033942", "value": 713440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706563574, "uuid": "a038ee0b-a3a6-4c31-b492-cf54df09e690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706563574, "uuid": "26b58876-9abe-499f-af86-81036b9f164c", "value": "SecuriteInfo.com.Adware.DownwareNET.2.22106.2082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7d1815-bef3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706566566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706566566, "uuid": "b1f7500d-df90-49f0-af2d-687ad7b4daa0", "comment": "Malware payload", "value": "b69036a695b48549380a64c8df3a00f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706566566, "uuid": "c2db5a79-8198-4683-912c-116b9a7de904", "comment": "Malware payload", "value": "e5c80844063be3cea01fa549f22c23723909ce5e596e2f9001b8c37099657210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706566566, "uuid": "a8ee1b43-c7f2-4a23-8cb6-2d43ebb4d2ac", "comment": "Malware payload", "value": "1f70d2f6e9b3172291fba309d60adea856af6be0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706566566, "uuid": "8c95d42e-b602-48f3-8a67-2582a6187e51", "comment": "Malware payload", "value": "b1f9a1bbba02eb5fb4d4cf9dff939b426ba4852a6595113720d55078775f38dd4ef75731b7b9364892b693f579f457ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706566566, "uuid": "9c1d4497-ce51-435e-a131-580ba7aea9b3", "value": "T1A3C581085B3E0295E5518C7161730663A97DBD1CC01C6AB9CBC09B46BF9FB21E5EB3AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706566566, "uuid": "11727de3-abf3-4090-b6c3-972ee50442a2", "value": "bc693d65c403eb6efe07b6ce35345618", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706566566, "uuid": "a8977e42-0570-4e81-a9d9-653045512cd9", "value": "49152:9xVm0KsjOgkwuEfD9GqLToTy1No2IiXwKYIBEe6k:J1S0TooVXXxqBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706566566, "uuid": "0b6aec46-2191-44a3-91b9-1cb6139cd9ab", "value": 2675712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706566566, "uuid": "c72aa96c-ce46-4b1c-a4be-6ae5bd358415", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706566566, "uuid": "d716156a-0128-4a2d-a1f2-1ea6972c9eda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a6af7c-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706536431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536431, "uuid": "dcc4abf8-569e-40cf-a634-263ca78e67cb", "comment": "Malware payload (Formbook)", "value": "2bc7d1500129d953ac220cc4b602a25d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536431, "uuid": "2638c930-79ca-48c0-8f66-0c463cb93771", "comment": "Malware payload (Formbook)", "value": "e6ea05ea9109885d5fa38b56d80c0748fbaacb2c8d63e32c83763cb7138acc56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536431, "uuid": "57a02dc6-f5f9-4c2b-b274-b042c6307af4", "comment": "Malware payload (Formbook)", "value": "747f488ff518d440511b48dcff90f306d5818657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536431, "uuid": "c80b50fc-b364-49b4-b2dc-955c2bcb7f4a", "comment": "Malware payload (Formbook)", "value": "a1db1850a31862b9b0f0cf9e727c04da07288db9640ad314faba3961515d77a5c34981620de70d8a16dcdb7788f7695a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536431, "uuid": "b23c2ba7-4f40-410f-a479-08f5732bfb71", "value": "T187257ED1F150889AEC6B06F1BD2BA53025E77E9D94A4810C569EBB1736F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536431, "uuid": "ca1d4b74-7d35-444a-ba81-78268a39d55c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536431, "uuid": "ee737f9d-825f-45df-bffe-80bd36207c8b", "value": "12288:D9d2iNjJz/IIHF3fKqHy5/Z4Vds/o25WI8EsKw1AvoFBpS2OB/:Dn1NJz/IIHFv9H24Yo29sqv8pSbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536431, "uuid": "6dd6c5b5-9ad2-4fcb-aca2-534c02d7b495", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536431, "uuid": "729fc8ab-580e-41b3-9287-e3f77a0e205a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536431, "uuid": "75fec5c3-5f3b-4667-b482-6bca6a18b8d5", "value": "Swift Mesaj\u0131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5f7017-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706536204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536204, "uuid": "5bf31c17-b9f8-4b89-92ce-4ca5d5cc652a", "comment": "Malware payload", "value": "023ba51b5e447dd15c898ecd9a7a3de6", "object_relation": "md5", "Tag": [ { "name": "nextyvpn.com", "colour": "#438EEF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536204, "uuid": "781968dd-9c88-48a0-ad93-7ac7f59eaa18", "comment": "Malware payload", "value": "e95fce5ddbf7cb03f4929fc163682f64d2e06c9663abe7e42843e040fa581e3b", "object_relation": "sha256", "Tag": [ { "name": "nextyvpn.com", "colour": "#438EEF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536204, "uuid": "6c424591-ec25-4ac1-aa3f-31596e25c225", "comment": "Malware payload", "value": "0ae804a6e2a5dd7519f6ed0fb1bf3b91bfebbf3f", "object_relation": "sha1", "Tag": [ { "name": "nextyvpn.com", "colour": "#438EEF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536204, "uuid": "ab08fca7-76a0-4180-b636-ab38ca872bae", "comment": "Malware payload", "value": "246e50e30f819b23d0b578f7559f2056d50d22005acbeff756d6ac4158c42d9b4af0959d637cc299cbe9c235dd55435c", "object_relation": "sha3-384", "Tag": [ { "name": "nextyvpn.com", "colour": "#438EEF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536204, "uuid": "e7f6a959-f024-42d8-b8df-ceae56f2087f", "value": "T16DE733D3BEDA8067ED0479FA6B805CA06D0D341086357B63E156385F1833DC6EA6B27B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536204, "uuid": "ac51fad8-e068-429c-b95f-edd5283ae944", "value": "1572864:MrziNx5qwFpB8KBeBDOiR3hpVTBxdfqXFLWxixdM1iei1s9DCa:Hx5qwLADPR7VtxNqXFLWxAM1ir1a2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536204, "uuid": "82452ce1-f6c4-45e8-96de-6238273871d7", "value": 69184962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536204, "uuid": "a93e853f-8561-49bd-8740-44fd57abfd75", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536204, "uuid": "4ba8dde7-282a-4ca2-8cdb-234be2b75191", "value": "NextyVpn.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef04d332-bed1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1706551936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551936, "uuid": "baaac39b-f70e-4fa0-8e8e-860f0ab60bbb", "comment": "Malware payload (Amadey)", "value": "2d420fee40182b4c6360bb05f801f9aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551936, "uuid": "8875a235-5c43-49cc-90dd-73f052ae62c1", "comment": "Malware payload (Amadey)", "value": "ec78f97f5dee77537df9ef30f8d899da9f76ddbbb1aeee9fc7194bd7da631f7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551936, "uuid": "8a575957-c02c-4161-a846-d7f217475d82", "comment": "Malware payload (Amadey)", "value": "9950ac2d5a9c40954c509b079befc3b3c220ec4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706551936, "uuid": "a4db8d87-e4dd-40db-bf64-5cfa86c69f93", "comment": "Malware payload (Amadey)", "value": "1c7edb1c661cb84856af6e43de02ab132271edad248713255e66e45c832dc84413e65b76d5acc9c0b33c97e4f8653a67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551936, "uuid": "e07e6cee-53d8-4eef-aaa3-895dc7d5d0e6", "value": "T176F5D0157609AF51C68B6239C1B39610D2F6BDF20B72FE16ABCC755E8A73142FC1D0A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551936, "uuid": "e46777cb-256d-4d9c-a86c-ae8082210f04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551936, "uuid": "dd65ed17-4d75-4bf1-a419-a548dceca0a0", "value": "98304:A7sk+TiLkcwkARHAaldtaSEPaYUY11e0ABm:A4XRgal2tL11eTBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706551936, "uuid": "ff4b204c-a3c3-4d05-8ce3-19fe7fd0437a", "value": 3466240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706551936, "uuid": "f50a364f-b647-4e5a-aead-9b2b82fe9ab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706551936, "uuid": "7ceaaec1-0ba4-459f-b0a9-07966255f7f6", "value": "2d420fee40182b4c6360bb05f801f9aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4831a3b-beb9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706541583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706541583, "uuid": "a79b4240-6ee3-4a77-9bc2-d2face320f9b", "comment": "Malware payload (Formbook)", "value": "9df143c9f9671c6f88b5d1d2aa0c8232", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706541583, "uuid": "7b8d80b9-d27c-4971-910f-fec33698ef24", "comment": "Malware payload (Formbook)", "value": "eeb9ebbaf564800d692de3de873fafbfb9ed9f47459e83bc4a2ffdc1503a1799", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706541583, "uuid": "bd3d15fc-39a9-4b7f-9ab3-926346e7305a", "comment": "Malware payload (Formbook)", "value": "c01cb1db4983207dc9395b86cf2bcbfba3a4d050", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706541583, "uuid": "ab1b3177-a905-45b5-9f44-91da36535c96", "comment": "Malware payload (Formbook)", "value": "c323055a3346ac323c01a960f1c3165fff362cad57f44e019a7a9223bcd4c1c74eb6125988f5ef4e0afd3ffde343b14c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706541583, "uuid": "78a903dc-51e8-4d87-bedc-cb3a5b4e06a7", "value": "T1EFE4124177ACAB66DD7F87F2242254A09BB63A277A52E34C0E8560DF0E72F054362F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706541583, "uuid": "8f4b001a-74f0-49fe-a4af-21add1546047", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706541583, "uuid": "1fe5dda9-a561-4211-a957-596dd472b8ea", "value": "12288:5uAoIFFHgeg/cKWCT+pIET2znEglXFD7V0YVODak93GlNUD8sNG1qJ:5uAXFxvQxEsnEglXFD7ZVODacqMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706541583, "uuid": "657f0084-16ef-42d2-8304-eba58a374030", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706541583, "uuid": "3ed36f76-b162-4ac5-8703-5f16cd52818c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706541583, "uuid": "f41108fe-b4e2-437f-8591-9ebf1cf68731", "value": "\u043d\u043e\u0432\u0430 \u043f\u043e\u0440\u044a\u0447\u043a\u0430i pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46099be1-be99-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706527600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527600, "uuid": "42ca9fc3-3ce3-42c3-b29e-fcc622ca1fd1", "comment": "Malware payload", "value": "39aeda2794a1c7d20201d26810f101ef", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527600, "uuid": "a160f367-8c77-4264-98b9-6920b58d1562", "comment": "Malware payload", "value": "ef33ce5d95da28f7cd7347975df18673778486721e50c59030f64475ffcd7f75", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527600, "uuid": "b33d3265-506c-4a39-8dc9-e330c9932ad9", "comment": "Malware payload", "value": "c42a26b468224148c29476fdce54fca80c875757", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706527600, "uuid": "b33b99f8-dd20-4fc9-abc9-3e4c225e91d3", "comment": "Malware payload", "value": "276d658328c9d83ad7aca432a9922769135d3680d096263831ccac94126c02671a1696d6b3dea7a703d435b451708e94", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527600, "uuid": "cc6a0279-efd2-4242-b367-4c27344c6a36", "value": "T186115EA953290D7FC4B262B5CC35AD8C88BADC730A4F909DEA633584C5395E11FD4718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527600, "uuid": "7a4bd13c-22c6-4dc6-9f74-d6bfef95ac98", "value": "24:8rBJlzAgrDaARXJX4X9VpaRdadENSX940uGITfLXBEXnax1P:8VJdA4pXJX4XpaRdadzXrgTfLXBEXnaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706527600, "uuid": "8488468d-1b69-41aa-be29-db1393dd46bc", "value": 1068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706527600, "uuid": "895a19cc-c88b-44c4-8f92-813f7fc83266", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706527600, "uuid": "d0c493cc-8bb1-4fd0-ae96-fffba972a173", "value": "RLDTLLRLDTLLRLDTLLRLDTLL.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf7cda2-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706536202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536202, "uuid": "0c9d479e-0c14-44a6-9f9e-483768db4137", "comment": "Malware payload (Formbook)", "value": "2b7b2d985d01b8c4daac655e6ea24772", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536202, "uuid": "9549867a-28e5-4dc8-9a03-e22389906385", "comment": "Malware payload (Formbook)", "value": "f02a705a7807a2273f5ce13acf1d4491ec5d5050394eb3b61c9c274714a01fb8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536202, "uuid": "ebef3b72-5029-400a-9d4c-1fcc5a9229b6", "comment": "Malware payload (Formbook)", "value": "f3905d34c55bbddb5d17b77a85b2f0b5da3d959f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536202, "uuid": "74a7fd03-26cb-4411-9ef5-ed05bbe0b0c3", "comment": "Malware payload (Formbook)", "value": "566dd41f14c360eee7e57574175d2c16dbdf8ff5321ca3b012076f7b5e4d5a0410dc90dc3f3c01acc7e7f83543bb68f1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536202, "uuid": "46686d54-fc2d-4477-ac61-45b9b9af57e3", "value": "T1AFF4131237BC9F12D47ECBF560B052504BF074226622E78C8F9474EE1EA5BC19A51AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536202, "uuid": "07a832df-36d7-44e7-9cf3-6775e2961399", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536202, "uuid": "dc3d6741-1e66-41c0-9dba-73cfea760d1b", "value": "12288:Aa1kIoIFFHgeg/cYE3j3vK/yw6DwEIXVMavWNCBl3U93WYOLJTP2soOa5PvH+:gIXFxYMvuyHDwEIVMavGCBl3BvJT1mn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536202, "uuid": "a9392c2e-39d3-40fa-8f95-4227bd2653fd", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536202, "uuid": "e0fe6637-6c99-41b1-8dc8-30c9be822f03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536202, "uuid": "daded621-7bab-4d96-88c4-a92d449bdf98", "value": "ARRIVAL NOTICE OF CARGO AND ATTACHED INVOICEBILL OF LADING.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74db9bf2-be3e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706488595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706488595, "uuid": "0ddc6fb2-4d5a-4021-8b24-c18d87921079", "comment": "Malware payload (RiseProStealer)", "value": "677e103a4ef31647c070b9a8b84ac26e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706488595, "uuid": "020ddb8d-4467-4b53-8d96-4ce06432f872", "comment": "Malware payload (RiseProStealer)", "value": "f30ab6d6ca6ef00ba665588e4170bc2619a07efbe76de6e17888004aa3e3af44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706488595, "uuid": "da998809-12eb-4b38-9fbe-9d3712adfa65", "comment": "Malware payload (RiseProStealer)", "value": "1dbd8fb5b6d955ccfb23098dd32e13bceb5ad386", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706488595, "uuid": "bed722ab-7d51-4622-a919-4aff7462c55d", "comment": "Malware payload (RiseProStealer)", "value": "2516a507ce611163ad7958615fc4cc08081b6c43f0b036cc4db73c343da9490ef4166ac5254186c6f93733a0a53f8bd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706488595, "uuid": "ff419f44-6e44-40f4-b37c-d4bb0a47bba9", "value": "T17BB533C1CE7B26E3DC1F57FEA92D9A0143532DA31CA45C491E48F0A8CB7C6B6A455F82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706488595, "uuid": "0e2d0a16-ff17-4e8d-b514-0fe6b0401fb5", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706488595, "uuid": "ebf28bb2-a0d0-4dea-abf8-fe83a4e50538", "value": "49152:P+aoejQYfZ3PfOvRZG4+Zu7rTuIDEnikEv5weYetCOwjOoL6b8sdc63j:P+aH3fu7fuID6EvqevtXwaa6rdpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706488595, "uuid": "4bc63f96-dcdd-41d8-8624-22e6bb90d50d", "value": 2319872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706488595, "uuid": "0cb2a4e2-d883-4b1f-b1b9-6fb686a26317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706488595, "uuid": "3cd7716d-b64b-4f0d-8855-a5ac6e3f81c0", "value": "SecuriteInfo.com.Win32.TrojanX-gen.25905.27453", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2843b7-bef5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706567371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567371, "uuid": "c116e312-c0af-48b9-8736-3d362c459b7e", "comment": "Malware payload", "value": "d1db1267fcfb9f7de903ec539e3a101d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567371, "uuid": "ee24ee4d-e9ee-49ff-bc2f-cf3ea9e5ce66", "comment": "Malware payload", "value": "f34fd4a3be52fb55752b81c96f6fad615784b9ad41e324dd6b78acab27b78281", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567371, "uuid": "b64119b4-109d-47d3-b844-1ab3a75787b8", "comment": "Malware payload", "value": "c63c070462ae472292f0a87830316eb79da64fdd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567371, "uuid": "df541c3f-0923-48b8-a1b6-9b7ffb0ee353", "comment": "Malware payload", "value": "d10f13c2b96870f886a021152fd3d44efc1bafbd3d8b8656c313e2ccb8074d4da6579fd7902c8ceab3d15ea374bf9694", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567371, "uuid": "3324e472-f4ac-4c14-aa35-3197a2075a19", "value": "T135F20852FC825627C2E4127A7B6E2B8D377573E8D2CF7223E92007647B8652F4C62E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567371, "uuid": "5f91b7e5-9dd9-4ecf-8761-e36bcae91a13", "value": "768:txDQaNiXSE2F3d8G550KwtJYIyeSiY4UjovRw6t:t27Xd+3WG55cZhY4UF6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706567371, "uuid": "e3dc0765-58e7-42f5-8715-d106b03c2ac5", "value": 36260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706567371, "uuid": "9390aded-af89-469a-932a-0934ca20cdf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567371, "uuid": "37deed98-6a52-42b9-8b0a-fedc2e08f4cc", "value": "most-arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669c76f3-be80-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706516918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516918, "uuid": "f5457ccc-e840-4666-8398-0c7f0d1c6cac", "comment": "Malware payload", "value": "9a976be39af68795a0447bf6e7c9eaa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516918, "uuid": "43ed83bf-e278-48a1-b7d3-d18b5315fc9e", "comment": "Malware payload", "value": "f444e74ba61c8a95e6e241458506300b9533dd85176ebf99de59c90164a441de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516918, "uuid": "98eeaed6-5b2b-4b10-9b71-2b4ac58e78c0", "comment": "Malware payload", "value": "37734057caae8191ff0e3cf81c6b3e3b9640748d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706516918, "uuid": "2a31f9e9-57e5-4998-ba7a-76bfab4053aa", "comment": "Malware payload", "value": "7a5b2483d5e06f3f48bef7626667ace4a69745f2d43773cb5d639318a7949abb75aca7a09da66fa706ab3718c8c7e776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516918, "uuid": "2a193203-8091-4f89-917b-ed753eff1bbc", "value": "T11EB5E057A3B441F9D07BC038C956960BEAB1741913209BEF13E08A662F63BE16F7E351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516918, "uuid": "e2d804b5-9d2c-4074-af28-43b0e78824e5", "value": "d37bd03f74e241e001d20ab228fc1253", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516918, "uuid": "b039b41c-c105-4097-baf4-fe3244fe5d4e", "value": "49152:OPBTI5NZdJClZhZjOnfsmt7Cf+9l9nDmdjt4BbY+ihRe4SqiPQQ1cdRX:OZTIxs47giRmdpk1CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706516918, "uuid": "018ed0e7-657b-408e-887e-979468c8fcb2", "value": 2372459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706516918, "uuid": "ad8b4082-d963-45d4-885b-0dd6442a4127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706516918, "uuid": "caa3596c-103e-4d79-bacc-ba6ea617d105", "value": "SecuriteInfo.com.Win64.MalwareX-gen.13459.17737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d11bdd-be61-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1706503651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706503651, "uuid": "2efac26d-92e5-425e-9d88-12f3755dcbed", "comment": "Malware payload (Socks5Systemz)", "value": "29e3ae47c7df4b865065a3fde56483fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706503651, "uuid": "6bda0b2d-8fa3-4d40-b290-7f1e9596d08c", "comment": "Malware payload (Socks5Systemz)", "value": "f4953dd47a1a35b12a94ce5c4fc5af2da86882070366a1684b8896a16bf636ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706503651, "uuid": "515467b6-e41d-41a8-b702-5cfca37f78f6", "comment": "Malware payload (Socks5Systemz)", "value": "61fefecb5575cde7bbcffad97671f19aa53479e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706503651, "uuid": "1c86e38b-469b-4dac-8ee1-889bc411bc0f", "comment": "Malware payload (Socks5Systemz)", "value": "ce0bbd6d3a9e66b5d1659abfd4336e301aca94896f1994fdb5f42c03d1aa65730778b9575489f81070e1a15ef6f9a0fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706503651, "uuid": "961d7e43-4bd1-4b82-af54-c0e43f5d4751", "value": "T16536332642F274FCE550C5FC55CAA1EC4E273EA72D52A40A30BEAD6F26B7312444F7A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706503651, "uuid": "4932baa2-f7a5-4fa9-888e-e4ee97c76622", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706503651, "uuid": "86861a7a-b557-4bae-81c2-659477da6279", "value": "98304:Z3lXv+AIYyh+rUJ6K4RXf4M73r/BfohM+DmeDMpgTV:b+44+rUJ6K4RgqoXjYpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706503651, "uuid": "71dabd82-be75-44ac-9091-67969dbd1b48", "value": 4928373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706503651, "uuid": "2b773a0f-be63-4f4e-9310-77fbb3d69752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706503651, "uuid": "bb992782-be89-43d2-9e20-1a293e8dad17", "value": "29e3ae47c7df4b865065a3fde56483fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68104a2-bef5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706567357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567357, "uuid": "5fab0122-b3b1-4ba7-8b1d-4e20eb3c07a9", "comment": "Malware payload (Mirai)", "value": "596e4996acd4e8015200b2abd65d3e23", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567357, "uuid": "33cf5cf4-aa5a-412d-9722-53a8f3ff1e46", "comment": "Malware payload (Mirai)", "value": "f5c6338ea760f2f3594a7c5937eb79718639954fb438dd9e4cffddcd8a0eafd7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567357, "uuid": "8be959a1-e9f7-477a-aa32-0ae025f23343", "comment": "Malware payload (Mirai)", "value": "9defc150a286d267057187a933f1448bdc1e54d2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567357, "uuid": "2176f92c-afb5-4020-a6dd-fb9e4a4c7c8d", "comment": "Malware payload (Mirai)", "value": "dab59cb39a1dde8ea50ae7c981adf05dcea6edcf356c61da111b39f33fabdc316f1acf70877599fe255a1d6a75df5d4e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567357, "uuid": "c7b3372d-b390-48b5-8546-fe7865d99c49", "value": "T1F604D716AB610FBBDCAFCD3702E90B0139CC955722A53B363678D528F54B54B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567357, "uuid": "acf34bb2-30d3-40d8-b479-01327f1e6339", "value": "3072:P34y6ZomgQQW9paISVZn9jkr3uJuZ6/mP:P34yIBgwvaISfVkr3uK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706567357, "uuid": "be6b009c-385b-45c5-9f4d-a851e5e89a19", "value": 177948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706567357, "uuid": "859c1245-0c3a-4429-a5ce-1765b96d650f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567357, "uuid": "6a3330bc-a731-45fc-8a05-0fdff0dc5142", "value": "most-mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9952baf-be6e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706509353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509353, "uuid": "15115d4d-b1ee-4dfe-a78f-a1a11149e133", "comment": "Malware payload (Mirai)", "value": "bdd25d3aa2707f8204f79b534171ca66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509353, "uuid": "99244e9e-4077-44d0-828b-e14c64c2e5ae", "comment": "Malware payload (Mirai)", "value": "f62f12176f471538b58ce520ab907aad496f4e9b4085fc835473cd580d97e963", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509353, "uuid": "805c9b00-3e78-44a6-b101-ebc871dd6092", "comment": "Malware payload (Mirai)", "value": "134af799b8ced66eafa551945eb9f04fa45db4f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706509353, "uuid": "095707a8-a38e-4501-90f5-fe656e46e036", "comment": "Malware payload (Mirai)", "value": "d4af8b6ccb4ec19a5e285868423f8ffc29628c4ac443c1eb696475537710a5a7fe94443618480bce5636ea493a52a6e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509353, "uuid": "d416f5a0-7e13-43d4-9c16-0c38a27f5b19", "value": "T1D9D36A73CC266F68C295D1B4B0709F7D2B63A69181475FBE29B6C2B54083C8DF905BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509353, "uuid": "1f581b80-5340-46ec-888e-a3d571357b9d", "value": "1536:taEFjL9GpAccm9vbrNa6Y71EwJCOKtdBVljQLHuImOWZ/TkbVW3OAc:tXJGLj/wJItXwHCOWBTk03xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706509353, "uuid": "5373e66b-67dd-4547-99a8-c7567280eba5", "value": 133952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706509353, "uuid": "794e9730-dcb4-4cc0-bf62-9d196b210604", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706509353, "uuid": "e148ca09-2d32-4f35-9732-a6ef0206aa4c", "value": "bdd25d3aa2707f8204f79b534171ca66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db52e44d-bef5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706567365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567365, "uuid": "d7fdf6f6-ab7e-4d7a-b695-ca19f13bea4b", "comment": "Malware payload", "value": "065e64fa3ed01246eb30b9c3c8963ea8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567365, "uuid": "2053734c-ed91-4d5c-82ea-0506b57916f1", "comment": "Malware payload", "value": "f6301bd1b1603be4b428d9f022498def1554ad5163eabd08827ca3f3ac8950fa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567365, "uuid": "00277041-4e99-490a-bc8f-a5f14ee96501", "comment": "Malware payload", "value": "e418b5b6c239320ab8994cfc0a9b60ba4db43230", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706567365, "uuid": "d2fafefc-fa16-4514-8f4e-46acb3c1b23c", "comment": "Malware payload", "value": "647f99a53c3941676cabadc4c730da6745628e60d0c1b432166901dee8063c2b09afca0768a95410f01da5c5024c3b89", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567365, "uuid": "c49f64a4-ead4-4620-a2d1-ac423036d627", "value": "T132E30A16F8819B12D5C111BAFE1E124E37131BB8E2DE72029D246F747B8B97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567365, "uuid": "9befe8cc-01fb-4b0f-8ae2-86753871beee", "value": "3072:LpUFaxYHUrGF2kXLh8Gao1MT60pppLuCMnEWR6B:LpUFfHInkXtVaoaT67pnEWRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706567365, "uuid": "8efe96c3-efba-4a39-bf6f-15deaa76d3d6", "value": 144604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706567365, "uuid": "58ffba44-4949-4e37-b488-a2eb85626533", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706567365, "uuid": "55e05cee-1a7e-4d68-a3fa-e49ee0daf2e8", "value": "most-arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9aaddc7-befd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706570717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706570717, "uuid": "f848e37f-8cb6-49c2-adf5-c973207f5af6", "comment": "Malware payload", "value": "0088c0508f8aa299bea991f6dd9cc946", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706570717, "uuid": "ef7127df-3ae5-436e-81f7-11397d5884db", "comment": "Malware payload", "value": "f6a6a6302de70532c15f94eaa972167b0a2e1f72a16885d81a35af4d1c6ce705", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706570717, "uuid": "57273d14-947e-4aa8-a783-605c59efe603", "comment": "Malware payload", "value": "56b5495aa6fd1d0543aa6ef47783283e7769bf37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706570717, "uuid": "1bd653f2-3389-4c87-ba46-a33faea898a1", "comment": "Malware payload", "value": "0e551c202381f27d4a6670b0815c5cceb6c59025813b78f4e560c560e8d667a536e1c9c4e4be8d0a34be97776b2fe712", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706570717, "uuid": "d2136cb1-86d0-49d4-b4e0-d6c8cb09abd8", "value": "T18715F110A501943BF8B704B7CEFFD92D5A196660070560DB67C819BEDFAEAE37A30217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706570717, "uuid": "feda08e9-ffff-4d1a-b2af-30395bba396b", "value": "13cabf02ac946361a6c830226d28bc4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706570717, "uuid": "09273f26-8c45-46c3-b8d6-e4a23b466969", "value": "12288:bN2yjPHFnG2o43Grsv0/4kmOxEgk95cLPtm9Of9cHrQP6JRUf13qKO4fBjfv4iJn:bIAH+xI0/vVGtmtgQARO3qnSfVERo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706570717, "uuid": "a4d4aaa1-6286-4014-a2de-9c20d691ac8d", "value": 931172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706570717, "uuid": "0f8c9ef6-f6aa-4964-8dae-2d89a27bec88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706570717, "uuid": "b9beb15e-2f96-4816-84aa-150cf207cbc5", "value": "SecuriteInfo.com.Win32.TrojanX-gen.9705.24847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a0f200-bead-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706536217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536217, "uuid": "1e4dc140-44e7-4e2f-9280-240c66880c91", "comment": "Malware payload (AgentTesla)", "value": "59da3b8a9402b4153daf20cf048ad098", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536217, "uuid": "b09b9433-ee0d-473f-9ada-5dbaaf7637cf", "comment": "Malware payload (AgentTesla)", "value": "f6d215e3634092bf878a66f048b32e03fe932a68a231906b8bbf9b45887bac4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536217, "uuid": "381dbcd4-7b2c-4619-9e3d-1fdc5d4b999d", "comment": "Malware payload (AgentTesla)", "value": "a03bc0441cca120366f0fbfdb47e7676c626f3c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536217, "uuid": "d9bf2282-71b8-4a53-8c73-de8a9a7e7db9", "comment": "Malware payload (AgentTesla)", "value": "ca2952b18465ded3c8df668a7be352f33f1901524740d2e6a798fccbf9466c1f4aa83520674309eb863c9ece9989f432", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536217, "uuid": "26c3f97f-74ab-483d-a743-a38cb6f7ee02", "value": "T129F412063378AB03D8BA5BFDA19061545FF4F02A6291E39C5F9270CA79B5F908F116CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536217, "uuid": "26ca204e-0272-414e-a8f8-5cd5bae5e659", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536217, "uuid": "42c80762-c06a-4a1b-ac73-38919633da6d", "value": "12288:Ma1UIoIFFHgeg/cKN/t90sh7rLWkvprtUNl4eeesAVzh9goyylNLfqQLobPFPmeF:MIXFxa0MfLWkRrOl4eeesAVz7gY9sDFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536217, "uuid": "0e58a6c0-88b5-47d6-a431-c2625b12b801", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536217, "uuid": "c6443db5-71e5-4acc-9f54-bb282389df63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536217, "uuid": "5604a210-ab5f-4d19-8da8-04434d6341e2", "value": "wpEAlPcclKDsTub.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45719cc2-be66-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1706505695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706505695, "uuid": "05289220-65a3-418a-930c-f6827c83d5b6", "comment": "Malware payload (zgRAT)", "value": "4637890c14f37ece8321cf079192acd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706505695, "uuid": "40ca6136-da78-466d-a44b-8b0ab6aa410e", "comment": "Malware payload (zgRAT)", "value": "f762e754543decaa05f5a48eb894db18c2396feac1f983dc732b17e5563cf246", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706505695, "uuid": "44ebac82-fa20-475d-a564-9ef8f819867a", "comment": "Malware payload (zgRAT)", "value": "8ab20768d020d40988fb848eeabb8efb16459330", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706505695, "uuid": "ea253c5e-728d-4060-8ad8-bed2ba081fdb", "comment": "Malware payload (zgRAT)", "value": "56578060121c836ecf9d17ec07a24720c01fe398ea1a5ca023c8fc74c6a7257a8218eeffb613570ae8c338aec419692c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706505695, "uuid": "f710637a-e627-4495-bf46-e6035c1b09db", "value": "T1D79423DC6ECE5937ED2A85BCECD515C888F0F92D246CBA02F66234534D6671084228FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706505695, "uuid": "5cd0680b-f651-40d8-b0f3-26ca57a45463", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706505695, "uuid": "86ba8300-726a-43f3-9abe-6baa0b1893af", "value": "6144:IbUCjzAieqUWBh4HtbcOdSTzUhDUKtNNhmQiBgZCxahmGatV48Mzr0YRDmX7:niDlh4HVcOiUxr3hmhC7h9warjR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706505695, "uuid": "33edb0c3-9794-488a-9ab3-05ef4c646412", "value": 430592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706505695, "uuid": "7ea6567e-fefb-4140-a036-c7961e00fd59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706505695, "uuid": "83351367-53f7-47fa-b09e-543c04b1e607", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e71c130-be94-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706525440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525440, "uuid": "6d2f560f-2679-43ac-8213-70da1777d88e", "comment": "Malware payload", "value": "ed131aca83095e74b6cafd79d68ca5f4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525440, "uuid": "2ad4a436-a8ba-4827-9089-809f3ae8c388", "comment": "Malware payload", "value": "f7faa6f21c839e9dddcc87a897f9906d381a6537459bfee41246fef487aff36a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525440, "uuid": "26eaf9e8-8d60-437a-9c22-252d030534b2", "comment": "Malware payload", "value": "73f02260e73b5f29b66d24810a740880b23f8313", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525440, "uuid": "21b00790-59e9-499f-9715-2d4b361e06a3", "comment": "Malware payload", "value": "83c2c608862259d252a811da8b56fedec67718fddaf9de74391c8358347251b830e7ce3bd15609b85eb9c31c9fe73d8b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525440, "uuid": "902622ae-1fb7-4747-8c3b-3f08d90d8207", "value": "T1A7A2C27ECD421FE7BE573FB4B8407D7C80B9B60242362024AFA5465AB0C359C8E789D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525440, "uuid": "e422a527-15d2-4db3-aa85-e53238f60b33", "value": "384:6XJSAUGlToky2HCB/gKeE+s4tXVLcScFpA2ChZQ3F:6XJgGtonAztlMUT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706525440, "uuid": "95bf5780-936c-4e69-8cd1-00b1836ef3d2", "value": 21525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706525440, "uuid": "8af57ffc-997b-47c0-9c6c-1d3fd431aea8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525440, "uuid": "29654524-4de8-4bed-8e97-503227706690", "value": "Bank_Details_Confirmation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc65eefa-be6b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706508096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508096, "uuid": "e7906589-fe0c-4cab-a7ab-fddd8a1f9e37", "comment": "Malware payload (Mirai)", "value": "bd0288bb7c4b34902c98b5b700ccdca1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508096, "uuid": "60aab6a8-6b4d-423c-a2af-71182c4e9c4e", "comment": "Malware payload (Mirai)", "value": "f8001abcfa86a36ccf6e7d971183513f9226c8b5e19ed35d72242df08b337a91", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508096, "uuid": "5cd12a79-d158-449f-aec8-4bbe88a6d634", "comment": "Malware payload (Mirai)", "value": "5c98873909c1ce2dfddd59ced5b1ce1f4c26e403", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706508096, "uuid": "66d430d0-62fe-47a1-99c8-cce68df79447", "comment": "Malware payload (Mirai)", "value": "9aaa70d60195f0b3337e9926f1e64d9a17d87ee1cd66410978cb583d971594c2f5bc9cfb8e414402514059c47433c01e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508096, "uuid": "30df6580-7058-4327-a005-937d7f62d6a1", "value": "T109E32945FC408B27C6D612BBFB5E428D372A17E8D2EE72039D216F64378A95B0E37542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508096, "uuid": "580b9b45-b8ce-4816-975d-3a667e564232", "value": "3072:S0Wwjt3TFP+qMFage4CSh339IsnEnMNXJNxA:S0dp5KEh4CW339eMNXJNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706508096, "uuid": "983b7b9d-384f-4662-857d-acee71dc5436", "value": 146240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706508096, "uuid": "b7d0e5e0-86aa-4913-92e6-79e8514ca2c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706508096, "uuid": "06a67985-26c9-440c-968d-9ef7f1b49d2d", "value": "huhu.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679f379e-be39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706486425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706486425, "uuid": "8857dc59-bb74-4443-b84d-29b0c52e8703", "comment": "Malware payload (RemcosRAT)", "value": "2b50f7f55c19f08900a54fd2b47b1778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706486425, "uuid": "78bef329-4991-4ffc-8ecf-26e6fbfc251b", "comment": "Malware payload (RemcosRAT)", "value": "f8cbeec0ed28a8828e727c4059fe0d3bf3b34abb3978cdaf112bc36eec83983e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706486425, "uuid": "f0cebebd-8437-4b43-9d7b-95a0f6d69158", "comment": "Malware payload (RemcosRAT)", "value": "f7020425f50c0c8857d57c99260dda7a87ab9cc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706486425, "uuid": "389e4e7e-f512-4b0f-898d-ad64af7fbf55", "comment": "Malware payload (RemcosRAT)", "value": "076f18493bf500221cf7dd4a406ff0496e5f95bef4750ff809845f5bd2d6c22fc34cdab8a460413e4f6317b11d75a29b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706486425, "uuid": "aff35843-6397-4bd2-a231-3984e2618ac8", "value": "T11095F1BAE2045536D0324532C70EF36FA854BD292F3831459AFE2DCCB6B9647F869067", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706486425, "uuid": "42d305d6-cb15-4aec-8981-5c70fd96aa45", "value": "5f7fe181812d5942ca24024d00d9c41d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706486425, "uuid": "9947fcb7-3ff1-4989-9488-cb67af232989", "value": "49152:FIOAjnxf2hp4XLkrhKOekUvUeudcvDaF5P0R:FI92hp4XQrhhekUvfudNuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706486425, "uuid": "b868172c-7b0f-4871-aa4f-f8978b5b22dd", "value": 1879040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706486425, "uuid": "8963b7cc-9510-4cb5-9649-eda14558f315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706486425, "uuid": "768c1fa8-5cba-4a70-b2af-01e14e8ff2ba", "value": "Radico-Asia Star-PO-2024-0102.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58471b03-beaf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706537080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537080, "uuid": "4272aa07-91a3-4906-ae1e-ec198cdbb388", "comment": "Malware payload (AgentTesla)", "value": "5c8ef29599ac61a0f93062ef5cc675ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537080, "uuid": "345705c6-da37-4f26-8f2f-6ec241800905", "comment": "Malware payload (AgentTesla)", "value": "f98337d350bd01bc89ca8e17ab617b797fb90944f8e9e7094dc951e62b47df5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537080, "uuid": "4700c041-3da4-4c54-9b17-da7fd7f3d69f", "comment": "Malware payload (AgentTesla)", "value": "03486309f51dcff54228853776036673a2a71493", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706537080, "uuid": "8bf432bf-90ff-4d3e-9cbc-794d95833e1f", "comment": "Malware payload (AgentTesla)", "value": "1edd32da0c6d6995d2d00f33f2205a59572aa2d7a841ca49308fb1e8221435b81930eddcdbba5a8020384f530b361289", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537080, "uuid": "faf87c5e-b219-4778-809b-48a01c0544be", "value": "T17F836C2DD34B02598F620376AB1B1E5142BDBA7EF39552B1306C437933EAC3DA1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537080, "uuid": "778add72-32d9-4703-bbd1-e2039064d6d1", "value": "768:8wAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjFTtzl3/+xoQH0c+bwIW:8wAlRkwAlRkwAlRqtzl3IoQULXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706537080, "uuid": "71fecd74-a94d-41dc-a43e-9b112dadf222", "value": 88270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706537080, "uuid": "1e7470f9-3131-403e-9ce5-1e87791a21ce", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706537080, "uuid": "0e596b8b-4e45-4ce1-8462-3ce0fb119c79", "value": "PO_AAAQ14576 - 121062603.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26370f70-bed4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1706552887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552887, "uuid": "a0001808-1dfe-4fbf-a99c-17aeae98d68f", "comment": "Malware payload (RustyStealer)", "value": "e1192c6eed02b5dc6235f2b65d847d0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552887, "uuid": "25de783d-2778-447d-af28-3b481d9e370e", "comment": "Malware payload (RustyStealer)", "value": "f9d54c7be59de3d53e53d8dca951e3553913faea4073c28694eba928f68d755d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552887, "uuid": "ee8f0751-47bf-49fc-88c5-05778ff6b319", "comment": "Malware payload (RustyStealer)", "value": "db6211243b85e81f82fa5af7faeae20d92eca405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706552887, "uuid": "91396f2b-0250-47d7-a635-8bdbe227c135", "comment": "Malware payload (RustyStealer)", "value": "711adc2664070f44b9787505811159b93c4b8aa92ee8b91d2d4d553a6e874bf95228de6aeda6f1796d4b866618a853ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552887, "uuid": "f01e9c06-cfc1-4c64-b45b-489d392b87ff", "value": "T17FF63A06F65250E9C06EC174835A6233FA317C4D47387AEB5BD05B222E65F90AF3EB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552887, "uuid": "a050014d-05ea-44c0-85c1-4e57d95961df", "value": "1637e1588e20d2ceb85719a5d1440d0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552887, "uuid": "b1662598-0a78-436d-b448-acf67be1f260", "value": "196608:SI40I9k0s+peTuBKxc9FJa5B5vdXtzIUTyE0+51in:Ssd9cUr4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706552887, "uuid": "967aca83-c4ec-401f-9586-0b7733f27537", "value": 15290880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706552887, "uuid": "1757a975-b6f4-4db7-b04f-700046ed63cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706552887, "uuid": "4cbf445f-5220-415c-890c-0fc5c89a336d", "value": "SecuriteInfo.com.PUA.RiskWare.Crypter.13348.14238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e12223f-beae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706536633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536633, "uuid": "3b9344ba-6ce4-4e6b-bf86-69df70fc390a", "comment": "Malware payload (Formbook)", "value": "92357379ae043eb18398eef86596e769", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536633, "uuid": "bb12dcb5-2e22-4a91-9da4-5fd3c6220ead", "comment": "Malware payload (Formbook)", "value": "fb23ee4f82f854f59fff3169ac33ea885b62d02cc0005df2bf7c260c641336de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536633, "uuid": "f0e970f0-1a68-4871-99bb-662b042ec02b", "comment": "Malware payload (Formbook)", "value": "4bc720e015bcf1260243232cdd5dbf04e70894ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706536633, "uuid": "f820c28a-a8da-419f-b25a-0b4733b1d9f4", "comment": "Malware payload (Formbook)", "value": "211a5e75f6ce0006a24828fc2c4069c3c26a80b32b7c43784cd4fb7c53744ff36861efcd07438e5af38cc661c063e633", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536633, "uuid": "d5b03ead-e439-439d-8359-071bafa9470f", "value": "T135156DD1F1508C9AED6B46F1BD2AA53015E3BE9C54A4810C5A9EBB1776F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536633, "uuid": "52cdde07-a4db-4646-85f8-32c629c401bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536633, "uuid": "39ec4a47-83dc-43bc-bfee-216f8155413a", "value": "12288:OLb2HSg3/gOxOewx0AKgv/8xor/BtJPUHUaW9Feid:43OxO7x0AKgvEqZ7sHUaWre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706536633, "uuid": "3b032c34-bfba-408e-95cc-0d7c5cabc4c4", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706536633, "uuid": "98270521-0aee-48fc-a4ef-c816e601260e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706536633, "uuid": "05c253e1-8a5f-4fa3-b0ea-0f490f6f61de", "value": "PO SAGE560.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d001d7-be94-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706525421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525421, "uuid": "6c32be75-ead2-4fea-83c2-e79f1b6a78ce", "comment": "Malware payload (GuLoader)", "value": "77cfbe9f52ce52e2d7842e84afad1418", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525421, "uuid": "961640f9-98ce-4547-927b-73d0e90b7a04", "comment": "Malware payload (GuLoader)", "value": "fb2e2d0d934f11236c50288d85c2a6856c66cac65ca270873e762f84275d4786", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525421, "uuid": "b7f1bb49-0077-4a21-9f0c-57236752119b", "comment": "Malware payload (GuLoader)", "value": "62e17f3683b85275a9b1cb3f78ebc08bf5393af6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706525421, "uuid": "7e67d5a7-384f-49df-9d11-da9fa994a4d7", "comment": "Malware payload (GuLoader)", "value": "96cbb59c8f4be54ece2c7ec2f9b0815b117b77c6edf5b281559da9018fd0225d76b647d173ef078a1f1dadb83f0fe904", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525421, "uuid": "ae81596a-ceca-4072-bd05-5f6eecd336c9", "value": "T18AA2F5F5B9051FAB9E473B74894369888D2FDE25CB311010E9AF42CD74024D8CF68ABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525421, "uuid": "ce3c16bf-dc82-4a84-805d-ea540c4ed632", "value": "384:CrS5f3SQF9IVydZ/rBN3ByRYKRJVXstB7uPS+by74rZN3re:CrG3SE9IQrmYGjcT3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706525421, "uuid": "f25294a9-fca5-41d4-903a-6c003a3ecbbb", "value": 22360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706525421, "uuid": "7dd58652-920a-43eb-aa03-e6d9dfb14a66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706525421, "uuid": "2abe7b4e-485c-4e1a-bcfd-9b73ae95eb04", "value": "PI00232.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319ed9db-be4d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706494924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494924, "uuid": "c76413dc-ae2f-4acf-a8da-d6851a6d893e", "comment": "Malware payload", "value": "0ad95de215bdee42c18c5833a5fc3dc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494924, "uuid": "9cb3d825-4d9b-4c4d-ac8f-edd6f2bb8990", "comment": "Malware payload", "value": "fc3f95654a181920f05056063bce148fdad38c4b2cd28fa3870bd4e071c564d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494924, "uuid": "82a66b09-e183-4865-b025-cac25a87350c", "comment": "Malware payload", "value": "a22eb68776958b42b5fa147f15141b0f06f1557f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706494924, "uuid": "f7649041-7b45-4f62-b75b-96ae338adcf0", "comment": "Malware payload", "value": "f1099809946c267085d022455ab0490c3cedb75011f3d3e807313ec0d5c8619fcd38ea2918e49ec67a72780300ae8b04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494924, "uuid": "5fca2dca-8460-408f-9255-0fa33b25d98e", "value": "T15BB406D5E6EC30F4D3A681388876C52FE6727C9D0321469B23E46E5B3F322A05DFA651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494924, "uuid": "1baca9eb-7d0c-450c-90a1-ea6c492681f5", "value": "8a30acffa5d4e68c6f30f1c14d9a5f09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494924, "uuid": "763989b5-1565-4557-af2a-17a0eddb1dfb", "value": "6144:YIWaU6EMyPwt1pcLjY0AJyGsrKdR6xmdohketP6ShV:YIWaUMyPu1pwjmIrKdIWoKetzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706494924, "uuid": "b252f3eb-19d1-4dce-beeb-3fd592829efb", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706494924, "uuid": "0e3d5a0a-1566-40d5-90cf-7d38eff58ce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706494924, "uuid": "743ad830-8a89-4e35-912a-0745cf0c1780", "value": "SecuriteInfo.com.W64.ABRisk.LETP-6336.18949.32311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd58f702-bede-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706557463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557463, "uuid": "4cd47ad5-d038-44c5-a527-e9f4d5908fbe", "comment": "Malware payload", "value": "b88352bde539f79207be209759505f02", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557463, "uuid": "da279d2f-8ac5-47d3-b577-573993025343", "comment": "Malware payload", "value": "fc6ab939f5f2d6f12cb1edbe2babd5b180d8d036fc0b37a77f784d1c52162112", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557463, "uuid": "3cdcca71-1f83-452b-93b8-a1720d28af36", "comment": "Malware payload", "value": "8ede7ee0a43c4282b41687408ddc38a243ac4bfd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706557463, "uuid": "5acefc88-c6ef-483e-81a4-1f6d6070abab", "comment": "Malware payload", "value": "d0ae79d01027b31c98abe44662d8a3a3b640d405203563041630cf48f362c05f1cb4905fb3e5d6bd916438bc8060b5bc", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706557463, "uuid": "ece9602b-e755-4598-9343-35bcda5b7af1", "value": "T1D0266B7F12B0A329C53A81BAC5927F04933366FD17A2CDC751CD64A84ADE4CC6A7B2D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706557463, "uuid": "b7936ca0-22da-4a98-a727-187461377ada", "value": "49152:zpUPB9qhCxzT+WKjSX15zLVI4vLeY9xV4qtGvmKBteU5oBgffUBS88qAU8:zpECQ1FLeYLVTV4WMVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706557463, "uuid": "c4cf254b-82bb-4220-9f5a-9be0c46c7960", "value": 4554752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706557463, "uuid": "bf770800-64a3-40db-88ab-76138d7421b8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706557463, "uuid": "0bdf0764-5c18-4053-8e01-0ac847b934f3", "value": "pullofmaster.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608a85fa-bed8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1706554703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706554703, "uuid": "e2ea4e9a-e593-4b11-aab0-a3b1a6b9f862", "comment": "Malware payload (GCleaner)", "value": "e555471283e63ab1bac54281b9b36afc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706554703, "uuid": "d986ccfb-26b2-41ba-8e7a-22a00a156ca5", "comment": "Malware payload (GCleaner)", "value": "fd772b8be4f37e29ebd0aa100406912bff28b54f21aaa4ba6c844fd635281458", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706554703, "uuid": "a8cbf8e9-4dce-46ac-b7c1-053b21384080", "comment": "Malware payload (GCleaner)", "value": "16681f0b7bc43ec21ad16f50b038bd7641d2951b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706554703, "uuid": "25ad6a12-7e99-4b94-9734-da0dea1cecda", "comment": "Malware payload (GCleaner)", "value": "bd7c0ed9e8c24440b50f91ed5ff01efc758b50f6667ae3e6c21dcb7ff08a85f933b0168c16f70a6ba674962b05841f52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706554703, "uuid": "3c1bba68-1ee5-4273-9ce6-2a077a6f9ff6", "value": "T1A2E5D011B9098745C6672379C8A39900C2F4BDF21BB3EE2AAB5D375C4A37386FC4D199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706554703, "uuid": "29a4fda1-f95d-4d68-a19b-f17aede5e953", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706554703, "uuid": "20623923-2c4d-4a1f-85df-0e143de568a0", "value": "49152:6x4UY38MwHPmp3TU/iiPc7gy8JKZHRT7Wh9Szf7ul:6qUPvmpY/7c57WhUjul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706554703, "uuid": "5386095d-4664-4552-ab1d-09808a7741c5", "value": 3039744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706554703, "uuid": "f59e8902-f941-46a4-b070-7acc6374c2c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706554703, "uuid": "7259673b-db88-4e30-98d1-5b60b2ae4317", "value": "e555471283e63ab1bac54281b9b36afc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c4a881-bedc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706556643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556643, "uuid": "9eec620b-7547-4278-bec4-1e1ebc747226", "comment": "Malware payload", "value": "7777a5df89504d6fb3f19dd37163c7b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556643, "uuid": "cb9329ec-6b29-46f8-b235-e764a2bb4195", "comment": "Malware payload", "value": "ff1057c2d45d463b4c95a41500217b9f830095e6a7e7318745d7453b24eac32b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556643, "uuid": "c41eef91-6a90-402a-97bd-a47d86194bb2", "comment": "Malware payload", "value": "faf4d6a8d6ff35ed4150475535bf150244d19e0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706556643, "uuid": "61b4c625-f5ea-4b09-a367-51bbd7dec808", "comment": "Malware payload", "value": "7317044ea8acfcf203309637bc1346003d0e6bc3979060985403e8458dd07c8e816851d697dd6cf06a3473944259bbd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556643, "uuid": "6436172b-0f05-417a-8396-d852dff29337", "value": "T1D6473325E8E8C0CBEDFB54B524B9D23850202DA2F660830BFDE2DD97791918CB95D9C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556643, "uuid": "48fe5478-56ee-4dd4-ac2f-2e0be4030d08", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556643, "uuid": "0034928d-63d6-40e7-9924-d823060db0a3", "value": "786432:OOm1whUTUllOObG0Y074TBh8nKIdvFqa6Wz:bvUTUCObG0YTTBh8n7dvFqZWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706556643, "uuid": "3b522efc-5591-42ca-8029-23808b989a51", "value": 26738384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706556643, "uuid": "633ed82d-cd6d-44bb-b49b-281e1a4103bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706556643, "uuid": "1bc6425a-88ae-40a9-b2d4-d9bd5ba485a7", "value": "SecuriteInfo.com.Trojan.Encoder.17199.16872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b964865-be88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706520255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520255, "uuid": "2f67869d-8ade-448b-adca-3822596f42c1", "comment": "Malware payload (Formbook)", "value": "0668939269ff59be1595b8ebd8c55c66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520255, "uuid": "e856d4d9-88c0-4106-b875-c65f8ef6a626", "comment": "Malware payload (Formbook)", "value": "ff232b508c8bd32a681a0a4737e6028f92538cc923cb67989841644294493b00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520255, "uuid": "e71ba11e-5c90-4af0-b3ca-3d4ecea862fc", "comment": "Malware payload (Formbook)", "value": "e6f43849e606806f5f191daf63aeb224cae911ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706520255, "uuid": "a5cfc12f-5b1f-4fd4-b876-4dbdafe8c5c4", "comment": "Malware payload (Formbook)", "value": "907a6c3fe13b8ff6f14e2709167b7aeddc429633e8d13dc3c1e6b3e263605ca30aac295bf53f62f64a57b65aeefd50c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520255, "uuid": "4f65ba7a-fb3b-4774-9ede-3ed1b0df3a27", "value": "T1DDE412913FE4867AD8AD473A7110C0506F7AB117B2A6F78C8689F1ED0C37F82564A763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520255, "uuid": "19a0e78e-dba1-4980-b2d0-0fcd9d27690b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520255, "uuid": "1942af9c-337c-43d3-92b4-375a9a381902", "value": "12288:sMvhIed3GfU3Y/rYdZYiSYVe5uJapGJm9tEc4r/TVDS8o:sMvhtiJTYAiShugpGInEZID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706520255, "uuid": "67e35ffc-093c-4e5e-ba40-bc72006bbb39", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706520255, "uuid": "a9bf3937-156c-48f1-a8cd-896379ba9ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706520255, "uuid": "3608ebf4-f6d6-4ac5-896b-7f3762d6b266", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }