{ "Event": { "published": true, "date": "2023-09-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-09-10", "timestamp": 1694390582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "5001e35a-52eb-45cb-bc5e-14f2dd0c0f3a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1aa1105-4fbf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694339576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339576, "uuid": "6881ffa4-01ec-423b-bed4-3755857ea432", "comment": "Malware payload", "value": "bef364e6870b16fffa084326861bba5e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "pass - 1593", "colour": "#9954E5", "exportable": true, "hide_tag": false }, { "name": "titanaquaplus-xyz", "colour": "#786C32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339576, "uuid": "30df5277-c02b-4ac7-8d75-d5c8c5b2a4ab", "comment": "Malware payload", "value": "0076a4164263d9915351d194535857d39ae2eefeb6696e21c08a4347b2ad6462", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "pass - 1593", "colour": "#9954E5", "exportable": true, "hide_tag": false }, { "name": "titanaquaplus-xyz", "colour": "#786C32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339576, "uuid": "02bf8ab0-b1ce-4b4c-b0c5-6b577e1cc955", "comment": "Malware payload", "value": "6fa56a40a1f5df81936c26b572d5130b2ace01b6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "pass - 1593", "colour": "#9954E5", "exportable": true, "hide_tag": false }, { "name": "titanaquaplus-xyz", "colour": "#786C32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339576, "uuid": "37d37147-fa6b-4aa8-a87b-21b9f2ec060a", "comment": "Malware payload", "value": "bcbaf7fc673d783da43e6aee111c67c082ef836900deb6910ecea2a5602b87fddb62f779cb6a708617265d6864e05b0c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "pass - 1593", "colour": "#9954E5", "exportable": true, "hide_tag": false }, { "name": "titanaquaplus-xyz", "colour": "#786C32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339576, "uuid": "6d12af92-dfb7-49ed-93bf-f0c2bae456a9", "value": "T14711C818C5B67640C01C80B572CE3A4CD97BAF809C48C861A2741230C22A679FE0EF1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339576, "uuid": "8c1b5519-1896-49be-83c4-08b20cd3c7c7", "value": "24:uF/5GL7oNhswOp0Uf+9cSBFJ157XOhTcE0zZkr:uF/YLsy9p0Uf2j57+hTZ0Or", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694339576, "uuid": "04427060-5bd0-4070-beba-e546fe44cb9d", "value": 993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694339576, "uuid": "0c52c23d-71e6-4110-a2e3-2499214ee3c8", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339576, "uuid": "f90f1a2d-173a-40ad-9258-7305c2922301", "value": "Allergy_List4.xlsx.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc15357e-4fb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694334494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694334494, "uuid": "7b1b3f7b-70bd-45be-8952-f55f142850ae", "comment": "Malware payload", "value": "71c4b69f2bf57f48544302ee764d71bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694334494, "uuid": "e50edeb8-7f1c-4293-a553-dfe9dbdcf866", "comment": "Malware payload", "value": "00e4126a1f8e36f6053b6622acf8c4be55b8b9f458c645d8ed553ff65cc0db04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694334494, "uuid": "53774316-2019-43e9-a8ff-a80f8d53e504", "comment": "Malware payload", "value": "4416306ac444b1f535e8664bc28c847befad2204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694334494, "uuid": "32221792-bfae-4df3-8898-90de7d3773cc", "comment": "Malware payload", "value": "a86524052e30eecd899f0dcc4979476970bc32a3ba4f7f0e4cf022bd22f024cb142fa82ac215cef83aca79b9b8837dd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694334494, "uuid": "ec188cf9-a202-4352-ab6a-43b62de347a7", "value": "T10E27339561150992E4E6643F9C0FC8B61137FC452364DCCE83E49A388F637AA297EFB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694334494, "uuid": "7d2e81f4-2504-4f3d-9787-8dc647a8e1c7", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694334494, "uuid": "d1c74940-2bc7-4250-8f5a-5ab4030ca8a2", "value": "393216:WqPnLFXlrPPeugQpDOETgsvfGA0Kg2YhlvE4AejGdLq:7PLFXNPP+QoEBDhxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694334494, "uuid": "1da3c749-3cd0-40a5-8313-51cbe5e619be", "value": 21426894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694334494, "uuid": "24fd492c-fa8c-4571-a065-15766ac021fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694334494, "uuid": "8b8846cc-81e0-43b7-856c-bd91b12f496c", "value": "SkyblockExtras.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b219ce8-4fa4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694327647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694327647, "uuid": "398fdb97-3b46-40c4-99d0-e95cd77c20a7", "comment": "Malware payload", "value": "1869e4b77ab28dd42dd27c330177770f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694327647, "uuid": "d80b2703-b97d-493a-be42-61234ae1fb95", "comment": "Malware payload", "value": "00fa8ba508b621400a870c2932f6bb17d3b1db49feba4dd0dd90781722b417f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694327647, "uuid": "a6f3f62b-d85c-4169-ad3a-613d46c09402", "comment": "Malware payload", "value": "bf12ea2605cbd225db7091da74d398c8139adb93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694327647, "uuid": "ad3193ba-98bc-41a9-99ea-54e0f6bd03ee", "comment": "Malware payload", "value": "db6c59230558f3871834ee9354418664d565fab89f5ab17f2d14d67c6aa3615f5243e1603f07b355341e8227c0801063", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694327647, "uuid": "074c73ae-938e-4074-86a8-fedacbf64d12", "value": "T1BCD523023CC155B1E1721AB269395F21AB7CFC34AF3689D7D381762D9C331E0A6357AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694327647, "uuid": "11d93001-97c6-4bc1-b57a-39dd58a54e9d", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694327647, "uuid": "5037e895-1326-4867-9fa2-bf80b86e4074", "value": "49152:rLL7OjCJKkYTFFaBvgwEu/DjWkPInPJHt5J4hiLn2Lzn8zCQ+vmfE4Ny9a:rjOxFaMu7jWk8N5J4h7zkD+Xyka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694327647, "uuid": "55867ad3-4a63-473b-8563-9bead655c816", "value": 2757166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694327647, "uuid": "a36e465a-8d52-42cc-98e6-cb7576b1430f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694327647, "uuid": "c71db8ad-f480-4c16-b8a7-f4478b2a9cb4", "value": "SecuriteInfo.com.Win32.InjectorX-gen.8557.10717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce2a2e2-4f8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694317584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694317584, "uuid": "e9b37e83-f6d4-4a4f-8625-2108fc9678b5", "comment": "Malware payload (RedLineStealer)", "value": "69c9841897df2014f80e53069a3b6b20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694317584, "uuid": "7206c233-bcba-46d5-8306-2e9adb4da3aa", "comment": "Malware payload (RedLineStealer)", "value": "01bda45f92bdaf75de7f809024177c873d12b133bb70ee1bec243ab7d3e9e3d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694317584, "uuid": "6a0cac4a-5b23-4628-ba73-03596e873445", "comment": "Malware payload (RedLineStealer)", "value": "69a69b26276fb187bb6dec569e26d0e14ebf199c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694317584, "uuid": "3c735fef-3f14-4ecd-a5ca-2f7ad141f738", "comment": "Malware payload (RedLineStealer)", "value": "850c89715e92d502384c70964935cfe7e1f141b21bd7a9b8c8166ec338b4771a90bd423a4033e584edc1759b27ff3485", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694317584, "uuid": "30c31e70-9285-44a9-8b1f-45af93488cae", "value": "T11C55125030D1C477C5229B3A1CF8DBB25A2F68218EA959EFF7A01A7D8F101D1F6B2476", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694317584, "uuid": "6e9f76ea-6a21-4543-a48e-673973b7fca5", "value": "2627254264278e0e80567712e48122f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694317584, "uuid": "eec9fe82-7817-463c-9c3b-c2118a158d98", "value": "24576:VlqBvbWFIIRiXRIHrfvxa9TMghvOegmLuCzMVxej6+UDH2+ep/J:2BvyFdiabvI94d0l21HMlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694317584, "uuid": "99c8bbae-6cec-48d5-9f14-13214f7b0854", "value": 1393664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694317584, "uuid": "0697eb4f-d572-44f8-8ab6-acf794e72f72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694317584, "uuid": "c02552ed-757c-4706-bf4e-dc8a9d3427ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0906077f-4fc5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694341817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694341817, "uuid": "d23b986a-75fe-49e9-bf4b-2c0e4af8a895", "comment": "Malware payload", "value": "18a078beba442ccaf584c20fc9f1ee10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694341817, "uuid": "3fc89f90-c88e-479f-a4e1-86823359d83e", "comment": "Malware payload", "value": "05d1813419c683a5d27c8d11c8a93313cc4c65353de28d16f171bc4ef8c4bfea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694341817, "uuid": "854d0f85-ab3f-4c2d-b0ff-f422c902c701", "comment": "Malware payload", "value": "d87ba89f5b62577bd67379312609f9eb67c16f68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694341817, "uuid": "365225aa-f8e0-4d18-bd7f-1aa68af1fb1f", "comment": "Malware payload", "value": "183092db0e3cdddfbc9792226da3924e56f36a0ba74b3cd571c965b39297a2117df25fd280b7d0b868a6345348a47fe6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694341817, "uuid": "774e53e3-2636-4cca-9b7e-ea7a9aec4b54", "value": "T1DA82AFA15D3319382EFCCA4A534A280DFF6FB40F80362E97394E9C15DBA66191E9FC14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694341817, "uuid": "db8bcb27-8036-45f6-891f-fc14b0e1f34f", "value": "192:PTFOePZ+x+KQaLmOmFeFWXC6YhJWq9gyLfiy:PxOex+x+KQAhCeFkV4J5yEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694341817, "uuid": "610a48a7-39c3-4f72-a2a4-fd7d1667ada2", "value": 18793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694341817, "uuid": "aa5a289c-32e6-4478-a6ca-cf315cc39e21", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694341817, "uuid": "03c54143-94e2-4722-b40f-4684da22684a", "value": "osquery_dashboard.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e99a0c-500f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694373977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694373977, "uuid": "3fda4b69-e1d2-4417-a609-d850d3375cbd", "comment": "Malware payload (Smoke Loader)", "value": "99118e45bd1439e58f7ae843a602567b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694373977, "uuid": "79e424c8-7927-4e85-b04d-d76216f65c34", "comment": "Malware payload (Smoke Loader)", "value": "063363c1b2f576e7ce22154903cbad7770b8b63ec17b0b9eee051638ce40479b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694373977, "uuid": "ccefd0ab-4bb8-4761-9e7e-0a72d5ca476b", "comment": "Malware payload (Smoke Loader)", "value": "fe21344748118f4d81323e131e9e8a0a8efc0aba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694373977, "uuid": "7b9a1ae0-3a37-4e13-9feb-2e6163644760", "comment": "Malware payload (Smoke Loader)", "value": "3991225bade6015ee3681b0eefa80f711d4d5a45b7a933b3c5ef6726f49d111fd425706ec04bd4cbf2f5c7ab037e2439", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694373977, "uuid": "6c63a7d7-75ea-4a4d-a752-0ce0844a2f72", "value": "T10C249D1B79F1BC22D55787354F2D9AECBB2EB871AE64870B32441E1F09312B1DA97312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694373977, "uuid": "2cd71476-f461-40a1-91a5-05503f4edbe4", "value": "4cf103460b980a8c131a7789354b386b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694373977, "uuid": "c0bc9283-f035-4667-b392-1887b0aa3abb", "value": "3072:GkBlILBlAiKUVrcwwv5GRioJPyVBAUN4L4Oi159jnC0x:bWLB6bUVrcdHoFUe+4L8jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694373977, "uuid": "de8082fc-b9d3-4829-806b-b5a9cedebf87", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694373977, "uuid": "06ea0e34-f565-44a1-bb06-871c7c308455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694373977, "uuid": "68c3fd07-7c22-4ff5-91bb-c47db2be8cbc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cbb15f6-4fa6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694328562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694328562, "uuid": "0f89e009-5a17-41a9-bc29-54f315fd7d4e", "comment": "Malware payload (RemcosRAT)", "value": "b18759785c283d4cd5dd2c54f5b177c7", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694328562, "uuid": "df2cefd9-670b-4246-8428-8dd6da3cd1ea", "comment": "Malware payload (RemcosRAT)", "value": "06b3a2567c8f30af04c48561f48263654175bcb4548fcbb1d1b9707a4969c595", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694328562, "uuid": "fce2aedb-7fee-457a-804c-c0313e3b6f5e", "comment": "Malware payload (RemcosRAT)", "value": "978361bab922d58a72c4906b3e56051ea665616f", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694328562, "uuid": "731c91c2-cc6f-4d2d-b4ea-f7caff91dc02", "comment": "Malware payload (RemcosRAT)", "value": "71697480cb8dec759c4fe070709d21c287ef79ef173df3b0d7d192fb223c84644956c115ebd59a46350b1826bc9282ec", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694328562, "uuid": "1f15a0d2-700c-4c25-9179-13d9871b94c5", "value": "T1DE84234822B09CEE22FA4151D845441AE8E76C36224E69D95478530FA3D83C6FFDF6FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694328562, "uuid": "87a6bc1f-8d0f-4336-a3e6-ac5f8a910fae", "value": "12288:9sPKX/tG+zAEDCadZUa2+QTAPt4l64dhx8:lnznvUbTstkjdhx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694328562, "uuid": "f3199ad4-1f29-48d7-b24f-d8354ef5d355", "value": 396572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694328562, "uuid": "919f5d92-4d52-4e43-8ce9-012b3bd2c623", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694328562, "uuid": "59e19801-eea2-4b0f-9f67-be73f1f0c056", "value": "TT Payment Copy.doc.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa4c257-5000-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694367563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694367563, "uuid": "83ed65ee-c94c-4346-97a6-a9deef637839", "comment": "Malware payload (Formbook)", "value": "cddf991339626b1e33e57cc2f175648e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694367563, "uuid": "a7c13825-ffa3-41c2-95e6-c2ea3b75bd8b", "comment": "Malware payload (Formbook)", "value": "09b328e48038594af6d79eb256d8fd6de1252725026f511bc1d0fcf7440a21fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694367563, "uuid": "df6e3bcb-6c0f-4621-b08e-87893550cfd4", "comment": "Malware payload (Formbook)", "value": "1a27dc245bb7de154facc13b7e2accaf94be40bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694367563, "uuid": "5cfe19d7-916f-4bb1-aa38-e840d07fe830", "comment": "Malware payload (Formbook)", "value": "0369b8d5205902127bcfc8a112a4c4fee92ffe088f5df3a6264e479179255e3a10f1be9a9528d34c2a1cf3c5aefb1765", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694367563, "uuid": "478e9e7a-3dd5-46d1-9bd9-0ee897cb4b01", "value": "T164E4024077D44E37D6BE837855612304DB7115A7867AC508BEDE329BAF3AB200B17E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694367563, "uuid": "b1aabffb-a0b5-4b4f-bd7a-7bc2d5b2e6d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694367563, "uuid": "b02bb50c-cb10-4e25-8574-732a061f4bc1", "value": "12288:fg3/DJGWTLLhAP/6Z1Zkgm4QHqQnHkN5MXgXH+OCqghbQO+/DlmX3ubsQ8HJ/4UU:fg3/DDLWiZ1myQKQM5qoH+OcD+/03Isc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694367563, "uuid": "47cd6773-1183-4a65-acec-c207a8621d4a", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694367563, "uuid": "ca0dec3c-92de-4889-b125-a03b2668f88a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694367563, "uuid": "bb099ba9-f3e5-47af-b78b-6ecc3829c45b", "value": "PI-CA23025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba7739b-4fad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694331916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694331916, "uuid": "23b49da9-67a6-443d-8439-ef10b8a7187d", "comment": "Malware payload (RedLineStealer)", "value": "d8edf9b6d689b164f8e5529a8ccb7945", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694331916, "uuid": "5419ea4a-0d9c-4775-9b49-0e55f83bf18d", "comment": "Malware payload (RedLineStealer)", "value": "0a458d8affc7f401e1c3b2ad52d0eb135dfab6c4a8e79c3d307c4145b184b239", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694331916, "uuid": "0a69f876-76cf-4d2d-9401-850a0fc3cb11", "comment": "Malware payload (RedLineStealer)", "value": "c3b0cc6297d40a47d0e46da8ee05029f2292ee72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694331916, "uuid": "3b56a8c2-235f-44e2-9a8e-1fb44394d6f6", "comment": "Malware payload (RedLineStealer)", "value": "2a8d85377e4b5a0e563a4859da5f1a51d681b931290b8311e3e3c04d3b4cd11ccf6754d34effaf952a4beeab38fafbb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694331916, "uuid": "2398e3ad-233a-4386-b945-6358bef79f75", "value": "T16A551253B5D58033C5A2E03509F593BA67FCB9308FB2499F4B940B7F49B0185FAB0A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694331916, "uuid": "9955d985-4ef3-4df7-bfbb-60137954a16f", "value": "2627254264278e0e80567712e48122f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694331916, "uuid": "c97adb4c-381e-412b-8aa4-0c50fd75a7dc", "value": "24576:cZK5vbWCM1Cy7PpH5U026BxQC8v4ih47PWjyJklcQ1G2f+cMcxvFR2tJaE9HRAdz:Z5vyCz+h264Qi47PgyelcQEtcxFROJar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694331916, "uuid": "6d327307-01ac-4f05-a118-6db73c34e696", "value": 1391104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694331916, "uuid": "02124b65-6f6b-4cd1-beaa-37889ebf99c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694331916, "uuid": "84abf6f3-749d-4b68-8a84-f8e3b9f9a281", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637c156b-4fa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694326507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326507, "uuid": "c13754ac-b22c-4c18-9772-197ab402c2fd", "comment": "Malware payload (AgentTesla)", "value": "6fd17429d6631ec57db2dc3a1f313679", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326507, "uuid": "30a245b6-472c-45dd-a92d-2bcbff0a50a2", "comment": "Malware payload (AgentTesla)", "value": "0cde9fa7468043255e8ab4b30904ff7850e2064ddbe612cce368604828f05a2c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326507, "uuid": "76b7d7d0-3046-4d07-a79d-1205e86dbd31", "comment": "Malware payload (AgentTesla)", "value": "c49623b647fe46182dc219e8bbbe5d93010cefb9", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326507, "uuid": "e66faacf-e0b0-41bd-97f8-34ab3da12c95", "comment": "Malware payload (AgentTesla)", "value": "094fea78e8d8d55226f197d9274bc316e1dc7834f6d511ab1270fcc60b5515cdb9804be42b4ff12fa7cb262d1d5534a0", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694326507, "uuid": "ac5657c1-ef83-4ada-b3f9-d5d6adc2b622", "value": "T1E5C4233E1D8808FF67EAC366D1B9E1BF94401B1D698287CE10C429DE8135E7D3618EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694326507, "uuid": "9b12a4c9-b64d-4880-a3a9-b387a19b1028", "value": "12288:vIIxidRVE3puLJytaQ24FHpdCwVPln3hgH3IdAhLDSi//PDThT:vIIYdRVE5uLxbw6W3hgXIdAhLDSKnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694326507, "uuid": "0a2bc1e6-eac0-4169-ac31-5557e7ce1509", "value": 579252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694326507, "uuid": "af1598ce-a5b8-401f-89f7-235a0fb78693", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694326507, "uuid": "92bdec01-3051-4a4e-b76a-b9e45d62bd88", "value": "Refund Payment 274652.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27afc3c-4fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PovertyStealer)", "timestamp": 1694355469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355469, "uuid": "24b15a8a-0e27-48c2-9ca0-4b31236d7fee", "comment": "Malware payload (PovertyStealer)", "value": "8a372a849320884f016b96a92571b1d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355469, "uuid": "1f518c85-793d-4869-853e-d8cf4da3628f", "comment": "Malware payload (PovertyStealer)", "value": "0d9f87c757c72b861c411ccfbb890c771ed8cddc28e03482eb967662e624511d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355469, "uuid": "d0fb7ff8-05f6-4c87-a4a2-3d7fbc3a9d67", "comment": "Malware payload (PovertyStealer)", "value": "3f9b383fb794721e5b922bcd32f0a90931e0cd76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355469, "uuid": "bdba26f4-a8ed-4d66-8564-1d857f6c943c", "comment": "Malware payload (PovertyStealer)", "value": "76caa9259e10aaf4a2af5cf70b0e4394dfa20dd981f554be8d943b0823ea0e710168bff0d0654d821083f73885183083", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355469, "uuid": "6bd1164d-3cf5-413a-b3d6-14db47ec361a", "value": "T13EC3BF2230C8C8F3F55A48B688D9DA714D7ABC708B3106C73BD911AD9E256D28F35B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355469, "uuid": "00f76a73-a2ce-4485-9297-c84016694675", "value": "62138de48166b74a51f3a26440069b5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355469, "uuid": "47653dac-4723-44c1-9bd0-43bfd7dca149", "value": "1536:sSAWPA4qMRtU8okc9q1fGqmkl0lyKRjjQWuXJAAqK08HTF2mNjPx1:tVPsR5iOJo0lyKRjNoSd8zFTNLx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694355469, "uuid": "268bb5a0-c42d-47e3-b81b-3d994a097b33", "value": 128072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694355469, "uuid": "765cebb3-8e87-46f1-846e-02bea09c6a7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355469, "uuid": "4753f00f-bbec-44df-a4cc-bd7d8ce0de32", "value": "8a372a849320884f016b96a92571b1d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88536902-4fed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694359210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359210, "uuid": "8738214f-60b5-4c7c-a470-b3059c96fd90", "comment": "Malware payload (RedLineStealer)", "value": "1322008e75c620fd60416b4264d42e7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359210, "uuid": "05350489-fa28-4262-b5d6-ae9cd07aaca6", "comment": "Malware payload (RedLineStealer)", "value": "0e527f21ad917b87f93f2cd665f5e5b8ca6f51a2505a5002e3bc8309335a75d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359210, "uuid": "260a3081-6559-43a0-9d6f-606647cf1ef2", "comment": "Malware payload (RedLineStealer)", "value": "57dba56481bc616d299d67f6fac5536e0e848d46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359210, "uuid": "0ea69965-3f2a-448d-beb9-e2bd29cc4c32", "comment": "Malware payload (RedLineStealer)", "value": "633708960c50d1898d8e806d28c72d31c85110a501b0df84266752649555b4e4bd512339f27b9d583a3944af098c27cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359210, "uuid": "61dacb44-dbc4-474c-bdb3-f41f9011621d", "value": "T19E551240B0D1C0B2C87714B518E4EBB6297E79E00A139DDF7BEA1B7A4F612C05279F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359210, "uuid": "d4564ad7-5095-4722-80c7-12b02f74311f", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359210, "uuid": "9d97fb19-5647-4bf9-b1b2-2efdc4793df2", "value": "24576:PAHCWpD0TJCKRi96Gd2/vaRgkrnexq0IfbgUu/bX7/Z5JnAxToNu0ikz1:YHCWpDgzHGdx/Dek0csr/Z51AxToNu0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694359210, "uuid": "6ba95eab-c6c7-423b-90f6-220234036eaf", "value": 1395200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694359210, "uuid": "d3eea84a-1d07-430c-b377-28b35da7a2dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359210, "uuid": "25d64174-b472-4246-91ce-f846b47bf380", "value": "1322008e75c620fd60416b4264d42e7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c53428-4fba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694337240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337240, "uuid": "c0425833-8b67-4922-ab24-ac55c25aa8b5", "comment": "Malware payload", "value": "a655dee715fab5f0de7eb835baa8df8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337240, "uuid": "9cadb33d-5e08-444d-830a-5039df728523", "comment": "Malware payload", "value": "0fb6928de0ac0d4860ae12261140b44d76577e168a9e0fdc0421d8a590f38eaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337240, "uuid": "13f2cc6e-7262-49dc-aad8-428cd0feba4b", "comment": "Malware payload", "value": "623b5277a2dd63f03b1e863c4cdb3a27dedf71b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337240, "uuid": "1e4f8983-540f-4aa7-86a0-3a3e714b7e88", "comment": "Malware payload", "value": "feee3d356038dc413441b9049d036fb6caddae4c8ea25f0ed34f4aa1941c4f7eac75cc4c433ca317852e779008b719d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337240, "uuid": "c231715a-4f26-42ce-9b74-402d90afd4e2", "value": "T19D16187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337240, "uuid": "e790d412-78fb-413f-998e-90bdbd018b62", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337240, "uuid": "932234a5-fe76-4246-b35b-ad6c33349815", "value": "49152:ngh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWVjXNO:La71f1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694337240, "uuid": "115b0e44-ca9a-42d0-a422-ead47a516bf0", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694337240, "uuid": "9c0cb176-bf06-4d44-8dcc-b435e52eb8f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337240, "uuid": "1d238290-3cf2-4c3a-ba8f-0e1f8f457add", "value": "a655dee715fab5f0de7eb835baa8df8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b8318c-4fbe-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694339016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339016, "uuid": "9cd0ccf8-d9c3-484c-aad9-f46acab2e0a2", "comment": "Malware payload", "value": "c9562b15826e6c53193526a6044c4fd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339016, "uuid": "63b8db6b-8bf6-4dd2-9114-3581f4b6b2a5", "comment": "Malware payload", "value": "1037110be4c7ed0ab6be853d1bf99d95faac02e9ffdb5b3e8420ad5c3750bd8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339016, "uuid": "67fa10c8-6712-4d41-aec3-fd5ab976d13b", "comment": "Malware payload", "value": "a2c0b87c4368bc97854a08b4e6c4b29ba73cc3cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339016, "uuid": "408ebee2-31ce-4e3e-9e2a-632d597f6bdd", "comment": "Malware payload", "value": "6b5901a8f354fe40880c71e93d558131439852f134c4a1e576e1794f827792f662c907e03f66b6518d72f2fdb13f5fea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339016, "uuid": "48e9af91-ee1f-4a1d-880d-c02484c9b17b", "value": "T18A243B46AA408B13C0D72BB9FADF42453333AB54D7EB63059528AFB43F8679A4F63501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339016, "uuid": "2f5e4779-da45-445c-ab5a-d02ad6d03cb7", "value": "6144:RDkfF+DdmWVbao8h6/Ile3fY/ePX+HVUdM/RxKKs5:qIdmWVbafh6/Ile3gWv8Um/fKKs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694339016, "uuid": "9ae9c085-b26e-453d-9884-b511a25b07b8", "value": 212078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694339016, "uuid": "4a24bfe6-ea83-41b0-bb6d-d97cce2e04c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339016, "uuid": "cc271090-2511-4ffc-942a-c48a59e7bf9d", "value": "c9562b15826e6c53193526a6044c4fd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5390756-4fde-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694352951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694352951, "uuid": "34385a77-0289-408f-a969-5e63b3d42a85", "comment": "Malware payload (Loki)", "value": "53a59f2e0b8e9b462e1762b9b62eee01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694352951, "uuid": "3f5ef0d3-e49c-4132-a3a8-be6dbd17711b", "comment": "Malware payload (Loki)", "value": "104add3dff386099f4ef475dd3e5e85c66ee9f474e68966f55e4d870ddd77b4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694352951, "uuid": "0a899dc7-4f24-4c86-a41d-d74c661236b6", "comment": "Malware payload (Loki)", "value": "01d6e736902ac79aacced201366124c190170335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694352951, "uuid": "4ab19834-6b15-4dca-9f38-569d5cf9b162", "comment": "Malware payload (Loki)", "value": "909292f71986b252b2e44ca4eff594a03f6bef1363ca9308d6ec7aecc96ed3197bfccee01b96b58c3fcc22a6d90e1fa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694352951, "uuid": "29c11e09-3d32-490e-a597-9e2b13a38472", "value": "T1B2B39E4477905B11D8585BB585F393A703F3D6CB6273E7497A888AE90E01BD88EC8BCD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694352951, "uuid": "675504f6-5ea1-48ec-ab1f-6a3d20690659", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694352951, "uuid": "d9b7b849-8c97-4f9c-8f51-70e39ada60e9", "value": "3072:fwA+uZeEsYuu/IIUS0h0CTXYmvFMQ4b1Lfe:Z+uZeEBtwS0hYmuQ4pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694352951, "uuid": "c1d3b52f-9e18-412f-b453-e4a76c19c381", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694352951, "uuid": "07a68513-67a0-4c6f-9fe2-22b02d22cf16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694352951, "uuid": "4d24a3a2-e9ad-4c6b-a724-2ddd14f21161", "value": "SecuriteInfo.com.Trojan.Siggen15.17498.16507.9322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a757c083-5014-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694376013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376013, "uuid": "db0dd946-6290-49bf-bc7c-de7a4f55bed4", "comment": "Malware payload", "value": "c5074c9a63bb9710a707adc4b86b3eb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376013, "uuid": "9514bb53-677e-450c-82e1-9a5be1f4dc67", "comment": "Malware payload", "value": "117d8008442413cc6fb501263e5e51874016d1919b98320cd6bdb1a3e1b06d81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376013, "uuid": "972b198f-60c0-40ca-a25e-e74340483b5b", "comment": "Malware payload", "value": "7c0b7961b3cbb3dbcd78a0c3a58cf70d89b4c4fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376013, "uuid": "e747c616-6fff-46ea-bc91-2feaaeee98fb", "comment": "Malware payload", "value": "2e97c4ce584fa9ef7e3989af0437e67b3380198383a59435119f4e7f7bdcf267c5662f2b5f42e1a870d0315e149d9b2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376013, "uuid": "393eb630-5e2d-4815-8b48-9d175098caf8", "value": "T15EB52312B6E0C8B1E562193516D18B71BBB87CB12F2A8BDF93842B3D9F650F06634717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376013, "uuid": "56bf7425-5e3e-4910-ba26-0f6c59b3446f", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376013, "uuid": "6dadee61-2d3a-4cc4-8a7b-5093f85c95ff", "value": "49152:8cbi6RGVy/TTbqdVqhXQ5W+pZG5MQ/h49J1i1:8cbmVyvEAlAW8ZSMQZgnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694376013, "uuid": "d45672d7-2232-44df-b6db-9a57b320a17a", "value": 2382018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694376013, "uuid": "d7ec6c47-8320-4491-8ccd-e5c1d3e7d274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376013, "uuid": "e552374e-2dec-474b-9cf4-81ec5ddc2c6e", "value": "c5074c9a63bb9710a707adc4b86b3eb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01d53c2-4f8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694319012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319012, "uuid": "0504f3f5-1da1-41f0-ab74-1076f509c3ca", "comment": "Malware payload (Mirai)", "value": "d61ebba62763c450962fb15d75ea0cd8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319012, "uuid": "732dd2ed-c945-4d01-8244-03120c56e0bf", "comment": "Malware payload (Mirai)", "value": "14311956dd34c6d7e3c22a1a1b2590d197d9be0a03c97abe3bd40ba853c047f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319012, "uuid": "b5ba6aad-e332-499f-9c0d-411890938344", "comment": "Malware payload (Mirai)", "value": "784c88ebc738c4297f344a1756ccf00e451b5eec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319012, "uuid": "3e4b49cd-db71-4f93-91a4-fe9eb06aee05", "comment": "Malware payload (Mirai)", "value": "78e1536174f18097ef232b02f6b423f9ec6cc7b6a18a37cabfff37910443778cd71d540cd3e32a946ab5190b1e5562d5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319012, "uuid": "88756c0b-ace7-46ed-a5e8-8f65629ecc6e", "value": "T1C0F3A95E6F338F6EF668873147B74925975923DA22E1D684E2ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319012, "uuid": "0fa96f02-76c4-495f-b937-ac6484afc261", "value": "1536:9MXVhdn9OdSAZTZtZd9BG9rc0eNsslP1zKTfNYoDF8jkmx7y0K:9MT+hZtv9BercxssDwYo58jPx7y0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694319012, "uuid": "1f80ff4e-b28e-4d12-b171-21c6a565b7d7", "value": 161416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694319012, "uuid": "e778471f-f335-49e8-8ce5-ad4f1a72faea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319012, "uuid": "02492259-9dbe-475f-9841-a12eb7b75eba", "value": "cundi.mips-20230910-0410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b4910cf-4f9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694325070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694325070, "uuid": "c924b548-d7f1-45b0-843c-e48bf3313393", "comment": "Malware payload", "value": "62cf67841fc5bfe5839d1f6e3f582691", "object_relation": "md5", "Tag": [ { "name": "anydes-cc", "colour": "#0F33B4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694325070, "uuid": "9479d669-d250-488f-bf7f-9ca6a731c0da", "comment": "Malware payload", "value": "14e60c39840af1d5be488496ebc891638e8821141db048c6cf2e6ff270ebe0dd", "object_relation": "sha256", "Tag": [ { "name": "anydes-cc", "colour": "#0F33B4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694325070, "uuid": "6da59163-bfc4-4340-8df6-1d4630fb6183", "comment": "Malware payload", "value": "76f1e869734be53c4b6271d88418a9ebe2ec0fde", "object_relation": "sha1", "Tag": [ { "name": "anydes-cc", "colour": "#0F33B4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694325070, "uuid": "32584c32-17a3-41c5-8e0f-a4489abf66ab", "comment": "Malware payload", "value": "2740d06c9fa9a542c1e95639dacb709cb1420766f4ce13ac807418bed778bd104513138aac851f054e11726c48fd7f14", "object_relation": "sha3-384", "Tag": [ { "name": "anydes-cc", "colour": "#0F33B4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694325070, "uuid": "96c46f61-551e-4f0e-92a8-ba9eae29ca5f", "value": "T1DE6633A9863BD9DCCEDF58314D7E3A339B06083AF5F68265A4847C1C6954F09F248B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694325070, "uuid": "d4aa85de-7a51-4cb3-9830-efd2e1656f93", "value": "98304:33TXJv9FmSuggqk4GDfBmRJ6Ir1R5ZaLGcRtIIQx3jiL5ODeGay13bZIhxPGtOR4:HD7kSuggF4GDwRbDPaDY3jiHKbZROc1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694325070, "uuid": "463562ae-ab10-4a94-bcd8-4932ac0c8608", "value": 6740812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694325070, "uuid": "af8a3a15-44cf-497c-9fbb-4683a5dc014d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694325070, "uuid": "ba8a2598-88dc-44e3-b75a-c5c0afb961dc", "value": "AnyDesk-x64.msix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f975c7e-4fad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694331600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694331600, "uuid": "ba30ee31-0397-4ff0-ae9a-f854ed6f70f5", "comment": "Malware payload (Amadey)", "value": "af386d4f06fc220943bc13812384f552", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694331600, "uuid": "f25721af-2a8a-43be-be94-fc5fc394183b", "comment": "Malware payload (Amadey)", "value": "1590e13b0bac57f3539e1663ac7ba290d9ef91d3b40a0b9ee8cd148f35689048", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694331600, "uuid": "18814dab-5c96-401f-8436-a0c682bb7e80", "comment": "Malware payload (Amadey)", "value": "e856463e566722dce9f5c86c567dc9fbb76c742d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694331600, "uuid": "37c0b0e6-05d5-436f-9226-0632b819f993", "comment": "Malware payload (Amadey)", "value": "381bcd65fe2e5d90e424d0a761a7ab682af742755eb891af7b143034ee80d4bb281035205fb825e069265376648b2f88", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694331600, "uuid": "bffbef11-e21b-451e-9626-f08d6044a511", "value": "T19C447B2365E0BC7ED66707704F6DBAE87B6EB8E14F21834A13141EDA1D306B1C65B326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694331600, "uuid": "7e2a3b44-5f94-4f43-8dbe-2d369f2283d1", "value": "3681be0c4196dc1f0159e8326f6ce58b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694331600, "uuid": "387d993f-7baf-488b-8cde-7ae090371fcc", "value": "3072:3Bc0bLwUUeGfJ6OfDOMWTXwnwNyvhjn1trtR9D7BlHRGtX2:xxbLwLxD0TvNGhHrtf7gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694331600, "uuid": "fb674890-54e8-4c14-a172-104c968245de", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694331600, "uuid": "d39fa615-28d0-4f6e-bcb4-78f0fa43eeb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694331600, "uuid": "23549859-fe7b-4757-8aeb-1194b59de2f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f040bba0-4fee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694359814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359814, "uuid": "310a7b96-cc19-4869-b733-0dd2c7397597", "comment": "Malware payload (RedLineStealer)", "value": "8669fe397a7225ede807202f6a9d8390", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359814, "uuid": "bf7521f6-34eb-4dc2-907a-57fde10efa14", "comment": "Malware payload (RedLineStealer)", "value": "1624a759791e49ce8f79dd249d3ac2aede589ffbe53db342e4c99e2fbbc1b90e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359814, "uuid": "fcf93bac-dec2-4b0b-8167-029346f96ce0", "comment": "Malware payload (RedLineStealer)", "value": "04a806a5c4218cb703cba85d3e636d0c8cbae043", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359814, "uuid": "82cb8186-c7ad-40a2-8d9d-8ffe69ab9382", "comment": "Malware payload (RedLineStealer)", "value": "6f4a9416580720cb0d992ffda967244345f5f89a60ebae6e451ebcbd0415782aa57db75bdb55d1bb7b2bf54ceef2221b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359814, "uuid": "703ae409-e634-4f3a-8d7d-18d01bb237b0", "value": "T176742AD0338469CDCE4F89F1617117788A60E442A567BBD37C8BACFB385AB45BE051E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359814, "uuid": "9ef7868a-8aea-4b05-aa39-324943748dc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359814, "uuid": "1dd458d8-3f8e-4ae0-849b-363f24be0036", "value": "6144:slX0q8OZ4wd4VW7F8bXUw4qP++0bVfMU64N1alTi:TqaU4VW+wqG+0bVfMU6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694359814, "uuid": "eb10c896-2a48-458a-941f-7606e80eb993", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694359814, "uuid": "2626ee77-8107-4749-8afb-bd1d02343e63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359814, "uuid": "2b038105-b9ae-4107-9ffb-f57b05b5552e", "value": "8669fe397a7225ede807202f6a9d8390.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1709a8ce-4fac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694331103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694331103, "uuid": "618f6840-14d6-409c-9950-a39a0b05f1b6", "comment": "Malware payload", "value": "1cbbf8d42d6975ca2c5f701f533d3123", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694331103, "uuid": "f1c5c028-e888-45d2-af1b-3b09bfebfb57", "comment": "Malware payload", "value": "17bc6eb89d39c0435ea2ea40ae912d62be10496a8bfa102705b496a1fdd6d788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694331103, "uuid": "dcc577f5-9e79-42c4-9815-5694223b543c", "comment": "Malware payload", "value": "1212aac4ac15737a77b73c8e125f3e034ad658ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694331103, "uuid": "6c2bc1c9-6d0c-4375-9799-4f972b2dbcb7", "comment": "Malware payload", "value": "c594d66923a7b30c4d90177b81385b5d937cf47aea147fc5a36e7b9aaf359717e40fb4935f332786eddadc4425da6f65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694331103, "uuid": "886d1ce5-92de-4769-a2c4-b02f22149948", "value": "T137D52303B7E512F1D2232E331225A371DABEB9308F618BCF5791462DAA356C157367B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694331103, "uuid": "c8c75d71-4486-4471-8b89-18f965b323cd", "value": "30d1665d4c796f53fba13defcdef7cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694331103, "uuid": "3563a84b-087d-4092-8b4e-3a30fcfbb34a", "value": "49152:xWhlkLBfJXAEXFuiri2yl1b43GAnadOlPk+FfcxwPh5ZOE17zx3CGdCd4EvEit9m:xWhl0BfKE1Jri2l3GAU+CwPh5X17zx3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694331103, "uuid": "80012f1f-2df8-4631-a29c-8a56a69c9cc4", "value": 2978182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694331103, "uuid": "48d3c7c4-4ef2-4218-aea9-fbc4fe3a8378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694331103, "uuid": "82f2f4fa-643c-46f5-a46c-89a2c6a9d791", "value": "SecuriteInfo.com.Win32.InjectorX-gen.4622.21361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6363eb7-502f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694387715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387715, "uuid": "12903a83-4cbe-4693-aed6-fa633f8f8884", "comment": "Malware payload (Amadey)", "value": "ba2f27a3352b2086317f3afea66c9982", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387715, "uuid": "716abcc8-3128-41b6-b89e-c048e83a5cd3", "comment": "Malware payload (Amadey)", "value": "17e6d489c82aafd9cb685806bf44acd6e2fc2c0fe5a249b16196ddecce66e348", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387715, "uuid": "2a24dd13-5d69-4d2a-8118-8696cfddb010", "comment": "Malware payload (Amadey)", "value": "65a4cd8170c0f50a64a0a0449c906a433c24cf13", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387715, "uuid": "c6c37c70-1627-42d0-9c53-eb36b8c7847f", "comment": "Malware payload (Amadey)", "value": "f816cdbf204c4cb6c5b3b6649082cb250456f9efca5cf7c5a7903525ef7d9cc8ded507cbe62cdd19e70951f53c7208e8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387715, "uuid": "0982f9b4-74ef-472f-b962-b8d306847228", "value": "T181651212B9F25936C971143601F1D6A2483AFC310EB55ABBAFA21F2FCF347915261A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387715, "uuid": "8e118a03-426f-42ef-9736-dc552b8af7a0", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387715, "uuid": "c6016a80-1497-4fcf-936c-5b2ffb459101", "value": "24576:veCCJXi6fT0SS/lIDS6juuiVk6FWWaCwis+V3DZZLJgzvamYZz2iDgruvK1EMu1A:2CCJXi6fvS/lVDuFBCwvm9ZVgzva7apz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694387715, "uuid": "55dc28fa-02ef-4858-811d-b186d9575ff6", "value": 1471352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694387715, "uuid": "abcd0144-5132-4d24-aa61-49e1ef441c15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387715, "uuid": "05890870-59aa-4518-806b-b0c13f6fd601", "value": "ba2f27a3352b2086317f3afea66c9982.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9148ca5-4fc5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694342085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694342085, "uuid": "d231cfc7-8e34-4589-a9e0-1155deedd07c", "comment": "Malware payload (AgentTesla)", "value": "208b5b195addadac27ca9790bc77c2ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694342085, "uuid": "d638658b-9e74-4775-bb80-42a377862c00", "comment": "Malware payload (AgentTesla)", "value": "1d6c8e54320e5f827ce7dda40ae6257f54bb38fb08da0b37540154c1e387685a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694342085, "uuid": "5b965be0-77c9-4dc7-8198-41574eb7b1e0", "comment": "Malware payload (AgentTesla)", "value": "ddc84a0fa8e27bba124b29710509e12cc046d829", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694342085, "uuid": "383b04fd-9501-4cd1-91b0-f8f40fb2fa0e", "comment": "Malware payload (AgentTesla)", "value": "f4eb413483d9a5d29f6b973ed54a7f7d63b4954493bbf46a2a516ff095fe6b3ca6c7f5da990d70d2dd9f4fbb6e087ab5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694342085, "uuid": "560a66ad-c17a-4608-89e5-7ee88a7b2429", "value": "T168A412433EF400B7D02D1BB35A5337489F5E9E4612987F3F41891F492A5A3EC66E0AD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694342085, "uuid": "7a15059a-636f-40ce-948e-491c43f4e421", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694342085, "uuid": "da627e94-3b15-47ef-aa49-23d92c6ea698", "value": "12288:pTaX8doK7rzx2gKSiR0l7P/PIxmaI1DrkjJ6Eh:pTaNOrzx+C7P/Q8F4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694342085, "uuid": "309d7a4e-d83e-4daa-b0d9-80947bb55417", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694342085, "uuid": "65551898-19cd-4aed-b50d-70e29681c84c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694342085, "uuid": "72ee83c3-89a8-44cc-8f1f-4383ac462b3b", "value": "SecuriteInfo.com.Trojan.Inject4.60697.2816.22053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a19aa14-502f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694387480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387480, "uuid": "9662c42c-62e5-4fcd-a9b6-30ec69a20cdb", "comment": "Malware payload (Mirai)", "value": "e772cd9c55dd3767d85ea7604b9964a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387480, "uuid": "0842022f-ae15-4707-95ed-248e5b998d98", "comment": "Malware payload (Mirai)", "value": "1fbc646e53fc9815165a7ab071751257118e04e01fe09c2098dd41dbc21e199e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387480, "uuid": "53a2db50-ef8b-4b4a-8009-0ad38d7ecfa9", "comment": "Malware payload (Mirai)", "value": "a415ec327fa0868509aa975400a6b3d1813bdffa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387480, "uuid": "0fa24f46-378c-4c1c-8bf1-6a9f88794032", "comment": "Malware payload (Mirai)", "value": "b866ca050305f33116ec87063f4cbbb9a5678215503bd7493e94d87863ce9a59c5ca23c0ab18b3f0c1ad2c9c3b3faa04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387480, "uuid": "209ae1a5-77da-4866-8fd8-b4df3fbf4826", "value": "T1EA538DBD866ECD65E0044AB8A8659D308B12BC0892332DF6DA464E71944FDBCFC197F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387480, "uuid": "5568c790-8a31-4807-9d7e-5c8bdba12955", "value": "1536:haYs8eNYlOJ9dsOVFl4LHig+fs3l74y/qDm3MuCnEQ:hONYlOJ9d1Vr4Tef+lU5m3MuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694387480, "uuid": "fb0c5dc0-1346-4df8-afa4-411732371c09", "value": 66632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694387480, "uuid": "1c94a54f-8ccd-467e-b1c0-4f79fa1f2b05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387480, "uuid": "321be04c-7750-4501-9edb-acbf271f681e", "value": "e772cd9c55dd3767d85ea7604b9964a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08166bbf-4fe5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694355559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355559, "uuid": "e1c5b052-de90-4a25-b5a8-29a7eddde020", "comment": "Malware payload", "value": "f0de36d080928b9b6fa064ca3ae34e18", "object_relation": "md5", "Tag": [ { "name": "pw-555", "colour": "#92F44E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355559, "uuid": "3953974b-86d6-4491-bfde-3e0466cfff5a", "comment": "Malware payload", "value": "1ff0a269b7e83d9ff2eedb74f7fc41fbcbb60d62fd1b90b13949f9e7df63683f", "object_relation": "sha256", "Tag": [ { "name": "pw-555", "colour": "#92F44E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355559, "uuid": "e67c3776-58b4-43da-a634-b55159dd86b0", "comment": "Malware payload", "value": "43ff870ddb269ec3a4ad0ffa737a62e69c1f2468", "object_relation": "sha1", "Tag": [ { "name": "pw-555", "colour": "#92F44E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355559, "uuid": "e5ddf9eb-1616-4a9a-b698-5911ffe86953", "comment": "Malware payload", "value": "c1bc14d4e61288dfa79c7dffc8a0d6d7e8491bbb4f0ca4595661a2eec82896efeeb4a8eea761adbd638c91e3057c073b", "object_relation": "sha3-384", "Tag": [ { "name": "pw-555", "colour": "#92F44E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355559, "uuid": "c731a721-60d1-4f83-9d60-ce2da9560806", "value": "T106C423645B572E75E2CB01D989073AD8F760A2F29B11B2F0C923AFA4CD2EF64D4D5720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355559, "uuid": "18208e71-6c5c-481b-91bf-8597b985cab2", "value": "12288:Bu/mTUx80PhprZxieJmSSfi3MexEpdU4JtJupaeLwYKb8fXb0xR+f7QUl:7A4rempmqWjLWb8fXIxQfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694355559, "uuid": "d5798b28-2cfd-49af-90a1-07c16d1d7172", "value": 556485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694355559, "uuid": "ded5d7ad-6ef7-4104-99ad-cf01255a9e94", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355559, "uuid": "6bd462e2-fc6d-4dc2-9232-38773b597b17", "value": "GoogleAiv3.5Setup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4819f991-502f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694387449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387449, "uuid": "9887af51-add6-4dc0-807c-af67d8473ad3", "comment": "Malware payload (Mirai)", "value": "e8a941c08d0b587181d9f0a73292cf83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387449, "uuid": "2498c13e-d8be-41e0-9d19-7bc73ecdb9e8", "comment": "Malware payload (Mirai)", "value": "20a1c1cbae043c1b34ebb592888e414484281ff93ad99a01646c74d9de6cf91c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387449, "uuid": "be03b407-f191-4678-a525-6b1ed9cbb14e", "comment": "Malware payload (Mirai)", "value": "0e13cac3ced0f5b8a6d4fe077ffddaed3019dc9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387449, "uuid": "fe705f93-ab96-4f9a-ab9d-cf5cbbad0107", "comment": "Malware payload (Mirai)", "value": "7dc97298b15b28cc49f0880ecf060cbb52f8a7a8da04daaa6769d22cb2e177dfae619b645ca87200f65812eec3f94308", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387449, "uuid": "a23580aa-46e2-4240-a523-0816d2f810e9", "value": "T1C5733C27A9791E2AC1D4B57A50F78604B2F5230E2AF4850EBC720F4EEF256446613BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387449, "uuid": "3a9ea32f-8181-435e-9414-94b775684a23", "value": "768:EnoKuChFQjcq09Q9RHgPi74iXN6WsQs+X1ySdFqGbWdKO+bWvaywb:En7uCzQ4qQQ9RHgPU4id6vQzy5YYeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694387449, "uuid": "f6925463-f3b9-4522-8b1a-f2c99378c381", "value": 76432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694387449, "uuid": "b324ffd4-3f69-4de8-a06e-3cfeee849c56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387449, "uuid": "59258e81-c40d-4319-b52e-17e0b71d53e6", "value": "e8a941c08d0b587181d9f0a73292cf83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669623d5-4fb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694335961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694335961, "uuid": "16e910d6-ff21-4bfc-85dc-19a3b5864da0", "comment": "Malware payload", "value": "20fc393f730242ba5ac07ebb4b86c22d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694335961, "uuid": "74b3ea00-c88a-48dc-99a1-e5a97bd13d94", "comment": "Malware payload", "value": "223b853c43dca5cb13276cd00d6e550746f3519ee69bf1beb979f6ad4ae84a0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694335961, "uuid": "a7a3ab33-a18f-4779-b4fa-b6b4d0bf00bc", "comment": "Malware payload", "value": "3ed34693e2f1e2cd38a3f43aef260388f48cfbba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694335961, "uuid": "4719274b-dd37-4c55-a506-06385f7fce3a", "comment": "Malware payload", "value": "77cb6e7bb4112ccacbfaa88cf63a912a4a6344b41c63c60f8caea3d26524f250749ec40a86c75b8feccd2bdb360e7612", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694335961, "uuid": "f083bf0f-9193-40a6-8eb7-a6cff9898828", "value": "T16BC1DB37928699B8C22F14FB9FAAD49E2525F4D083D2302AC3705F743F92938325915D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694335961, "uuid": "004972de-89ae-4197-a614-ca24ae64690d", "value": "0ffe343f735f6c7d7a04587c244e2896", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694335961, "uuid": "be9528c2-c236-4938-a51e-9a68540d858c", "value": "96:jqJtHFXoDqxPcgqyRRvnbOpbdOvdddwTrf2ifXor:aFXdxq01ypbdOi2ifXor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694335961, "uuid": "970bc824-777f-4d60-8149-caff1903a828", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694335961, "uuid": "e4078083-a741-4def-8753-65a7d890d8cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694335961, "uuid": "ec7acc1e-c391-48d0-8637-ed0c0a0a2f3e", "value": "20fc393f730242ba5ac07ebb4b86c22d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f115d41-4fba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vjw0rm)", "timestamp": 1694337129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337129, "uuid": "bc2d8d26-16df-431a-9d3e-36ff42fc82b0", "comment": "Malware payload (Vjw0rm)", "value": "2ef952eeb1e0caf443dfee9cbf97f086", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337129, "uuid": "0d3d6628-59ed-4398-bd25-57c75c0ca712", "comment": "Malware payload (Vjw0rm)", "value": "23280d742e475a0a00dae2a6ff0686092ccd14f02b292b4be61de7b73b7dcbda", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337129, "uuid": "a0359ecb-042b-4543-8366-e17577b6e90a", "comment": "Malware payload (Vjw0rm)", "value": "6226e9e1319a33c523e4634d64478cfef9bf2084", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337129, "uuid": "0c41332e-3214-43d0-af05-eaa56696e2d6", "comment": "Malware payload (Vjw0rm)", "value": "2a04b108be2d0adb6ae88a5763c9bd7eecba9e55729fefa629b798e33b281ad8fd5d35315040f5522752a555850ca09c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337129, "uuid": "7355f806-ddb6-4d19-ac90-a004b23acb38", "value": "T1B081219C284B863C57D23B8A802DD14CCDF548B47F28D2B6148CDAC5360E979C7B69BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337129, "uuid": "2dea2201-b6aa-48a5-a9eb-f062d7110a22", "value": "96:SABNo5Dyk2c24ZRMHXE6/BIBV+Ys+fJHdDdQqR7bJyKhBOS4UK:zSj2c24ZRMlBIeYs+fJHJfRf6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694337129, "uuid": "f75ebd02-d65a-4f6e-979e-0d96ee265f39", "value": 3888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694337129, "uuid": "7bbdec10-86c4-447c-b631-6eac26469d2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337129, "uuid": "f7d749c7-a5a9-4234-97da-abed5ba102b4", "value": "paid_invoice1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896cffac-4fed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694359212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359212, "uuid": "0bb7178d-5b20-4106-a506-45af68de93a4", "comment": "Malware payload (RedLineStealer)", "value": "b2d73546341a9fd03730f097240800f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359212, "uuid": "34b9c388-40f8-4768-a86b-dfe992e86d82", "comment": "Malware payload (RedLineStealer)", "value": "24d1db071682d7d2ff58958f5c177d716b172ff1f19c42cf95f4c28744f2f4bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359212, "uuid": "d184844d-f4e5-4ebe-a525-d563c2fd05d8", "comment": "Malware payload (RedLineStealer)", "value": "148cf2b38d90a0710b187b47fefe7f6918fd9e4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359212, "uuid": "7f40936a-570f-4980-a8c5-3351eff8008d", "comment": "Malware payload (RedLineStealer)", "value": "599a64d6abb7d83530f731809a680f1d12bb000f4aa985227dfa3cdaddd363eb32e13d8647fa2ed9a11b80d516d20a55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359212, "uuid": "2078c311-2740-4541-ba70-1b3723552b4a", "value": "T1D2349D11B4D18432D872153609F0EBF65A3EB960CB625EEFA7E40F7E4F302C1A671A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359212, "uuid": "46d6104c-8965-4e66-aad2-d450d3797e66", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359212, "uuid": "3adde2e0-d210-43d3-a241-c9821e87ae3b", "value": "6144:/ytRVgUwtKqCVkYdkEktqoigAOqlCORNJBrBi:/ewtHCOPfYvJBrBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694359212, "uuid": "fb8f6193-7f3f-44cc-ac7b-e03da831fb64", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694359212, "uuid": "0f2e0723-ddb9-4b4d-aafd-5b8680f17bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359212, "uuid": "a49560d3-7e66-4021-9905-fe658a82d6b5", "value": "b2d73546341a9fd03730f097240800f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b167b87-5011-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1694374596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374596, "uuid": "7c03f57c-42f8-49c8-9f69-a3bf6b841897", "comment": "Malware payload (Stop)", "value": "d964dc85ce7dd77ffb40e6b38cb77e3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374596, "uuid": "6c8cd154-f3d6-4548-abaf-424dd154f74d", "comment": "Malware payload (Stop)", "value": "253fbc06ef1863a8afe10ec32ab0e0c507c1f1227ececff38eeb3d6bd6ea9320", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374596, "uuid": "42b1c480-8299-4840-907a-6590111ddfa9", "comment": "Malware payload (Stop)", "value": "9b0a8d46bfb7f6a9490f5fbd472472e969c3856d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374596, "uuid": "18d9ae3e-31f7-43ff-aa1c-b79528a7145a", "comment": "Malware payload (Stop)", "value": "70b1e7a74fd86674854082fa5ba25446c82e32063c810b8e3beddda5aa4ca44f349fc4fa10333b2ee7424880052775c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374596, "uuid": "ecd4c187-e2fc-4874-b708-88b14168a381", "value": "T139F401137AE0A862D6674F395F1DE6ECFB7EBC205AA05B4F12540E6A5D303A0C937325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374596, "uuid": "cefd3f77-b480-48c2-a56c-93bd23949411", "value": "cda48ebb1fe57d9b31da3a94fc154bf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374596, "uuid": "20e77799-7273-4cb8-8a59-adadd233ed69", "value": "12288:4x94UoS+GHjQGdns6r1xQemfB/dyYxJbHRl3UexOTsw5TSwJJo30TJIarc1Bbddp:4xStKQGdnFnQeghHRGexOHhBo3Ijw1Bh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694374596, "uuid": "2027878e-db50-4ce1-a452-0e33a096ee67", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694374596, "uuid": "c57b28b6-aa68-4d7c-ba05-eae6149f9916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374596, "uuid": "9aa4f535-f53a-48c3-a561-c3538ea8583f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611e2609-4f81-11ee-a6f9-42010a9c0055", "comment": "Malware payload (TeamBot)", "timestamp": 1694312759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694312759, "uuid": "6aae89fe-fd76-47f5-b27e-e35ec41e7983", "comment": "Malware payload (TeamBot)", "value": "6ef977771342ef9c9ccfa431d6306ba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694312759, "uuid": "015260d1-7192-45f9-b0eb-4e2829d53a1b", "comment": "Malware payload (TeamBot)", "value": "2670a729c07877c97a3593905bb25f15b1d27774b89af3bb06e24fe80db64d32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694312759, "uuid": "9413dd6f-72da-458d-a74c-8136c8d8960d", "comment": "Malware payload (TeamBot)", "value": "65719c7d1ab31c91febb1294816b0641bed03aee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694312759, "uuid": "3e94e9ff-125b-46c8-b1a2-f4094f38d29e", "comment": "Malware payload (TeamBot)", "value": "fa2ef0397903c990444eab16edff3cd23b6a5469bb4106ecd86512ac88218c5aec367cf35ac3fb4ac6c83094d9ce4606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694312759, "uuid": "cd24acf1-89f1-4775-8b07-a98ff77e62a7", "value": "T1A5449E1375E0BC73D66747304F6DAAEC776EB8615E6057CB23541E6E1A302B0CA2B326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694312759, "uuid": "979df6cf-b155-4204-8b37-67ad8b97f42b", "value": "3681be0c4196dc1f0159e8326f6ce58b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694312759, "uuid": "b9fad9a0-2d5b-4ac4-81bc-42c43bbad820", "value": "3072:oBYgGLLfvU6GLJUEch7t4/6zupQoseCclDTWxLj6RC2s7J4w9bwyHRGDTkX2:48LLf2lUvhp26z1eVJ+SQ2s7SRZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694312759, "uuid": "a7667fd6-97b2-4e49-87e3-7629d49f7b0d", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694312759, "uuid": "b25e98e0-4d9a-4cad-bbd6-662075b67406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694312759, "uuid": "3fa18ce3-4437-4b35-a42e-221a58225eaa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045a7c4c-4fba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1694337085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337085, "uuid": "f1ca9517-3c6d-4962-9178-ea8b806122e9", "comment": "Malware payload (AveMariaRAT)", "value": "961baddbf10b42a9d073c78dd4885911", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337085, "uuid": "658dd626-900e-4763-acc8-21a701dffa8f", "comment": "Malware payload (AveMariaRAT)", "value": "27bf61182f09c2d4fdafc0c1f406b972861ea31f2e615028defcbaaa483f6f30", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337085, "uuid": "4608ace1-4a1e-4714-b8b5-6f1bd78b7039", "comment": "Malware payload (AveMariaRAT)", "value": "dac0a5eff723ab60109919c1bf7ffa92c7ee2674", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337085, "uuid": "b84e731f-426d-4598-b4fb-f805241153ac", "comment": "Malware payload (AveMariaRAT)", "value": "8554e5c73fa8fdac39a365ed9fbf42edf0bb69ba0ef232fa900b432e95810b591ec4c407f3ce9e85d1d73d71b94bae5a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337085, "uuid": "7bcc58fe-ca43-4b4a-b56f-805a4540bce5", "value": "T1AA3168042EF71320E2F2DB34A8BAA711C53B7D66EF128F8D01A1C1895426611F4B5F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337085, "uuid": "cc03a8af-05c3-4820-b189-a659b8867c23", "value": "24:8J/BHYVKVWO+/CWY+OyAMUq9tLMxbrUMkWUxoHK0:8x5aayeq9tLSbrHS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694337085, "uuid": "c598b9d0-fd7d-4de6-8a73-4a3ae6e37bd7", "value": 1504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694337085, "uuid": "d2e55415-ad89-4bfc-b168-0474b1434e24", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337085, "uuid": "ee4bc55b-e25a-4593-8ed5-f85b0da28275", "value": "IRS_GOV_clcik_on_file_2023.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c38bce-4f83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1694313565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313565, "uuid": "c8f41fc4-65bc-4ccd-b94a-3aa36e16e63b", "comment": "Malware payload (CobaltStrike)", "value": "43e176e16444079c82e2446f0870d1e1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313565, "uuid": "149ce775-ea06-45e9-b2bd-17a20f7b542a", "comment": "Malware payload (CobaltStrike)", "value": "27fb95086df3f2a22f6e34a746bb1f15d882936e2f6dea770bfd76bb1fc0423e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313565, "uuid": "8239cebe-7004-47be-bdd4-99ac18635b74", "comment": "Malware payload (CobaltStrike)", "value": "d8374212293dfec2c267848d1cf620d8142035fd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313565, "uuid": "917c0d68-c534-40c2-aa2b-31a5f49ac05f", "comment": "Malware payload (CobaltStrike)", "value": "56765275857c2fe8c15a99676215edbcad2893022a4a9e270b457fa3d1ba9384db7de6ab3182a197f2fed0ebdf5b9ee4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313565, "uuid": "6e9b01c3-315c-42db-b5f5-2149211b4aba", "value": "T153B58B47BC8424B6D9EA92328AB512917B30BC580B3137C73A55B3BD2E73BD85E35394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313565, "uuid": "bcec0413-e05b-4378-94f8-6fcfbebf1906", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313565, "uuid": "6284728e-cd77-447b-9319-72b1834e96fa", "value": "49152:eMn6jRfJ3c1m8Sg2rgNF2b1D6KiMWFUIiJ:Tu3cFLvFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694313565, "uuid": "50bb699d-effe-4923-8d74-a91303ae21d8", "value": 2281536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694313565, "uuid": "2831c589-42d7-448b-b5bb-2f5c95f6f3d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313565, "uuid": "08b49652-b437-4ff6-8d90-933d2f052e48", "value": "43e176e16444079c82e2446f0870d1e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f758ab-5035-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694390019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694390019, "uuid": "dd19e971-a500-4176-9506-57648be06640", "comment": "Malware payload", "value": "83ac976bad443e25d5c1e54092e348b7", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694390019, "uuid": "d2b80faf-868a-4273-9bc6-b1d424005246", "comment": "Malware payload", "value": "28ad206b8c48e0674b923e6a4077ca48ef1f385e7f741efd28b6445fe5cac39a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694390019, "uuid": "481bab9d-b7ae-44df-96c2-f5e4fa74a47b", "comment": "Malware payload", "value": "c4651e714532b6467052bec9d06a507ea0bfa8ad", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694390019, "uuid": "633f36fc-6d6c-4a33-acbb-4796c3b84095", "comment": "Malware payload", "value": "7230ff2a1127d4c4603e93e1cc8611960b804c37174bb622dedb5ca2e80f928a8c7d9a1f0fd1a3f532cbe61733111203", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694390019, "uuid": "67790534-f492-4f41-a616-8cac4acee8df", "value": "T16EC4013E92AE8214CC5981BE1E7B93083232E985E4C1F55DFB899029CF2C65217E5FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694390019, "uuid": "c25bacc4-74a3-4e2b-833c-dcf86c55a62f", "value": "12288:YOPUz6ifIxrXnTbZMQQFQQeQQJQQZrJPd/0E6+iN1+TX2NCEebCFRw2S+AvA2Ege:d5iOrjFMQQFQQeQQJQQZrtd/V6+iN1II", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694390019, "uuid": "6c3a6c03-d95b-4d2c-865d-72dc868e53dc", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694390019, "uuid": "9fab8caa-8a29-4132-9c42-3a3c7f9beb04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694390019, "uuid": "d9904ed4-ce01-45ae-8e4d-f47031328f25", "value": "83ac976bad443e25d5c1e54092e348b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa39fc00-5017-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694377440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694377440, "uuid": "45db047f-96dc-4424-a539-cb31596d2560", "comment": "Malware payload", "value": "19a0528678360cb1c072541ad6a904db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694377440, "uuid": "e7292b27-29e9-4396-b6ae-72822d0aaa2c", "comment": "Malware payload", "value": "2987dc6ea8908c9e80ee5cd15ae4b91d15c48d1d31f7dbc79e01864475f33247", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694377440, "uuid": "f85e275d-eca5-48b9-a86d-172d05c4215f", "comment": "Malware payload", "value": "555001f79e1f704ca0911de60044132127bf179d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694377440, "uuid": "4b5f7f2d-7c26-41dd-9179-e61886ed14ea", "comment": "Malware payload", "value": "c51ff5d528de74d21db49efee7807576f90612a3c0732a1354db31fefc84fd1733c7fd2795cad1590d759d2b543608ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694377440, "uuid": "2a873dc8-b07b-401c-84a5-b46e1420f2f4", "value": "T16D853303DB104871D186DAB0CE55D38D552BB8B42BB8692CB49C683F9F221DADC4DF6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694377440, "uuid": "523a67bb-6ed3-478c-836a-af914a58eafa", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694377440, "uuid": "7351d1f8-9382-4ce8-8266-2c0b8a222fd2", "value": "49152:w6ddhlgiruNuSWEdUnWYmNVWAl3ba0yTQwGKc8VbvfnpD:/d2irunL/YqVVh+hhGKc8Vb3pD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694377440, "uuid": "3e1ede34-ab7b-438a-a8db-b5e00daf5618", "value": 1734927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694377440, "uuid": "9b300335-eb3a-4e88-810f-b83565b3c821", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694377440, "uuid": "46147a3b-7254-4883-8245-1b8ee327237d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f82245c-4fba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694337318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337318, "uuid": "02a81c34-05ea-4ba0-9c9d-707d27e47d67", "comment": "Malware payload", "value": "695c089de337dbe521c914fa73e91281", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337318, "uuid": "dc090a51-998c-42fd-8d9a-7729972839e9", "comment": "Malware payload", "value": "2c580c4932d29d27834d46ae5139ecf230cf2a07b39f0bfff479d7db7ca36629", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337318, "uuid": "45d4b968-7f7c-4a05-820c-8eef5872b066", "comment": "Malware payload", "value": "0e39b6d9daa9cb5a2abc7d488a838eef64b86108", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337318, "uuid": "a3db1250-5187-4735-874a-e2eebc2f107c", "comment": "Malware payload", "value": "853203787e0b3ce2e5e254ac1814b7b67d1ed7452010681f6918c50621aa36a52d8fb56b187113007080862b84754764", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337318, "uuid": "dac02c84-2caa-43bc-b10c-1a5185b04cfb", "value": "T15E16187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337318, "uuid": "17a30262-a71b-4830-941c-72b470278c23", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337318, "uuid": "03db120d-eb15-4ca5-bca6-73a7a7ae26e3", "value": "49152:xgh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWTjXNO:da71f3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694337318, "uuid": "e373addc-ce97-4bfc-92fa-55ce0186c41c", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694337318, "uuid": "e8304c67-106e-406f-85b1-b7dd393c9ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337318, "uuid": "c479b60b-9475-4a14-98e0-6c6d5f6715e5", "value": "695c089de337dbe521c914fa73e91281.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72cef06-5028-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694384710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384710, "uuid": "5987aa4d-6abf-43d2-8e5d-d2dc6136c56c", "comment": "Malware payload (Amadey)", "value": "ef236ba0225bc29ab59553155e80ccf2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384710, "uuid": "73efd033-ba67-4f94-9024-17db203fbfd8", "comment": "Malware payload (Amadey)", "value": "2c8bd244edb14b9b5b52ab73e7e0c9042347bfaf4df70e9cdc15794f45d3212d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384710, "uuid": "fa3ae4db-0c60-4478-8c7e-a3fa4daf8ed7", "comment": "Malware payload (Amadey)", "value": "3ccb97481924568752a49faced07aeb5fe668b9c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384710, "uuid": "175d37a8-fa7d-4824-90e0-c534938f74a0", "comment": "Malware payload (Amadey)", "value": "ae21ec66c87d8515cb0db5a2a1871c877c937688b5a0a25840c871083bab8dd05a2e186dd5ad9a369268d83f5818a4df", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384710, "uuid": "ebea5cdc-3d9c-4ca4-bdfe-99148f732499", "value": "T111651214BCD1C8B6E472623205F0DBF6DB3CB1A40BA505BB63580BAE4BA47C0E775E65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384710, "uuid": "9e80ff58-db0f-441c-90bf-24dec042dea4", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384710, "uuid": "3685d0f8-1e1a-47bc-90b5-4e2e8b56cfa7", "value": "24576:oP4CJwW27UNZYGx78UJlIx91gOQvZ4nTHS77mVLCdTjtUecB8m70+u1Hg:64CJwWwU3r79zIx9oyTbsd3m9b761Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694384710, "uuid": "04f6cf0e-e2b7-445c-b7e3-1df8343e8c29", "value": 1472376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694384710, "uuid": "0ad0429f-dcc5-4be9-bd43-658f6d33e8a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384710, "uuid": "0c44ed6b-dc10-4544-a502-4b31709c6075", "value": "ef236ba0225bc29ab59553155e80ccf2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f7770e-5010-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694374192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374192, "uuid": "8cd27de3-3799-48aa-a949-b9bbbb01f7e7", "comment": "Malware payload", "value": "e52ef1f6efa8f51c077ffebc9e56b598", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374192, "uuid": "866725cb-b11c-4af6-9c50-c96f68db06ca", "comment": "Malware payload", "value": "2f53f658185eaa4ddcaf6e9ca529559a371b8720db09d53103cf6a9e9c0c3e2a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374192, "uuid": "1f6306ce-81c1-411d-aed8-6e7194e6b23e", "comment": "Malware payload", "value": "7351195d0cb21569a083dd70a68903766922be3d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374192, "uuid": "048ad064-d164-45f2-91b3-4cfd55213eb3", "comment": "Malware payload", "value": "4bcc5e9ee32b2c6f29bd8d449937af43139181dab85ad32ec76431bbf596248038a3754b492704ec647be00b2a8f2fd8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374192, "uuid": "c6ccb7a0-f39e-42b4-9ae8-51297d88c18d", "value": "T1FC951257FA52999BC9F6D33221B4133620374D18CB43F78B2A4837BE28BB9D847952C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374192, "uuid": "3c891e84-8f5f-4407-8269-7033ca009d7e", "value": "49152:F/fSP0vv9PJS4Zl0RVs63NyjeZ45BDXfJWRT764RAJnUesA6b:dq8vvqOoX3NyjjvDPW76n+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694374192, "uuid": "412a7b93-d31d-45aa-b97a-8312120155bf", "value": 1999598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694374192, "uuid": "928bebde-a58b-4f6e-b108-a59e7b18b848", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374192, "uuid": "07134bb4-99f5-4e22-b3fb-9305dc4cc1ec", "value": "Sahamman.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3359ad2-4f8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694319017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319017, "uuid": "6685e4f3-a93a-4f3b-9c44-53bedd739476", "comment": "Malware payload (Mirai)", "value": "9e38132884c1e2af92c19b5406989ce5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319017, "uuid": "9cbed767-a78d-4faf-a497-8f422c658047", "comment": "Malware payload (Mirai)", "value": "2fc418f3aced9fb4be44d7077868a7427f8fad814a41331b13e772343ef5bfd7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319017, "uuid": "1cec2874-2f11-4fb4-891a-fb82485e1b89", "comment": "Malware payload (Mirai)", "value": "5d363b8a1d838cd594c8a99129d221c26cf8bcba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319017, "uuid": "b83a0ea0-131b-4a36-b8e5-ad5dd453ddcd", "comment": "Malware payload (Mirai)", "value": "842ae87bf40f79867a6005dedd82c8ea30e4659434bfed3a569c737e08eb4075ea418bad9121835c001ba2a9d76f2d4f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319017, "uuid": "10418917-578f-4696-834b-ad13db902a23", "value": "T194F3C70AAF610EBBDCBFDD3702E9060139CCA55722A93B753674D528F50E54B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319017, "uuid": "afd77360-bce9-4bd8-8e9c-7c78a98b7f55", "value": "3072:wt80SR0Aq4zDeLZDWnu7rpv/eLMnO7W3:wsRVzDeAnWr1G4nx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694319017, "uuid": "0b312c7e-c598-468d-9afd-6f1818b50fdb", "value": 161512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694319017, "uuid": "4a35020e-8c8d-4ae4-849e-1c3fd09724ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319017, "uuid": "75ad0613-1e8f-49eb-8aa6-42f7ef37e71b", "value": "cundi.mpsl-20230910-0410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb54efd-4fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694355304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355304, "uuid": "c517424b-600f-43cc-8eed-2f0ab6fea98b", "comment": "Malware payload", "value": "9fad0be2d9d7c5dd318083aa6914df56", "object_relation": "md5", "Tag": [ { "name": "pw-222", "colour": "#6A7660", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355304, "uuid": "43f4ea45-739a-489a-8f01-cf605dc021a8", "comment": "Malware payload", "value": "31171744ed11423d6e4b9bafbd93920b77cb17a69c79917eda1389725c9b45b7", "object_relation": "sha256", "Tag": [ { "name": "pw-222", "colour": "#6A7660", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355304, "uuid": "f04724a2-760b-435e-ba61-600b6bfea705", "comment": "Malware payload", "value": "77030f6b4b9d22bc829f5a8ff8a0bcabf83baa70", "object_relation": "sha1", "Tag": [ { "name": "pw-222", "colour": "#6A7660", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355304, "uuid": "c0d8b812-9c47-4555-8b6b-9113c47b1bc5", "comment": "Malware payload", "value": "bc146228fb4bcf46745c6653068a4274f5ade77538c93ad04ad14958665a345def0e0ef5069c2ef417b67d17667d4cba", "object_relation": "sha3-384", "Tag": [ { "name": "pw-222", "colour": "#6A7660", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355304, "uuid": "6e5e958c-34af-469d-a53a-9a6ec07efc32", "value": "T11AA5332722D4B3779412703C668B627A09E4B728519EDF746E32B6403C72844FDDBAB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355304, "uuid": "c23e0b13-a038-4097-bd3b-920f7c7eaeef", "value": "49152:7z5xAMvXOZhGOdO/eHN+2KMwpbC0+PiXvrkCDkCJB6yJdbmO:7VxAMv+ZhGOdO/i+2epuwfjoCJA0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694355304, "uuid": "44180de0-7e84-4c37-8bc5-ed1a8ed74534", "value": 2083133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694355304, "uuid": "6dd92520-1e10-4c55-a2d6-0a62a4f0e1b6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355304, "uuid": "913dddf8-d429-4f6f-9731-806b1f7c48f0", "value": "Ads Manager Trial.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ddcde0-5010-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1694374286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374286, "uuid": "f82efc77-dde0-4f10-b4b1-300995e924f9", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "b019e2348f3e06cc27f5e05f499c7a71", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374286, "uuid": "52b8be11-9f75-479e-ad1a-bc4668f4ed49", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "3222778fd2f0717284dedbbda7298abf17105881147832e7a1cdbddc24747b0a", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374286, "uuid": "f85c01a5-1d70-4394-b2b8-5f086ac601db", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "d7a2ffc3dcb2f9482a7b1f0f86220a1ec02215de", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374286, "uuid": "eab22d57-36cb-43cd-8d55-c79b8966f9f6", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "7ecf658b788bfb5f17d9ff2c5e3d1b840e4be1a12d63539a5daa11a5445c1946dac7befc8f792ea2e62b70365b0418cd", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374286, "uuid": "fa5e5496-3ca8-4e0d-bba2-f09473fb9c6c", "value": "T185853314EAA7B9B8C3B273B92E0BBB0C1B223C42657D014C9BBD5D8B6F39154644677C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374286, "uuid": "9742cde3-14f7-4b7f-91e5-f11048015427", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374286, "uuid": "db9be745-71a9-4ac7-ba76-58940605f8f7", "value": "49152:26duXv7xsfCumMCGKj9xAAlWrIknZEaeVbvfnpD:tduf7OKJMRKByGWrDnZPeVb3pD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694374286, "uuid": "c803d62f-0500-4ac9-916b-3f38b0d6765a", "value": 1727702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694374286, "uuid": "4eb7481e-f3e4-4e82-989f-8077f223f5e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374286, "uuid": "d8427a5d-2984-4842-a3b6-4b2dc411a15a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3b77e6-4fd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694347597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347597, "uuid": "bfee89c4-4571-46f9-b61e-198b46d4b51e", "comment": "Malware payload (Mirai)", "value": "0056d7043c0e1720ab40004561f2eeec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347597, "uuid": "83abcedb-3597-4a55-94cf-328bbb3fb6d0", "comment": "Malware payload (Mirai)", "value": "33ebd1a8d339575218295c86ad987339a7e6a7a39aa9702fa5afce922c6c17dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347597, "uuid": "6e049825-183a-4eca-92ac-403373b1a4fe", "comment": "Malware payload (Mirai)", "value": "2f999dbfe3ad59cee79ab1d72cbab21adc287976", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347597, "uuid": "81726828-4d1c-4386-8dc7-cf5b7fd7710d", "comment": "Malware payload (Mirai)", "value": "629ff010ee095ad7dda9fe1c6d5726f38d5f6f99e9af600bd2974be940a08534d99dbd4cfbca6346e5ddb28b48259543", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347597, "uuid": "f0be6349-fd31-49ba-9561-a73e0c1e0f57", "value": "T1C8B3F845F8509B17C6C222B7FB4E428D7B2A1768D3EE72039D256F65378B85B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347597, "uuid": "e3424251-1769-4281-a5d5-8937dabba030", "value": "1536:EhEOK0zZBFi19AJVm4VemhTTrNkCUyMj1b9tIL0l0XwywqFWiJi1hI7GW3OTRrP:EhRfQ19l4Fh/rNkCAb9iwjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694347597, "uuid": "9773c4c4-b2a8-4d53-a87a-6e1b06d9e354", "value": 117504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694347597, "uuid": "279448e4-9c95-4ddb-b0e4-6a8703268241", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347597, "uuid": "4fac9853-a6b0-429f-be1f-7804e9fafe5b", "value": "cundi.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c1ea7a-4fa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Neshta)", "timestamp": 1694326432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326432, "uuid": "709694c7-3716-48ed-816a-26daeb8a4e9b", "comment": "Malware payload (Neshta)", "value": "e5c5493bf415291c5089f1ab40bfb2a4", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326432, "uuid": "571149fb-162a-4b3c-be53-ad0659d49259", "comment": "Malware payload (Neshta)", "value": "3415d2ed848d6a3e9ce8d94b41182628b029a4c5c40c362984d39b4ce3e31a1d", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326432, "uuid": "1118f756-22ee-4a90-a579-7c1c5bee5e8f", "comment": "Malware payload (Neshta)", "value": "33a9b46fb401b8b82f054c940193c42d96deafcc", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326432, "uuid": "2f17dcdb-c0f8-4528-af8b-2b52eafb5998", "comment": "Malware payload (Neshta)", "value": "d50ae1ce89b7d17ae24d9cb4fad925f1137be6cef2e6253f205066e7822efe9b88190e4430b0e9553d5ad52908cddd53", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694326432, "uuid": "a48e4450-b5e6-463f-a414-86c208070c7a", "value": "T19F4512431F084B66E0A953F466794525CBB0B5AF387EE75E78CC57C327DB3821602AA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694326432, "uuid": "c505e752-ca10-4683-9686-2c5d4a998de7", "value": "24576:A/X55k4FGjYc4Y+1pHiJiCmqWlkqWfUo:A/pnG0VzDixIkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694326432, "uuid": "0907fa01-1248-4901-b8ad-f194074c365e", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694326432, "uuid": "749cd8b0-3991-41e1-9804-1614567aaaf2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694326432, "uuid": "d7c1a861-4051-46e7-b098-e5f5f51c696c", "value": "Statement Of Account View Image.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7daa95c1-4ff9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694364346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694364346, "uuid": "d21fa835-7452-4b7e-96af-5c07f7eb3545", "comment": "Malware payload (RemcosRAT)", "value": "1f7a5c088bf10f7e49069631936ba11f", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694364346, "uuid": "333fa44b-544c-4287-82e4-2bdd1f4e62a7", "comment": "Malware payload (RemcosRAT)", "value": "35ea9ba31a80ddea85ddfbd1bdd80cc197bada7131b1e311f44dea9594b4e8f4", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694364346, "uuid": "7ba84126-83ee-416a-971a-2f72b9bf7a56", "comment": "Malware payload (RemcosRAT)", "value": "a00fb00d0d4bb6afb1617a4b9bff055a87814826", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694364346, "uuid": "78183414-9c4c-43f8-9571-37ec0cacd434", "comment": "Malware payload (RemcosRAT)", "value": "fa73db26d79d058a07bd5a66f41d98e6b114baa189f8c1f8442eca891fe8925528020995479ebf162e44844a77990c61", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694364346, "uuid": "44375224-e3e1-4cb1-9be3-58c28b70d816", "value": "T15CB423484AC22CAE01ECC155C213728FBC515AD0FFA1BE93BE19D96E361167D2F24E76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694364346, "uuid": "0026f44b-ac9c-464e-8c73-172cb9f82373", "value": "12288:hhPglhun4XVm6e1piEiDcsNpGHYJiadKZ/E+49/yU5G9Ow:fPiVBesBoAirG15G9Ow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694364346, "uuid": "dcb8f1d8-c011-47c6-b0a1-9f8248de57b8", "value": 518499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694364346, "uuid": "5acc7301-4249-4fcb-86f1-0f8fc3788152", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694364346, "uuid": "4f71a80c-d13f-4476-89d7-7f99a189157d", "value": "Credit_Details1983165205090023.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c871f6-4fd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694347559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347559, "uuid": "85292654-8062-4e19-a5ac-3a43f939e931", "comment": "Malware payload (Mirai)", "value": "3899c990569288395a6c6b4d60bde2dd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347559, "uuid": "871b2af1-e0be-4fcf-8962-327748834aac", "comment": "Malware payload (Mirai)", "value": "3704a6614b9315e9eaf911d3e6e3d107c97985a2615de6f77ba952fea8d9b5a3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347559, "uuid": "4e794973-56a3-4853-988f-90a1f20b9e64", "comment": "Malware payload (Mirai)", "value": "c641b829f5285434318864b8922598fc7197e41b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347559, "uuid": "2e884050-3230-40f1-823b-c01533ce4f79", "comment": "Malware payload (Mirai)", "value": "1cdfce4abcab54a3d98baf8583910209aade54aa906720c8a24db9fbbd85a928b0127a67c122fd3a3e06da537d5263d8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347559, "uuid": "573ce09f-e962-4460-ae47-911c054687e7", "value": "T155F31A46EB408B13C0962BB5FADF425133239B5497EB7305A528ABF43F8679E4F23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347559, "uuid": "70daa0f4-62af-4459-b1f8-15687c9dae37", "value": "3072:21+G9iNG1k3aE7KGO8zLmN8y3P6o/szDDohM/RAp26Q5:+9iMm3aE7KG3zipyo/cshM/Rt6Q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694347559, "uuid": "a0acd7c8-880e-4523-b734-7cd41e7564b1", "value": 168108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694347559, "uuid": "a0ca201f-a75d-4507-8d7e-ef86f0936687", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347559, "uuid": "c9393ef7-a136-4eb4-bd97-aa6b6dc0a91b", "value": "cundi.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516624dd-5023-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694382311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694382311, "uuid": "da1d914a-41c0-4c8b-851a-c3f32fbe27e1", "comment": "Malware payload (Amadey)", "value": "d11f94ee799fb309a66897c03c283d59", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694382311, "uuid": "7688ef93-2ac7-4977-a436-9f016fb65556", "comment": "Malware payload (Amadey)", "value": "374009053f8b456f596abbcc512fd5ae7834e24397a3fc725213d2d6e401952a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694382311, "uuid": "fae79559-51f5-4b55-97b6-57353c306d15", "comment": "Malware payload (Amadey)", "value": "155aeda11ac7cfb3e98c93e711cdc325a2a835ec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694382311, "uuid": "fb99795b-7fee-4efe-9f11-24741a0bc603", "comment": "Malware payload (Amadey)", "value": "234e9f2a72c2bfbeb20e7540bf7a13898a5b93d294e966e7e9712b5cab5e920562320c640d622b8919d5495fe653c725", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694382311, "uuid": "829145b7-53b1-4510-a9e8-b7a6b6721736", "value": "T13665121034B194B3E03B783609FCA7764F397561A7525AEB1BE03FAF5A343A096B0716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694382311, "uuid": "65c2e9b4-09c0-498d-bdec-953061fb9bf5", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694382311, "uuid": "f2180b70-2f9b-42c6-ae29-28676f746c2f", "value": "24576:OL1CJDT0T5D53VJ198L5nPVonhKX5ZQsvsl79g1y3Qu1Hg:E1CJDT0T59Vn98lPV5pvryd1Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694382311, "uuid": "d7f4785a-b76b-4f3c-b034-73c8689dfe08", "value": 1471352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694382311, "uuid": "f65d5b54-44dd-4563-ac8f-820ba2b40b61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694382311, "uuid": "5e430cb4-038e-44ee-9036-a0d63724922c", "value": "d11f94ee799fb309a66897c03c283d59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712c87ec-5003-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694368620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368620, "uuid": "0b97a029-7f1f-4d83-a6b1-ae24cb93a182", "comment": "Malware payload (AgentTesla)", "value": "61a526efdae779fbf31a9691f58c5512", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368620, "uuid": "5df1eabd-cf70-4f94-a131-4056c43f795e", "comment": "Malware payload (AgentTesla)", "value": "37a05cec97778b51a5ca69fb06c90897b818db70d36100b7056c44f3d2a67343", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368620, "uuid": "8a877343-dfa2-4176-86d8-df7fa405c0bc", "comment": "Malware payload (AgentTesla)", "value": "2f1845d07f8f919d0e26591516f94addf44675b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368620, "uuid": "d306ce18-3782-4119-a7a4-3789fbcc23b7", "comment": "Malware payload (AgentTesla)", "value": "dd30bcf22b087e9ac287ba649500d1a927a7a2f756510dff084d177b734be8690d49be9f40944f0488a0ef60d7b67e03", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368620, "uuid": "19f66593-81b0-4977-8ef9-a0ecc1b427f2", "value": "T13DB4231B6373FD1109916969BD08BA8B812CC2502EEF81636AEFD1D16C72DF64535273", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368620, "uuid": "1c48b61f-7ce9-4dd9-96e2-b9c0e7c26c1c", "value": "6144:zaeaADWQwVdhChdl721qN11T8bbIYHIo2efg0PDVDDrXh7WFB0KDu6D9xFchCOJP:zaysVd71qNrTqbpHXI6RDrR709xl5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694368620, "uuid": "870bb855-ac4e-4076-a3d1-536cae7c8866", "value": 530909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694368620, "uuid": "7cffeddf-6ec4-4264-bd0f-de34fe7745b8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368620, "uuid": "8981cfd6-8e35-409a-8b02-095af6615f25", "value": "NEW ORDER INQUIRY-SGN30069320.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a5cadd-4f9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694325492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694325492, "uuid": "8d3e81e9-1506-4d48-9e78-4224fd8a3e33", "comment": "Malware payload", "value": "21449ac9ef7af36403825302548e404d", "object_relation": "md5", "Tag": [ { "name": "cdn-new-dwnl-site", "colour": "#B6CEBD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694325492, "uuid": "354d8e75-ad4c-4f23-be5f-21a7628108a2", "comment": "Malware payload", "value": "37c274b2ad637a4ce8f112ddd6977868d6962c451ab38e80640ec6d9ad679f13", "object_relation": "sha256", "Tag": [ { "name": "cdn-new-dwnl-site", "colour": "#B6CEBD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694325492, "uuid": "b1310f3d-4845-42c1-8a95-9fe301b7fe69", "comment": "Malware payload", "value": "972d76f68c415cd4058864bfbb409209d78c75bf", "object_relation": "sha1", "Tag": [ { "name": "cdn-new-dwnl-site", "colour": "#B6CEBD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694325492, "uuid": "d6536f7d-0445-48b7-9321-f371d96b2af8", "comment": "Malware payload", "value": "e3bcd77d5d9f4777bbaead794213d0ed9cff6e0cf145575397b5a8571df4fe9a9239eadd256129c4a5744674abb40a47", "object_relation": "sha3-384", "Tag": [ { "name": "cdn-new-dwnl-site", "colour": "#B6CEBD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694325492, "uuid": "5a57d7af-4132-46c9-aedc-0a7504bcc9f9", "value": "T1F831540BE10F43B5EBDA16D2F594690ED884584FA606B875B7E892D0AB260B1C34B04E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694325492, "uuid": "dde187b8-0b4e-4a81-9811-84db5e291303", "value": "48:fij+CtBxEjCY41Fc05GKWUEQWKlaVcmDt:fijN7QCYmcMGKfEQ6Pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694325492, "uuid": "1d4cfd3a-bf13-481f-a730-ffdfb164bec1", "value": 1729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694325492, "uuid": "2d8005b5-403c-4508-a32c-13390c02e04b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694325492, "uuid": "1ad9d064-1fb4-497b-b2d3-e192b7e6a9ba", "value": "shark.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50556bc-502f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694387713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387713, "uuid": "20bde54f-e2dc-4914-a0b0-5e01d54addfe", "comment": "Malware payload (Amadey)", "value": "4f6c15f8a13d0d408d84287ad23dd3b8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387713, "uuid": "ef34ea8a-a97a-4e91-acf2-7f9800454558", "comment": "Malware payload (Amadey)", "value": "37ef517ad91a44700971fea612ba8a63a1d2f4c373a2c92084e13803119270f9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387713, "uuid": "2723127a-2b85-469e-8233-7899cb1684f5", "comment": "Malware payload (Amadey)", "value": "9b2fce942f722f19446d8bc359b5f3a87ec0c511", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387713, "uuid": "a566cf37-3b2d-4ad1-8555-7ab9c1051fe4", "comment": "Malware payload (Amadey)", "value": "8b202de58f9706db8264e5c80d589d4a25713c4e6f7ea77c8f57a45b66fc99281a8e1c2fc20b92f330a4b0baf2201157", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387713, "uuid": "562b7ddb-9102-4484-974c-6ebb492b4b5f", "value": "T12065122070DDC735E2F215324EFCFF7546396CA00B1289DFA7A01BAE7B647D192A0966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387713, "uuid": "91f0fb83-e4d0-4860-a018-25250c60ca1e", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387713, "uuid": "3ae40b6a-8a75-4fe0-b0fc-f100b5a9a2f5", "value": "24576:/f0CJcf7SJScSVScSpr+S9tn+faVZPS5DBPN8DgnGzPNPSm5gvFm5aHdWwDJhTBl:n0CJU7SJScSVScSR+S914aVA5NN2gQJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694387713, "uuid": "ee47b322-07d9-496f-a9f0-0c1d4156cdf9", "value": 1471864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694387713, "uuid": "ef7e5390-a2b3-4314-8fa3-9a202c5c811f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387713, "uuid": "6f82d640-06fa-4706-90ea-a7bf47b180db", "value": "4f6c15f8a13d0d408d84287ad23dd3b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98bb8629-4f82-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694313282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313282, "uuid": "352d9554-9fa9-4514-8283-021f28c94159", "comment": "Malware payload (Mirai)", "value": "fd660a9216d614c18da0583a9d0de8f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313282, "uuid": "871e99c0-82af-46d1-97de-e364c222c567", "comment": "Malware payload (Mirai)", "value": "3971f179cda1eefa9cc71a6b138d07bbcfe982feb910f13e719b64eb2f847b37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313282, "uuid": "692b204a-bae6-4b0b-8e53-e4ecf19e3ae5", "comment": "Malware payload (Mirai)", "value": "c9ee853c6fcee5018349516bc84d21e5aa560dbe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313282, "uuid": "304e5302-b9b7-4cc9-9fd5-1b0403e6647b", "comment": "Malware payload (Mirai)", "value": "3a318d3e1a9ab2ff0321700b7255559877b63f1d6887819a8ef58dd7dc211026fa03b3f791585b0e46e0d547f614c6d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313282, "uuid": "0df38d2d-f9e6-428d-b943-8b3469d489ae", "value": "T144434B22A97A2E17C0D4B5BA21F74328F2F6631E25B8C71D7C720E8EFF1564026176B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313282, "uuid": "322c9f9d-cff9-40dd-b256-4ae13e4a0d79", "value": "768:fYoBV+q9SpUDcl4auN4PaFZezVX3/EDNyoQmtAtO+lNHRVR:fYWESSpUDcl4auN4CFZezVH/EJemtAdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694313282, "uuid": "f0a72f38-fc65-4621-96fc-5f3724d245db", "value": 58312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694313282, "uuid": "0044abc8-9661-4ab5-bf61-0c57b4dfaf57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313282, "uuid": "f5727390-1ced-4ed2-b618-a699e2be6b64", "value": "fd660a9216d614c18da0583a9d0de8f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0097b670-4f90-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1694319039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319039, "uuid": "af2e1c37-ced7-4f0d-b240-187bf924cecc", "comment": "Malware payload (Vidar)", "value": "c932efa508ef39e723186177a7a885f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319039, "uuid": "6262f281-4063-4bf7-9354-32e911d54475", "comment": "Malware payload (Vidar)", "value": "3a42cc7e2fe0b899116b5e8890d2865f53b29752a56c230caa55a5d02953faa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319039, "uuid": "9aad0d13-20b2-4522-b9cb-d5fda11d8e5c", "comment": "Malware payload (Vidar)", "value": "0b5e7caaff826936e2688424113f201ae82e9941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319039, "uuid": "45744d57-6962-46b1-8a0e-bfb336bcd2e1", "comment": "Malware payload (Vidar)", "value": "2316afe2a7ac063fd5c479409d0258df5d311b29e01722c1f1604b312b3f92e5008c721e1cd59bf6ebfdd0ac2a2a973d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319039, "uuid": "af3eb14b-7ae4-425b-b51d-330e0d9e7a2a", "value": "T14D25022137E0C472D6A34832CC82CBB29977B9309E75894BB7942B6DDF317D1D929B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319039, "uuid": "72bc4a37-2b88-45cb-bf23-c9067b2f01df", "value": "a248a167b096530a2f6241dbb2acf9fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319039, "uuid": "354ed6e1-5c90-4b33-ae1f-6e8f41c9930e", "value": "24576:pTHiqXUJXXHx1uOb/OWgiAJEvcDdXKZDNC1J8Am1:prDUJnHx1NjOW/AJE0dXKZDNKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694319039, "uuid": "6a8f7693-d4d1-485d-b68e-b4855917671d", "value": 975488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694319039, "uuid": "e5910697-73b4-4046-9552-86cfda047466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319039, "uuid": "6c367901-fb2c-4b47-b85b-ca62f4ac36ac", "value": "Information about the reservation.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d9bec6-4f8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694319028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319028, "uuid": "6fd9bf45-1687-47e0-9c71-705b3ef08893", "comment": "Malware payload (Mirai)", "value": "36c243340cfa524e11f42301e298fde6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319028, "uuid": "c1c8b699-7c0a-48d7-a346-c3f8f145593c", "comment": "Malware payload (Mirai)", "value": "3cec1e52144bac73b09c7e7f474c941fe5e47f27277b0366bcfd159847d2b0fc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319028, "uuid": "206de227-c108-408d-bd22-e169b1a32574", "comment": "Malware payload (Mirai)", "value": "892879e80d33d073033432b191e8e887a5c59e54", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319028, "uuid": "103afe9a-a624-4de1-ab7e-2db6bec5371b", "comment": "Malware payload (Mirai)", "value": "6831d82da1d6ae91506195ebb167db5ae025ef144cfce174ce0158a22406eff6b6575bb12ef8200ee8b5080800976d81", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319028, "uuid": "472e75e1-bf9a-420f-80ad-d9360ed3ef50", "value": "T157D3391775D1D4FDC8E9D5B44F9AA13AEA72B02C1238B16B27C4AE272E4EE305F1D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319028, "uuid": "de9b6bf7-7044-4504-863c-7c8b51adb28b", "value": "3072:PntXAN16wQ4MyuaogvXpmQ3xzJMAbl4x:PntXMjXZ9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694319028, "uuid": "98e35d6c-c1cc-42c7-91c4-606eaf08c1f3", "value": 131384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694319028, "uuid": "58a16849-2c3b-4912-a130-e007e97bac11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319028, "uuid": "f7bf8ed5-3418-4199-b601-beb8b2763f1a", "value": "cundi.x86_64-20230910-0410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a421ec6-4fbd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694338517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694338517, "uuid": "e40f0cd0-cbe2-413a-9ade-3bb06a459e7f", "comment": "Malware payload", "value": "a265b108c02971a92ab51b69576676fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694338517, "uuid": "3062e862-c508-4c44-a5e3-59f22090dcec", "comment": "Malware payload", "value": "42912275f9384a33dbc7bf9d4f5c256776ed89a0535013640ca509a04fe30b37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694338517, "uuid": "12d0bb6e-61cc-431c-a926-bde8701e5459", "comment": "Malware payload", "value": "3b5883c5e2f872b8ee4257db58fb4687485aa13e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694338517, "uuid": "fadfd2b8-5ef0-47ac-a4a8-41479d12c5a5", "comment": "Malware payload", "value": "133a981ee02d558516012bf4effcd6ad245a653a784cc7e8a78231cb16651638ad8a67612585fee52cd34fdd356fc38d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694338517, "uuid": "a8a406c0-150f-42fc-98b2-dc129559f7d7", "value": "T198C52342F6C086B2E0621833262A5B74F63CBD309B3589EF9794295DE9335D0A737763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694338517, "uuid": "872de429-86e8-41bb-bebc-d0737180d635", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694338517, "uuid": "9bf192e7-89a8-4ab4-8da4-88eef037622f", "value": "49152:HdgL20HMIGkoM9o0+ekEd/NVAzt4mOVyO061HtyloBp5/o2628621RSQP:HD0HMIGkoM9o0+ekEd2mo6ZtyGCZ28N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694338517, "uuid": "7470afa9-5e66-4101-81b5-0d34bf4d838e", "value": 2658692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694338517, "uuid": "7178718d-a7b6-4185-b4fa-fb302c4ee9ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694338517, "uuid": "f211bb36-c054-43b7-99ec-7155def31949", "value": "SecuriteInfo.com.Trojan.Uztuby.4.16177.7025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48ce8f7-4f80-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694312443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694312443, "uuid": "43570e7a-e004-4953-8890-ce7477eea96d", "comment": "Malware payload (Stealc)", "value": "35aa9f3afd14c7114b8f6104ae840b80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694312443, "uuid": "f1519662-8bc4-4e16-9805-9551ea00a7a3", "comment": "Malware payload (Stealc)", "value": "436df5626a5852dbc7e583a9539f55d068e65d9b6cd62b339c64dd2a87f4ad46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694312443, "uuid": "686da20f-ffb8-405e-9f3b-983771a923c7", "comment": "Malware payload (Stealc)", "value": "a1c843ba960a10023e53d89edf01ca745028e99f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694312443, "uuid": "04a846e8-0e05-45b5-867f-e96cb9cc08b7", "comment": "Malware payload (Stealc)", "value": "9bfca03870e6bd682873003aa0056ef16908ca4fab998e67fb9d0d05d88fc0dc98837b16d02f84d6070a3b04f53e9329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694312443, "uuid": "e18aa525-d1d9-4cbb-b8ef-2fb949069790", "value": "T17844AE1375E0BC73C66747304F2DAADC7B6EB8615E60434B27543E5E19386B2CA2B326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694312443, "uuid": "cd8e6dca-a3ef-4140-a810-8331c1ce6530", "value": "3681be0c4196dc1f0159e8326f6ce58b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694312443, "uuid": "914ccf23-115a-4d34-81d9-cb052be3885b", "value": "3072:JBJnfLOXUEGsJNijF7iPMX/DhupqM5aVmbycHRGxiN/oX2H:jpfLO4CNih7BwAmbaSwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694312443, "uuid": "84236f8c-fa89-4c08-8e90-94354e4ced9b", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694312443, "uuid": "88a030ed-f909-4db6-bb8a-12a284005eb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694312443, "uuid": "8eab9b53-f065-4b3b-835b-8f90109a32b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b66f9bd-4fe6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694356021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694356021, "uuid": "ff1dfa6d-9af7-479d-8215-2116c7eb19cd", "comment": "Malware payload", "value": "8e907c9833ee773ec37975c493b8b159", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694356021, "uuid": "93f12d3c-25d6-4245-bd91-62fdbeba4318", "comment": "Malware payload", "value": "4478d2f03a3223d84877b969498e72167855628b4c7b2c63617e3097f75626a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694356021, "uuid": "695341a4-f9fb-4fec-ba02-9d47d00831f9", "comment": "Malware payload", "value": "cde9cbcb6e27b79d74e34bb092683a85291f0335", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694356021, "uuid": "4692133c-9c89-43d1-a048-176f53eaaf74", "comment": "Malware payload", "value": "522384ac39f86e66b407f45db45c3f424bc2b2d570c4c872d63d3ece5c865e8b3b7ab807d37e4cc06129f258f6453aef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694356021, "uuid": "75a9a14a-784e-45b5-99cc-23a1b0ae7de8", "value": "T11B75AE11F8C08122EDD52C7B95ACF578451F94AD1B3ED5CB06FA17EEC2282E16A326C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694356021, "uuid": "3c4fc434-35b9-43f5-acae-0ae6fc1bd73b", "value": "e4946bca3cf74c7fc3c827baccb3d9fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694356021, "uuid": "0db31e75-845e-4995-bb4b-536d5dfae549", "value": "24576:qoek+9ZB7gFwZlFLQ51yRV6e/jInMINsR3aR:qoWB7gFwt3Q8InMI9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694356021, "uuid": "d92ac7ae-4625-49cf-8209-2be2bcf1223e", "value": 1689088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694356021, "uuid": "b88ca647-6336-48f8-b5a5-89485006ebf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694356021, "uuid": "6950a3c9-4368-4f0e-8822-4b39b59b5f8b", "value": "8e907c9833ee773ec37975c493b8b159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5809ee-4fb9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694337076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337076, "uuid": "5c23e678-6a3a-4677-aa8e-27783139875f", "comment": "Malware payload (AgentTesla)", "value": "2ef8baca1684c30a9058acd7aab69238", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337076, "uuid": "9b4979db-2d48-42a0-830f-3406208b5084", "comment": "Malware payload (AgentTesla)", "value": "44f1236de9be7944b5ee2b19a9b7cda3df8ca686954a464abd509916d54671b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337076, "uuid": "faa8a96c-557f-4d83-ab6d-a570729799da", "comment": "Malware payload (AgentTesla)", "value": "d9d7adbce422dd1eb368649fcc31fe91b179ae4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337076, "uuid": "3e128882-b36c-40d7-9267-3a003b47f556", "comment": "Malware payload (AgentTesla)", "value": "cb6ce3ece8e704ce6aa4d3a9ebf3d0da6e7464f05bccea00e72ca91348b569ae0b3344c094ad8c4967b4a84d0d4c3df0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337076, "uuid": "48701dcc-1d42-4fc4-900a-55bcc8f52c67", "value": "T1D4C412109F1D6188EAEB1FB26EF7D9259F37443225236922754EB0A5CC42F4E6603FD8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337076, "uuid": "ebc62bbb-cf4f-4941-850c-465f01126844", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337076, "uuid": "e7f70491-821c-423d-a02f-569519952298", "value": "12288:lWvKNM038gAOoZKNosjc9cxUtpVCl5mh:w9ZJ1sjetrCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694337076, "uuid": "75b43843-7e5f-47da-8969-57da58fc6598", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694337076, "uuid": "7c2e2ce9-ae24-4454-9b70-a521bee7c4e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337076, "uuid": "af27dfa6-7a96-4c69-8553-c251da9e59ef", "value": "Sat\u0131n alma sipari\u015fleri_20.09.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782ab327-5035-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694390107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694390107, "uuid": "3614fde5-2e09-4702-af77-d2136d7aef06", "comment": "Malware payload", "value": "a6c6da25ac005788224a81d37a570770", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694390107, "uuid": "f5f96b2c-da53-4175-aeb5-d8ac8de86f10", "comment": "Malware payload", "value": "46f017311939733df19371fde5e18d8bae8bdb9c5454a0e2029b2f6e6aaa9bcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694390107, "uuid": "4d4f0ef3-6a11-4c55-86cd-df6c9c5e3a42", "comment": "Malware payload", "value": "bd9c6198ba34554d669fecb6f1c1f70c70eec34f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694390107, "uuid": "b6756712-85e1-4c00-b7be-18e8d6bb5628", "comment": "Malware payload", "value": "0c8c1fe4cb8b3f3a23817373f4cf8a8287aba9f2aa3fc0e750c46c69ff75b134df0a2b881bfe8aad5c0bea3ccdb55552", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694390107, "uuid": "140cd108-78c6-4c40-a47f-b2113723238f", "value": "T11231E991AE261EC3F417D0BCDA282329A7A9D87030EE435708CCD83C6079084E99A219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694390107, "uuid": "24d10653-92a0-452c-857b-0ab6362aa539", "value": "24:A4iGbY48hNcHEHBiSvKwKNyzkoUWNBtoX6LAFlqUiC2Ly3kXj7uZGexHL2IktC:A4JY7UHEHBfvKw0yYoUM7Cbl4LLyif6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694390107, "uuid": "ea14dfd3-a809-4a29-b166-12ee89072300", "value": 1452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694390107, "uuid": "3cbfcba3-621e-4c6e-be83-07434df9b7b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694390107, "uuid": "14fd5aaa-01dd-4596-8e57-79972cbaec7d", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.15939.31108.21417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06b6419-5003-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694368834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368834, "uuid": "8b944e05-1201-4cb9-b350-b69d8190cb60", "comment": "Malware payload (AgentTesla)", "value": "ffcbfed66fe31c57f3dd73d202c96404", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368834, "uuid": "60b2a1fd-f312-41f4-8056-a7773b979585", "comment": "Malware payload (AgentTesla)", "value": "49975212d43717604ea95a681b05ac2f07c2f338450e7330cce736db945d5e1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368834, "uuid": "47ad21ad-0088-4b37-867a-21d6f5bdc5e7", "comment": "Malware payload (AgentTesla)", "value": "aade3cf5441990c446eceb7fda27ec267010f5ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368834, "uuid": "babfc415-6f9d-41d2-8bc8-84033d839639", "comment": "Malware payload (AgentTesla)", "value": "6262bfdcca1dc435da6564aadda3a5a3143f5078cbadc793b24aa6abc9781e04f83b06df42c9bb918ad0106cc05a95b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368834, "uuid": "f37cf7be-c80d-4aa5-99dd-497c437e4f4b", "value": "T16CE4334F4FC0C9DDA406C09C602973114A63DAEBBAC7747612B5B0E25C6E52D3A72E7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368834, "uuid": "ecf7983d-844f-4410-9a9d-ecaf18b8c047", "value": "12288:ek1KqL/HCoDYT+SVfDcEnTnS0MKnDA8eHdb93ZkId1pMuNVfj:ek1KqLaocTRDcEe0NDAfTphJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694368834, "uuid": "986038d0-14f5-4030-b498-76fe7bee3b29", "value": 671017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694368834, "uuid": "790e3262-47d3-4a32-8964-d7d51b47a7d1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368834, "uuid": "0413b505-0532-4099-94e1-1f6d0491ef3c", "value": "New Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a4bf62-4fed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694358989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358989, "uuid": "cb74351d-89ea-4c04-9bdd-a410c60f8b6c", "comment": "Malware payload", "value": "42fe9519768bef688b32f3ba42b322dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358989, "uuid": "68e41e14-7a82-461f-83b3-06c567f621b1", "comment": "Malware payload", "value": "4b556c1816c13581e8391b6db17a9c1b1541adb871a29885129883e85f23b41a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358989, "uuid": "54553652-157a-4b1d-a922-203b59c4eeb9", "comment": "Malware payload", "value": "f1ca7d9cdd1321aafa97cf8d4d9cda40b6cc7953", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358989, "uuid": "6161d5f8-9b40-4595-92fb-90734bb4451b", "comment": "Malware payload", "value": "5ee347837e0c3c5f0345161804c6159ad5205d22928a97a3fe4df9f2cf742456b0fde7fc033ee2f368893f5cbef7c5d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358989, "uuid": "237b783e-98f7-4138-bfc5-04552cf8b468", "value": "T1FAE31A45FD809F26C5D226BBFF4E428D772A1768D3EE720399255F20378B85B0E76242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358989, "uuid": "385472f7-6575-46e1-aee5-4a5db36249e2", "value": "1536:RpK1kyAhCOBHCrmQ9Bgib5OMETYMMNZmPxn9ZAD0TyT8djZ1faOZpU7EL7amlNf9:2kH/BHKN/F66NM/ZAEy4jLFyEvWxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694358989, "uuid": "7f8a3b86-dce7-42a9-a4a1-e28425f5b648", "value": 154336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694358989, "uuid": "93a20df6-1746-411e-93e1-b12dccac01b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358989, "uuid": "e150468b-a898-4209-852a-ed48419439c2", "value": "42fe9519768bef688b32f3ba42b322dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665dda3b-4fd3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694347986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347986, "uuid": "3c2e88bf-7d86-4517-b698-f0b03394f14c", "comment": "Malware payload (Mirai)", "value": "c505f12597378971f86524d5f47176a0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347986, "uuid": "38e8bc7e-4c34-4b14-ac92-0e616e3107d3", "comment": "Malware payload (Mirai)", "value": "4e2625520a9827c94a5718000ad4c7237e8cd85cc0447bf227640643df4bdd11", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347986, "uuid": "09944610-8aff-4e4c-9843-5d8860af9c85", "comment": "Malware payload (Mirai)", "value": "0e2236e56ea2aca45417e02744abe2234ab18d57", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347986, "uuid": "caef58f5-5b27-4343-8f69-c6c45b51f193", "comment": "Malware payload (Mirai)", "value": "189f68b65d6a88f087c44727885e9ee96ff31a53c16da10c260214a5c175d1a9d28f399190ce2034385db181020807df", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347986, "uuid": "0521b54f-a933-4da8-81a0-31d8c60a957e", "value": "T11BC32945FC508B27C6C252B7FB4E428D7B2A1758D2EE72039D256F61378B86B0E3B146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347986, "uuid": "1b639bc6-a35d-48fa-b023-63ff39c9325a", "value": "1536:4hEOKSsdaoA0F0AC7M4VeWJ/TZNYTFJ+Z3k8HlBOl/STwyweFnpYjke3to11KbO0:4hkNdF0y41llNYTFnili9otcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694347986, "uuid": "84c68f6e-2334-462c-82e2-b928844c7a8b", "value": 121600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694347986, "uuid": "bc00b6e5-f70a-4c7f-9638-7bf8fe9d8007", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347986, "uuid": "fe39ebe3-c956-4b1d-9879-c5750208662c", "value": "cundi.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115e3341-4fed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694359011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359011, "uuid": "74249bf9-fc47-4fb4-8a2f-d0f62c21cffe", "comment": "Malware payload", "value": "f635a6c314cc4f68d34339fc4248480a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359011, "uuid": "2c458a37-a19e-40c7-98a9-7b80832bb93c", "comment": "Malware payload", "value": "4e589892f95fe0035dbda7f3c189adee300dd94ee2de6bff873822f450080696", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359011, "uuid": "efe0ad6b-760c-4d01-9ba3-ec804013b54d", "comment": "Malware payload", "value": "6822b3f54027a954cbabda86c096e401f9d63620", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359011, "uuid": "d6224d1e-7f15-4638-8b21-5860cb7fa2fc", "comment": "Malware payload", "value": "27b808d6c8bcac7ccaebfa0a9c76e79599cae4689f178d4836dec09a208c19ce3165668bc690f8b889e8264806cba64e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359011, "uuid": "a86e5408-5d65-4cca-a803-f05239b4abc4", "value": "T14314961E6E228F7EF768873047B74E34A76923D627E1D684E1ACD1105F2039E541FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359011, "uuid": "03c96fd6-4513-4d63-ad0e-0a42610b3664", "value": "3072:kEyg+3Qi6O0pUjPyfj5FpsyRofgKRYwe1wvBLyJVDgZ:kEygK/X0pqyfphyf3e1SLyfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694359011, "uuid": "5302fdaf-12ad-4929-bc65-f252a21e346b", "value": 207480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694359011, "uuid": "24016011-0c14-4af0-9a1b-a1dc63e8cddc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359011, "uuid": "63c1a1d2-4ad3-4af1-a769-ea7776568133", "value": "f635a6c314cc4f68d34339fc4248480a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ae9f27-4fb1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1694333255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694333255, "uuid": "8ab159ce-83c6-429a-a61f-d34cc363302f", "comment": "Malware payload (LummaStealer)", "value": "6fdca44f96e65b377af9470ee76e4373", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694333255, "uuid": "e92cc548-bd6e-4e7e-a013-1ad86f825176", "comment": "Malware payload (LummaStealer)", "value": "510b19e6574cac935d07ee0daaeec1dcef77f75008ff5271ce1b29a0ba723407", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694333255, "uuid": "43202901-32bd-46e1-a682-e8eb1625b2d6", "comment": "Malware payload (LummaStealer)", "value": "b7c271f0cdb0e7e5def387c129e2d0b7be1d8dec", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694333255, "uuid": "30496708-d174-4be0-b1bf-984bf384a4ff", "comment": "Malware payload (LummaStealer)", "value": "513cd13f984eee078d05c60975b087d03fdc387a67e08b9d4ed122b277c92eda4d641313fb79605f584474e4d1009adb", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694333255, "uuid": "6dc1e937-bdc3-4141-b721-69209aa52354", "value": "T12D166C31324AC52FE96201B0192C9A9B552CBF760BB254CBB3DC2E7E1BB55C21736E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694333255, "uuid": "a3be1d3f-cd23-4bf2-8150-23803e8c960a", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694333255, "uuid": "3b5cfa39-41b8-43f0-a971-8e5f2e6ce19d", "value": "98304:D9iZasQra4ios7RjnRU4UApr2Y54eRRXvWcV7nM:oZa5+osNbxrkURX5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694333255, "uuid": "f5344f8f-9e4b-4881-9c95-8453204169ef", "value": 4313448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694333255, "uuid": "a3457e3d-eb0f-4e61-b9d6-3710a255cc08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694333255, "uuid": "2a11c3ff-91a6-4563-ad2c-ba187d5b238f", "value": "\u0421hr\u043em\u0435S\u0435tup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07460419-4fed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694358994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358994, "uuid": "717dc717-272c-4a4f-9bab-723ad1c122cc", "comment": "Malware payload", "value": "9b611e67e9d535b28dc7333a8a6b12af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358994, "uuid": "97f2f6fd-d636-424c-9cc9-af6173ccab10", "comment": "Malware payload", "value": "5356de50d524ed4ff2f4c815ee2e0d389542df51eda110feca31615e4aca7c31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358994, "uuid": "d7ddd4af-43c3-48e8-a452-53f08d807863", "comment": "Malware payload", "value": "6272c55ebf761e0a022a472380f95b4b6ee5cb79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358994, "uuid": "f01daca3-cdcd-4c0a-9270-e4a89a9aed8a", "comment": "Malware payload", "value": "171f8fff86f724d583f25f00d4a0f4ba8d11c843dbec04351e5bb64fd5d191c63ffcb727bc5204475d3472a685fcd34d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358994, "uuid": "2ee35900-bb6a-44b2-90fc-0a5cba84ad0b", "value": "T136334BC4F683D4F6FC1621751167F7368673E92E6039F9C3C7AAE67AB813601962620C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358994, "uuid": "e462dbd2-3d8f-4856-b44a-c791e0741b1f", "value": "768:Oc3oxY+tdHRj/se1eY1cXrbq2JXp61ooA6gIWde55pvJx7o+D+pvG/:V3YpttRj0eY4cXPXXWi6lWU55pvXhKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694358994, "uuid": "4244449a-986f-4183-944c-5878ba57d9d3", "value": 54472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694358994, "uuid": "a55e0055-308e-4c9d-a5cf-98635ad65c90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358994, "uuid": "19346ff0-4b6b-4c90-b350-5a8f59ed91c3", "value": "9b611e67e9d535b28dc7333a8a6b12af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e8060d-4f7e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694311502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694311502, "uuid": "d6a4df2e-ca20-420b-8a63-ba0e78251038", "comment": "Malware payload (RedLineStealer)", "value": "042f4855e38d3a402b7427bcf03dfb53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694311502, "uuid": "35d3cebe-9e61-4a7b-a586-e6d939faf71a", "comment": "Malware payload (RedLineStealer)", "value": "540aaf6ba4135b85b6aa37a66e28b69038e992cd6a92624058177b697b32e15c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694311502, "uuid": "beffe8ae-5dba-4720-978a-f4edf3e2443b", "comment": "Malware payload (RedLineStealer)", "value": "03543e0ce76a4e916562561765e88faff5a48ee0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694311502, "uuid": "1b3506c3-4bc3-484d-b2de-6dd6e4f26afa", "comment": "Malware payload (RedLineStealer)", "value": "4c02a45eb2d9a93655d00772271a9bd1b46fe38f509dce3092543739b152ce353975c773c5b2ac9cb5c6a25aed7057a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694311502, "uuid": "27f6b491-748b-478a-89c2-d72585171f49", "value": "T13E94DF1364E0BC62C65643330F2D9AEC3B6EB75D3E60476727161EDA9D302B1C62B726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694311502, "uuid": "03b1ee98-2998-4845-89e7-d6b476cc223f", "value": "3681be0c4196dc1f0159e8326f6ce58b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694311502, "uuid": "c97476e2-75d5-401e-ad1d-a42586dfb175", "value": "6144:QsFBLwZnmQuSPN/tJxQXDZImSiy6SJktgcXvbqm6ascr:QoMZnmQNNl0XDc+t9vbqBaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694311502, "uuid": "4506c5ac-49fd-4fe6-a207-c49750e3b4ec", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694311502, "uuid": "10eeb8ab-3cdf-4647-b5ea-9a48af37172a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694311502, "uuid": "14389a13-bafd-4974-abde-3cb67afd464d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62e5563-4f71-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694306030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694306030, "uuid": "2d4feb71-370c-4ada-9a5f-b7a9b58bb70e", "comment": "Malware payload", "value": "93b4195d3839b911f07d0709975e8559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694306030, "uuid": "32da2ba9-adf3-4373-8c72-b68014e65df3", "comment": "Malware payload", "value": "54bbd40de4ec726d5a76d82a9ae961a72e5939b2c7aac5544f6ecfab4e0bf729", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694306030, "uuid": "47f959c4-cc47-4ce4-8e66-67dbe810dc35", "comment": "Malware payload", "value": "ccd22a913943291beadcf5d8fa20ef2f0f4eaa65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694306030, "uuid": "30331aae-b864-4788-adb2-0e065dc9a94f", "comment": "Malware payload", "value": "496d6a17a4d200cf8e7ea115cf0c90d6a7a793dfc2512f79be82eb60351930e60e737d0c6f56be293c5644426d3d2387", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694306030, "uuid": "de1f3f2a-05ec-4449-a2c4-93edd185cdd3", "value": "T18FC52381F6C58AB1E5622A33196C6B10373C7C7016768DDB63E8356EDC272C0E736B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694306030, "uuid": "d888b84e-53a8-4c53-ae42-b2f54de2f2ca", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694306030, "uuid": "9a1cb33b-1bdb-4737-bb42-b5b59413577c", "value": "49152:nILNTuGJwqIVQvaZFQKZf6oU/v2UnG7dZHkFfo37POBnYDtp3YOD/:nmLIe2FHb5UWzH6sCytZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694306030, "uuid": "cda1f92f-da7c-49b7-ae88-b16084c10a61", "value": 2524889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694306030, "uuid": "0c9025ad-b964-4244-9e9d-9b296b8a828a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694306030, "uuid": "7168522c-96a2-4f80-a17c-f6a3ced0752b", "value": "SecuriteInfo.com.Win32.InjectorX-gen.25488.2516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28255324-4fb9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1694336715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694336715, "uuid": "b626a208-05d2-4494-a1f6-e3a9a6e76451", "comment": "Malware payload (Vidar)", "value": "5ff57d39f6e6521ebc9afc11b4e6a61f", "object_relation": "md5", "Tag": [ { "name": "116-203-75-210", "colour": "#488E1C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694336715, "uuid": "d8379339-8fae-403a-9a37-3dc6e54d6671", "comment": "Malware payload (Vidar)", "value": "551224b64adf039d7568f3a67e4d74f9a27ee358bd0e44d9f0d66b4d96588202", "object_relation": "sha256", "Tag": [ { "name": "116-203-75-210", "colour": "#488E1C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694336715, "uuid": "cf4db6e9-b58c-4fcc-b875-59d24a2e2032", "comment": "Malware payload (Vidar)", "value": "79ecc401b91fb9c9aebeb35875ec21d991aeca38", "object_relation": "sha1", "Tag": [ { "name": "116-203-75-210", "colour": "#488E1C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694336715, "uuid": "2f40676d-46a4-4780-a043-1321bbec0d54", "comment": "Malware payload (Vidar)", "value": "d1c5784e3f09a3e495853cdb4c718e961b7c60e620bf2ccd2e5965f693c4397bbf6f1b247a3b896d5cccd89f994bd946", "object_relation": "sha3-384", "Tag": [ { "name": "116-203-75-210", "colour": "#488E1C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694336715, "uuid": "70b375f1-ae5e-4c30-8571-29dcb4166e70", "value": "T1D6560266E71D1456EA0F63FF10A92161FE62821C42D5BC8F7EEC494CD8C9F984787B28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694336715, "uuid": "2d1abf31-5180-4e1b-ad4e-46df1ede4db4", "value": "98304:07R8sNqCTAh8N2nX/YrD5/CiLgElczCJfsiON4vhtOJKq1qz5N6se71+8a:K9NqCEyS05/C29SiO2KJW1o71ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694336715, "uuid": "1231649d-8b6b-493c-aee8-69736de57c27", "value": 6155688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694336715, "uuid": "f65f30ec-29dd-467e-a5e6-81ca24727904", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694336715, "uuid": "49bef9ec-4174-4723-ac09-1e8e8b99bd00", "value": "Augmented_Hostel_Informations.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a5b186-4f8b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694317011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694317011, "uuid": "5372c954-317f-40ad-8c76-e77a5eeff810", "comment": "Malware payload", "value": "06992e9b14eaf0dabadf6ee124c9c3a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694317011, "uuid": "57506237-36e8-46a3-80af-648d4789ea17", "comment": "Malware payload", "value": "58c82524744c8505e93358653d4e74c0f5079cc14fa0b68a175b6b8feab30bc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694317011, "uuid": "56d1b949-e3ae-4594-a443-863732abef19", "comment": "Malware payload", "value": "07f6b41f93125c673ed79aa1d131a20a63eb61a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694317011, "uuid": "b850ead0-5abc-47ac-a6a3-84b06f0e2bf7", "comment": "Malware payload", "value": "cd7279c11285986f0a42af9403adbfd27168138d926b5adf9e5f0af484c6c61ad2dd70f704c0cfdac9071aebfd42d00e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694317011, "uuid": "f693e5b2-0a26-4385-b6d7-28ecd29fed75", "value": "T194C52303B9C085F3D06225325E2D2B50A635BD20AF3BCEFBA394BD5D8D321D0952A767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694317011, "uuid": "098e395b-1443-4d2b-a44c-b08c334e4c46", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694317011, "uuid": "daf721ee-0663-403b-ac40-21c62900ef9d", "value": "49152:rLLBtuoP29RO2WDMPxP0XSB+d0NBcZivi4RY/ErGM/HudcyHJnKqXVa7ReI:rZFMc2WsxmWzcQWidHccypKlRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694317011, "uuid": "d9c56c67-f55e-41c7-bba7-10350fb7fa96", "value": 2688227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694317011, "uuid": "af251829-a3db-4608-9d31-496245bd5ef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694317011, "uuid": "df6c11a0-7d25-4f43-acf5-ddabb9532799", "value": "SecuriteInfo.com.Win32.InjectorX-gen.31419.11518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb1ec3c-4fbf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694339573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339573, "uuid": "888cd329-b253-4797-8617-3eb9229fadd9", "comment": "Malware payload", "value": "ed013a65f9f2184b59cfa41e7e4b3dba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "titanaquaplus-xyz", "colour": "#786C32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339573, "uuid": "f220350f-8b69-4ce2-a39a-9ff4bd86af82", "comment": "Malware payload", "value": "59692df75cd335b1fa5026307c90367db2a8f2bb96503857784135597a1bc4dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "titanaquaplus-xyz", "colour": "#786C32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339573, "uuid": "31ccc760-cdd4-4c17-98e9-8b1404368a0b", "comment": "Malware payload", "value": "03554252ed7f31b9ddc473ec780fc0ef1674cdd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "titanaquaplus-xyz", "colour": "#786C32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339573, "uuid": "c529a820-711a-4c2b-ae51-f2c6d6b939e9", "comment": "Malware payload", "value": "6cad89122315536a68df90e3f9206369f89947ee456a72cb072b29d4503016b2fceaa01909714da5359067ce381c7374", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "titanaquaplus-xyz", "colour": "#786C32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339573, "uuid": "29859d3f-0de7-4898-8fd8-515218465d2e", "value": "T15D549E45B3A910F8E1B38278CC510645E673B8191B65A69F13E0477A9F336D0AE3FF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339573, "uuid": "10558170-9b4c-44c9-9c2b-cc29d747529d", "value": "8a8dbe6ecfacdaceac22d14c24917858", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339573, "uuid": "aeaa9760-0427-459a-b7ab-622bdc2544cc", "value": "6144:cV+4tt25MIRakGNhYPu2p3QuvakzErQ9cQfCj:S25MIkkGNwPWSahrQ9cQfCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694339573, "uuid": "f077cb86-bd16-404e-83cd-3083e433f51e", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694339573, "uuid": "f7663285-bd87-4e58-84c2-90d90a509363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339573, "uuid": "284f8e8c-2b09-4913-8247-bf01783ff5a7", "value": "filex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870273a5-4fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694336445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694336445, "uuid": "b696c59d-98eb-4820-856b-97b77df74806", "comment": "Malware payload (Smoke Loader)", "value": "cc86b034549ae055fc8d778fe39c1549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694336445, "uuid": "4bf073ee-e3c6-4b21-bd65-4defd165691e", "comment": "Malware payload (Smoke Loader)", "value": "5b0a948e001b9578721e1750b85a1ad72b01e262cf24f6fee578a57dcb684547", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694336445, "uuid": "e4a80a80-7520-4963-8d0b-525852354e08", "comment": "Malware payload (Smoke Loader)", "value": "7ad52cf3eb54a907c906e5cb428b2b79ca85f9c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694336445, "uuid": "6abbcfdc-bafd-483c-bd81-89e924f334a0", "comment": "Malware payload (Smoke Loader)", "value": "ec2bb52df4b6a86ca2d415f8a466f2726ebfac11f6283f31796492a63aea93d7434b80c9ee00fb03cf2b805e2906e2df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694336445, "uuid": "fa3ef142-a9b0-463d-abd0-4cc2b7e5357a", "value": "T1D8348C1365E0BC72D66707344F2EAAEC3B6EB8515E204757365C3E6E1B302B1C62B326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694336445, "uuid": "4e449ebf-0162-48e4-958a-25401f64d99f", "value": "cda48ebb1fe57d9b31da3a94fc154bf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694336445, "uuid": "7b3ba30f-1167-4476-ab7a-b2bc822816b1", "value": "3072:VjGDNkILk8KjYWVOYO/U0+OTCog9A6J8BE6Gy7BK2He3ypiwVJ6lbwVHZ53G+h:xGDNJL+Y/vjnHbGuFayp9lzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694336445, "uuid": "6b2f289b-9e89-40a8-a156-7d8242ad853b", "value": 248320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694336445, "uuid": "9fbed51a-626f-4bda-ad07-fd879af67af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694336445, "uuid": "81b7730d-ce17-4f65-aad7-01dc1a1de2a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7718878-4f7f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1694312125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694312125, "uuid": "526199e7-9b44-4c47-be4e-ea46a4ebec59", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "e41619d47436954cde5ca2bbbe3b0b37", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694312125, "uuid": "5f5b30f4-b4b4-4368-a6c7-5d086bb0b608", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "5b3b41fcfe12f7bf5f933d8dbd5d881a3c5391ffb0a71fc313ac456afe8d7510", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694312125, "uuid": "00ac30a1-da1d-463e-9239-89268ab0172e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "b9e805b3eb085c826c7698f61a47586def8c2b51", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694312125, "uuid": "b9b46549-48aa-4681-a6af-6a472d698aa1", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "b439f7acaee0faefc23d081026fcd83bc8df932e3bce79ee4e3a95c16f080347cd8233b92e120e1f618d60c26139c3c6", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694312125, "uuid": "5bc3dc4a-1b2e-4b62-a5ff-7e4ddcf5fca7", "value": "T1335533216A42D4F6F173DDB89C35C480E96A7E393028245C7ECF482F6F6B189C198B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694312125, "uuid": "4a311881-1001-41ff-8293-4b0290bcc4f3", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694312125, "uuid": "f630e688-2f43-4fda-a2ef-7a20b471bffd", "value": "24576:VI39dbs+ImwiLtTw+5+KUsXQSA6g3j9Vf16kX1KN2fYvhs3s7xQ0LoNsXZNBDRGp:V6db9HLFZ5+kXhA6g3zkkXw2A689C+Xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694312125, "uuid": "6b19863e-4986-437c-9c64-23098e28af3d", "value": 1361742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694312125, "uuid": "649773b4-18b1-49bb-931b-ce6bb78b533a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694312125, "uuid": "76c0920a-b749-4be5-88b4-19bc4fe174ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6118b65c-5010-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694374177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374177, "uuid": "bc876a8b-6329-4853-990f-8aba1ad86c2e", "comment": "Malware payload", "value": "bc1a3956fce5dcdb88b09c3b80c1fd77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374177, "uuid": "1e58887a-7e67-4ef3-95cf-d02888e46005", "comment": "Malware payload", "value": "5b9381b7cd3ba1a77c441b0b0531b468b48b17cf72f4b0e3c3a084aef15ffdf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374177, "uuid": "0272d778-f769-41d8-8f08-59d1bf526b69", "comment": "Malware payload", "value": "da3866a5038b3e3a5c688fb7d42fe67e25dc9707", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374177, "uuid": "8806b6d9-07e5-4b1e-a7e7-f86b81578841", "comment": "Malware payload", "value": "a4465c440502c5acb74c573517d0e3b53eece66dff8000738e25f279c688a9633025a10e01436b1e8d4b360218d11ce6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374177, "uuid": "4c619e7a-d6e8-4ed1-bfcb-5f8538fbb5f2", "value": "T15952D1D163423689E332DF783B9C340FD09C49227139A7157E85D64AD42FB1848B9BAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374177, "uuid": "75d452a8-8e95-4f27-9ff1-3b33dbbc9bc0", "value": "192:KXs4Lyi82so2yzXtb1MQFGKVeKJRT6XXmBrdIQG2tdaOqGM5V6LsDdvrY6js:yb2eX3zAKuiNPZRwwqdvrrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694374177, "uuid": "170d5d33-602d-462b-8164-4f72db6ed11f", "value": 14120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694374177, "uuid": "adfd46bf-f9b2-4d10-9d94-bf20b0f39c11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374177, "uuid": "34775b2d-cf15-4a0d-9cab-0e945fe450fe", "value": "SecuriteInfo.com.Trojan.GenericKD.34055387.13480.22805", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc544209-4f6d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694304429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694304429, "uuid": "f4fb2308-504f-4969-b137-552b9047d75f", "comment": "Malware payload", "value": "04f223246d4160e8ea0b9c8a6ad97594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694304429, "uuid": "ab7f81a3-cc39-4c51-a0ab-48fa85aef473", "comment": "Malware payload", "value": "5c2d49e0dc75cd90f9684bc374d6496d43b4e67de0d743381002a61745f89642", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694304429, "uuid": "ee4171f0-af8f-4d0e-b281-ccc856ff3cf1", "comment": "Malware payload", "value": "e33faf95b0d4493dd90b982186e1d46b139d6094", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694304429, "uuid": "8e8c3929-9fac-4193-922a-6d8eb7bb1d41", "comment": "Malware payload", "value": "10173b64f701700912216bdd54d852cb7e210924ffb8c087fb6fbe55b25f7295b1e48e72738e9baec5f830aaae599dd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694304429, "uuid": "5798d4ac-3e3d-42d5-b7d6-189594e4f6f6", "value": "T1A6D523817AC041F3D6621D336A76EBD6A87DB8701F68EF9F87D1896CE9320D09630716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694304429, "uuid": "60ca8ce3-ad45-40c5-85e8-70f512e0c171", "value": "30d1665d4c796f53fba13defcdef7cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694304429, "uuid": "afb1853c-da70-4294-b7bd-4604d0432534", "value": "49152:kWhSV4BfJXAEgj0ZzQduLT5pgLZXb8dtV+72iw6tUxn9MlW20xWurj1AI6tUs3:kWhSeBfKEXVQITOss2e+xn9MlWNxWUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694304429, "uuid": "ea40778f-ebb7-4b1d-8a75-3fa3f899be9f", "value": 2908407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694304429, "uuid": "625f6833-5a10-4887-b55f-63bd7fef2308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694304429, "uuid": "050f5ca0-c512-48cc-8f32-c686a95663be", "value": "SecuriteInfo.com.Win32.InjectorX-gen.20362.31818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec960816-4fe2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694354654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694354654, "uuid": "e8b928ac-f38b-441f-bde3-b0a7827c22ac", "comment": "Malware payload (AgentTesla)", "value": "2bcf87e70cd4cf24d13eb4585c886c98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694354654, "uuid": "6783cf9b-822c-4260-a3b8-9bc79d801460", "comment": "Malware payload (AgentTesla)", "value": "5eda95d8390d9ba79eec7a7ef9ddadc0ca1c19209191ec4570c2025bcd2b7d6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694354654, "uuid": "dda95f12-ca97-4b5f-ab20-c9132c384fc3", "comment": "Malware payload (AgentTesla)", "value": "acf9406aada32cb2ebba17071e924541d2bd72cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694354654, "uuid": "ab994dff-25af-4734-a391-c520698d1b24", "comment": "Malware payload (AgentTesla)", "value": "49cb56df53f7f266706f3fa0b3da0b3484399518ae54402f9ccee5df5cdf528d490c6378f90ee2a869c9029025d21bed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694354654, "uuid": "70af428a-e704-466d-ae3a-558d48a92e51", "value": "T1CFD4230DC1BF05EF8DD5812E1927A60BE2D0CF5F2E5D66853A32B6D5BE7ACAA4714030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694354654, "uuid": "792b2e7c-47fa-444a-9234-7fd93ec077e6", "value": "12288:Z2V92uRv1zebrOEcbQmie3Ltk/r0pcYvrWJxGHlMhws+Bfmy:gv16brOEC6atk2cECfDS7fmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694354654, "uuid": "ba91ec1e-0f49-4e7d-b067-eb35f9ec59c1", "value": 653956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694354654, "uuid": "3b3c53b8-93cc-466f-b762-d445886e86b2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694354654, "uuid": "4ed3f2e6-6de6-498d-9a4f-163f035b9b60", "value": "debit note pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb182955-4fe0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694353712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353712, "uuid": "d6114309-dc06-4eba-8900-a29f0b0888b7", "comment": "Malware payload (AgentTesla)", "value": "ff1a4e7b274862add3924bd4cf4834c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353712, "uuid": "ebbe3157-143e-4c21-ae3b-22a6bd7afb48", "comment": "Malware payload (AgentTesla)", "value": "5fd067472a7502e3520ef55aa707960414b21a670aceb6000c66e5ed0025df56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353712, "uuid": "09992892-c0e5-42eb-8744-a4ed414b29ad", "comment": "Malware payload (AgentTesla)", "value": "37c3bc1d1e3ecb5fcad5f16752a1c89827d18de6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353712, "uuid": "3c850aa5-9e28-4d9e-af78-6e50f19aa449", "comment": "Malware payload (AgentTesla)", "value": "fafd6a3b398813e292bda67fbeedb9911a75d8ec15a0bf95d182229b2a7446e11433a3c948f6ed127ede20681581d2ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353712, "uuid": "a8ce8d1f-89f9-4787-971f-1b96b3e3f1a6", "value": "T136D42323C1249E9C409BB0D111E5B417E8EDACAE87C8B2877D5F6C6EE086175F35F1A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353712, "uuid": "b6789ce1-d855-401c-83fe-5fe877658d81", "value": "12288:c6gF6p8C5PV5AvJNyteMt3a/cOmCV+6RCNoyFE0yGAbhIqM:c6gTw83ycUbYGFhyJ2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694353712, "uuid": "39023eed-16b6-4773-89d1-bcec9a8a0203", "value": 654708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694353712, "uuid": "368e93f0-09a0-4e34-bd14-6d71ae3322ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353712, "uuid": "ccc85700-0c1d-4858-9b59-695aefbacddf", "value": "New PO--080523.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d8fd17-5003-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694368595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368595, "uuid": "43b8aedf-6072-4c77-aa39-28fe11a310de", "comment": "Malware payload (AgentTesla)", "value": "56464d682efb70d61cd012c24e237256", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368595, "uuid": "e01cb2f2-f177-4cfa-a53e-b218bcfd6429", "comment": "Malware payload (AgentTesla)", "value": "601ca85fa385ee74827fc023fc91c88964e8bc7dd8724305cddf1e089c7d372a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368595, "uuid": "d24f77e0-bd0f-4045-9f31-2e6d48234a3b", "comment": "Malware payload (AgentTesla)", "value": "15cf540d96cc8d6d9fae823dda9489080ce870f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368595, "uuid": "7d22c348-6fb3-46ee-8a35-b557c3e5801d", "comment": "Malware payload (AgentTesla)", "value": "30317fbf82c00c00220e0efbfc7f7cf09543947bce44153e8ef5931a73bb0fde151c49859f9a58917906a2cbcb445ec0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368595, "uuid": "ec4be307-61c7-4308-b541-c79055a8923a", "value": "T113E4F1511AD84D23C7BE02B45215F308D7B301A79066D22CFEAD31A79B6DBEC0757A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368595, "uuid": "36e0c1da-53bc-44cb-ab62-aa8841d1517f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368595, "uuid": "2d2f609e-4894-4abd-a4f0-e9e4aab689fd", "value": "12288:ZkGKvDJGWTLLUgAJJTL2OEXdLkgqMoTc0ErxY2OalPh5HXoGhVW1lPPLNIsjPAE:kvDDLAgAJJHEXdLk3T/2nDBs1R+qP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694368595, "uuid": "20c9ac39-8acb-4371-86e8-191b75549094", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694368595, "uuid": "6afe34d8-5069-4b55-a28d-6034a1ba8725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368595, "uuid": "c6ff74cd-35e4-42ae-9e73-a304b82c3308", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0129a41e-4f90-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694319040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319040, "uuid": "1e5acd19-098c-4040-b43a-0c943e36e491", "comment": "Malware payload (Mirai)", "value": "f7a34bd4796caf106a975ab79043acb6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319040, "uuid": "7e96b91a-a52a-4d23-a1a4-e092c2b56baa", "comment": "Malware payload (Mirai)", "value": "613f03b52910acb8e25491ca0bfe7d27065221c180e25d16e7457e4647a73291", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319040, "uuid": "c70b9768-3bb9-4b7d-bef9-34202073d75c", "comment": "Malware payload (Mirai)", "value": "9b0348ee8010d6b19041de9cab16b4e68f633149", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319040, "uuid": "9e674567-8a0c-42e7-a80c-c3c4585901bc", "comment": "Malware payload (Mirai)", "value": "0a666fd54061701f6a98e5dcd9bdcf319d68760fba57e70d2a10a87aef6aafb43a746273ad734244f7ace2f4d7ce4724", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319040, "uuid": "29a58ee7-36ce-44e9-a7ef-8258996c854c", "value": "T112D3F856F9819B12D5C111BAFE1E124E37131B3CE2DE7302AD246F647B8A8BB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319040, "uuid": "8b15bb05-70e6-46ff-add3-cf646d074949", "value": "3072:0CUIEJXcXmp80gFairId7f/b8DCh27V/8:97UcXO80AaYIx4027VE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694319040, "uuid": "e98e5da1-93e4-4050-845f-db7a638093c6", "value": 131932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694319040, "uuid": "366da1bb-4294-458f-918c-a1f6925ccd07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319040, "uuid": "22b63a48-fc91-4a48-87b1-420f5af78a91", "value": "cundi.arm6-20230910-0410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37cc1a2-4fe1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694354209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694354209, "uuid": "5451c483-a7c9-40cf-972d-e2c7a098d386", "comment": "Malware payload (AgentTesla)", "value": "5b672d1e9b0dea8de1f0e93ac7c03582", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694354209, "uuid": "762a58cd-362a-4b0c-b784-148563c411be", "comment": "Malware payload (AgentTesla)", "value": "651e67d3847b133e30c49ec1a11288870d71107da7c001fe2cc988c6ccd1096a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694354209, "uuid": "2afbd8d8-aaa5-43c2-b2f8-2293c6dfa173", "comment": "Malware payload (AgentTesla)", "value": "f4dac6ba544823fee3cd20d6b8319836c4cca984", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694354209, "uuid": "73ce88b4-b2c2-4125-a9ad-9e760ba18ec6", "comment": "Malware payload (AgentTesla)", "value": "2d38d6bc4e465b4c677d373b82d9d11d1de459304fadc9f9c5f6d5436f13194c3cfabfe5cca40ffcf24a554b1fe531cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694354209, "uuid": "46cf624f-1f7d-4657-9906-a9831f8d6575", "value": "T1AF84233D1AE563B3CC45B7C5EAEDD79B9378AB70DE648007919D050A37392043CD199E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694354209, "uuid": "bba1e220-4a35-4bc5-b87e-510540fe3c35", "value": "12288:Pe7xPV7CvchEPh1QYvYICT42hSjROgXTvcGj:Pe7xPxUPhe+o5hS1OgXTvcGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694354209, "uuid": "d2b97702-8d1b-4498-bec6-ee35e8e68ae5", "value": 401717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694354209, "uuid": "8f9c9b11-5501-4480-ab10-deab70b193b4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694354209, "uuid": "79eb4cce-2a0e-4df3-a970-0b8372dd8a39", "value": "swift copy 330175944820.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ae22c6-4fba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694337322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337322, "uuid": "d0c7a232-cd1b-47b5-ac41-7689bc9b2ce8", "comment": "Malware payload", "value": "5607e0ac649051f774795c424b288164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337322, "uuid": "dad91753-e3df-443b-99c1-5e39f94a61cb", "comment": "Malware payload", "value": "67a68c48f428159ea9ab8b7820000e06e85f5c471bcf7cc7b878ce37c7c3d204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337322, "uuid": "fbb920d9-7bba-4a43-8067-c0087cc0c330", "comment": "Malware payload", "value": "a9f189d7507ec13ed22cc8c03db9b76a391d8e9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337322, "uuid": "ea5e432e-12da-4f22-ae9f-613f66d78d4b", "comment": "Malware payload", "value": "92ac3b839230dc30670181b3fc82e334470182288144272c380ddf95cbf306a24fe5dc2acb3cc77abbbfc5618f5949da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337322, "uuid": "76454524-8217-4b8d-b98b-df2ae40ecb1c", "value": "T1A274F203F7D88473D8B52BB458FB03C30B36BDA59E74936B2759985A1CB3690A53132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337322, "uuid": "ab27ef58-0d88-4d32-9c94-c85eb6bd156c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337322, "uuid": "b846e765-5f37-489d-b6ec-e92c9ca4c0cf", "value": "6144:K88y+bnr+Kp0yN90QE+hp1XcQKSLLyCCXxWpPX/g1nTZRm8ny:VMryy90IhXcQo1TZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694337322, "uuid": "f7a9fa16-13bf-4642-b6be-8d297fb795fd", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694337322, "uuid": "720220fe-3c91-469b-8905-ab42682fe5a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337322, "uuid": "9290d688-bbd5-4734-b300-6b60acda97c5", "value": "5607e0ac649051f774795c424b288164.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da95bb7-4fb6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694335516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694335516, "uuid": "63786c0c-3788-41e6-90d3-018d7cd59f6a", "comment": "Malware payload (Smoke Loader)", "value": "bdcdddcfc735f367c9644e07ea2605e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694335516, "uuid": "7727612b-2006-4600-8915-611d31d0340a", "comment": "Malware payload (Smoke Loader)", "value": "67d2677beac2c88c2170da3f1a40010c8ea41430f3d34e2a56052b9f1228c054", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694335516, "uuid": "428b249a-1e8a-4aa1-b527-e8ae0cdcefb4", "comment": "Malware payload (Smoke Loader)", "value": "59428abd9dce4882975b1e28ea919df55cb84aa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694335516, "uuid": "b5588e9b-eed1-4f55-ab88-92235db672c4", "comment": "Malware payload (Smoke Loader)", "value": "c712a09038b327c8993fad0be7f52a895e871fe600ad1ad4a63a452faba200e02e036d9d296ee23303d3d91d7fc873d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694335516, "uuid": "6d5ba89a-0c19-4b43-94f6-8fbcf67f72ed", "value": "T15B348B1365E0BC72D26747305F6DAAEC3B2FB8515E6187CB17141E6B1E312B1C62B326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694335516, "uuid": "62bf5d87-8952-483e-b0ad-bb1cd69b738e", "value": "cda48ebb1fe57d9b31da3a94fc154bf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694335516, "uuid": "935a25d4-4914-433c-83a5-15642f5a92ca", "value": "3072:Sjtp249LA8nGpWqO99r5fbXjuB5sJ+Hg1f6osfYyLsVUO5500Z53z+h:4tp2QL4pILhDJ+Hgh6obygSm50oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694335516, "uuid": "b2c005dd-1061-47a0-bd36-9486c1881af6", "value": 248320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694335516, "uuid": "8d160190-3ac2-4a6c-b1ac-b61df9a330a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694335516, "uuid": "4328526a-92f8-4b4f-bffb-c234e4350bd1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ae6872-4ffd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694366205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366205, "uuid": "7bd04a56-25b1-4864-8259-41e382d7fb78", "comment": "Malware payload (AgentTesla)", "value": "1fc6e621270ebe1761e95fbccd142f6c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366205, "uuid": "3fb94d96-0be8-49a0-ae37-611363c07296", "comment": "Malware payload (AgentTesla)", "value": "68963cc1ad4f7ccb50304c69a8711dfa90d8d520c0b4a30f1769c52dc44f20a1", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366205, "uuid": "185c0ca4-ecb2-4d5f-9b8e-363ef8ede6ff", "comment": "Malware payload (AgentTesla)", "value": "c9b58dc456f9455fa29be16ee2f1f411ab6248ed", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366205, "uuid": "225077bc-2ef5-49dc-9387-9a0e8463289e", "comment": "Malware payload (AgentTesla)", "value": "09e16803ec0becd997d05b3f47b7e481e00396ec5d3b7f10c9405faaf5169c9cffb1c509df72558451d9ac9f037efc4c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366205, "uuid": "c30749db-ae50-4cc7-9dd6-551c3f9ad4ce", "value": "T1F4E423FA2509DC4795BF9D2D0DE5A683D63412F15A2CBA36E6BAFDDC031684D0A7C0C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366205, "uuid": "dfb65ef9-f78e-4aac-88f8-572ffe878ca0", "value": "12288:6EaBgvUvKrN5fbh2vKvqBzbwlt5+tVSFGrI/qnFDZ31EtgD/fdSpb1Vrko:6EaBgMirvfb8vmSKbGnFV1EuV4bnrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694366205, "uuid": "7bac5385-10fb-4af7-882f-caa1e9a6a242", "value": 670649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694366205, "uuid": "628a5fc9-0e88-4d9a-a4ae-9d6b41b30a67", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366205, "uuid": "c908c1e6-ff9b-414b-b3a2-b244fb03c768", "value": "New Order.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca156b3e-5012-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694375212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694375212, "uuid": "af4d54d5-bce7-486c-acdf-1ce372292ec1", "comment": "Malware payload", "value": "f553ab409bd3bb412c80bb7dc97d967c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694375212, "uuid": "b882df3f-3969-4c45-b5a1-80f6e0654e80", "comment": "Malware payload", "value": "6a14002ccd42f720001b28a0efff201c6d35dbed90d71b6a546c337df6ae0d5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694375212, "uuid": "d29737d2-14e9-442b-9d44-0455ee2f625e", "comment": "Malware payload", "value": "0af33064e260f9aa3932f143f934b309f93fa6c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694375212, "uuid": "82441c73-72a1-4ab2-b996-b82fa364a1ea", "comment": "Malware payload", "value": "2196c11a76781fef4ea0d92db423a4f0ba5899dad9b1f71eceab17864491d78aa322ab7a32648b253ab67502e310029f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694375212, "uuid": "863695be-91f3-47ab-95a3-5135268ca180", "value": "T1A7248C13F5E0BC62D56783304F2E96EC7B2EB862EE518756324C3D6E19312B1CA97316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694375212, "uuid": "5b424a10-25f7-4368-bfc6-d180ace6a104", "value": "4cf103460b980a8c131a7789354b386b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694375212, "uuid": "abdfcee7-db16-44c4-9638-64da2abfb4b6", "value": "3072:+uyHLuNfop5c7QRoEPf/Mo/uBB/7mjdlXjc2f7fh11594qPM0Hx:JSLuNop5lo0f/hf97fzJ4qE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694375212, "uuid": "d3237441-fc5c-49b0-abc6-8dfadcd90d90", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694375212, "uuid": "cf2d2fdf-f391-4352-9264-dbadccfa1831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694375212, "uuid": "61db93eb-0807-4b0a-a22c-66aaf017b592", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57c050f-4fe0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694353756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353756, "uuid": "56241a32-89b8-48db-882f-97e97c5aac7d", "comment": "Malware payload (AgentTesla)", "value": "ebb05d78205ec863b5b495f60a886663", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353756, "uuid": "d3b8318b-615f-4a68-9d2c-436ee2743da2", "comment": "Malware payload (AgentTesla)", "value": "6a5cbe40c2fe2db0f9f1409865bc99e11c2e66c68320a85d60f2c1919413fe38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353756, "uuid": "4c383b8f-7485-4f9b-9e68-900531e10f5f", "comment": "Malware payload (AgentTesla)", "value": "0966668363f4d39a0ee2404143db7d4246d08349", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353756, "uuid": "cee9ba61-3ece-4bd0-b261-0ded3a0d8464", "comment": "Malware payload (AgentTesla)", "value": "687220325bc8fbdc106b2409ef51769fbd78a12a2a09fac647ef02da2ef1e4f3ad6e87879b72ced270004fd4f3ac331e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353756, "uuid": "01fe7a51-7c2c-4541-8752-011c81c55282", "value": "T158C423764A610033F76B5931464247432EF3ADB4BFEA87AAE1A9DEB11E075F15802CC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353756, "uuid": "0b55b82f-4ec7-4bd0-b78e-a3a5a089563c", "value": "12288:kbcMOtWxj7o32f2UtvnoH5QKdxdXbTD5V7HLtgX:kbcM5xj7o32eovoH5QKTdLTD5dZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694353756, "uuid": "0ba17f6f-ef95-409f-ac80-c6a1d6bc7157", "value": 570027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694353756, "uuid": "4ef3ac7b-140b-4ac8-bfd8-f453220079d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353756, "uuid": "ea21ec8e-86ef-41f4-9ba5-36a958093462", "value": "Swift details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4cdfa46-5003-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694368841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368841, "uuid": "93dbde79-9993-4b2b-a5ea-326cf5840f01", "comment": "Malware payload (AgentTesla)", "value": "1e487bd04d2589c6f209c3a13e9d3b56", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368841, "uuid": "97ebcadf-5f6b-4730-b261-9759635b3954", "comment": "Malware payload (AgentTesla)", "value": "6ae4be0b156132af2c8150ca4e286a95053ac17792d295cfd21a03aa4938bf52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368841, "uuid": "546ff071-9f9e-4341-8eae-870d77842930", "comment": "Malware payload (AgentTesla)", "value": "4d7b7c5308fb21c58d50d0b8fff92cf2a572579c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368841, "uuid": "15408bc0-167f-4415-9579-c26acec9fa26", "comment": "Malware payload (AgentTesla)", "value": "a7627cd068d25232724b47a76b2816bb10e02e4e2b2938bbbab8e9de0b683c3a9b6e08a0386aadca981137933cff609d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368841, "uuid": "7b2b2efd-9ee4-46f8-8bad-901f894532e8", "value": "T1A5F4ADDC3650B5EFC867C976DA982C64E66064BB530BD207A06315ADEE0DA9BCF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368841, "uuid": "07adab25-c124-4c58-98f7-50cd2ecd45d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368841, "uuid": "7314dbe7-2b17-4770-8d52-1d6463b54b8b", "value": "12288:1CsuWpPwONpOvxsa8fSuvG/wWAMNHLhpotGhuW/yGOoWQUzD5aBl+2sT/sgRu9Ql:1n5hNYvetFWAMNrhpzhNrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694368841, "uuid": "48d9c20e-55dd-4cfb-b58f-ad71c2acde04", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694368841, "uuid": "e2dd01da-4bb3-49db-a548-78938ee0ac2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368841, "uuid": "3ba34386-72d7-4e8e-8a31-d1c0567a6354", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a75479-4fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694355522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355522, "uuid": "4f8af525-c83b-46a1-8dc5-7b4debf92247", "comment": "Malware payload", "value": "7276a105764d9443606f79e0e6f0726e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355522, "uuid": "b6401f52-d742-41dc-ae13-7928f4a3c816", "comment": "Malware payload", "value": "6b9f8ec504e85c492946fe937012de7e3d8bbbee95c4459c6c6f0fec83d0f875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355522, "uuid": "7f536348-c26e-4373-9a36-ff369599e3ed", "comment": "Malware payload", "value": "83a575839b4e3be607a95400eec286515f902899", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355522, "uuid": "b7a08d4f-c1a3-4038-9f2e-d3535657f288", "comment": "Malware payload", "value": "257d57c8db9c41526af64aedebdd55a3d0a95bef6e3ef6dcd2264447a96f6515f9ccfd7352f3247e446e77cecdea97da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355522, "uuid": "47496bef-36d3-415c-ab7b-448d5d6dd17b", "value": "T10316187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355522, "uuid": "ec609ef1-af01-49d6-a257-21c8eb1b92a9", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355522, "uuid": "1e1a02f8-2e86-4ed4-98d7-2fd7f02045af", "value": "49152:jgh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWbjXNO:Ha71fbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694355522, "uuid": "902d92e2-e86f-4f90-bda2-888d8cf2e01b", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694355522, "uuid": "882adb20-5edb-49ed-a44e-61c5fe57250f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355522, "uuid": "7406b0e8-6a4e-4ebe-9d9a-945a3a7949a9", "value": "7276a105764d9443606f79e0e6f0726e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc6dc26-4fba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694337315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337315, "uuid": "af81e830-2c6b-49a9-add7-2906eaa6b808", "comment": "Malware payload", "value": "3f6cd06c9501a3d416c40183780965d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337315, "uuid": "a2b5a215-35da-4cc2-b344-db02a9d264b4", "comment": "Malware payload", "value": "6d8404c0dd63242f67e1b776a866215f88362ab760e40f18f4657bef68199e23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337315, "uuid": "79d0efda-21dc-4a47-acf4-f0dde33c80e0", "comment": "Malware payload", "value": "f11c52af5d0ba6e1e3a8d9eb7ecad7e76d2aa65c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337315, "uuid": "60b01b8b-912e-43e0-825e-fa884f597ce3", "comment": "Malware payload", "value": "b451349efe45bad382f6ea9377086a89f174c672b6506962c3ba7bdff14bfaf496ccb09d379f9b8de76cf1bfd4c92176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337315, "uuid": "13154361-ee7d-4273-a4ec-a4484c9fcaf7", "value": "T1DC74F113F6D9C433DCB52B7058F702C30B3ABDA65978925F2391695A0CB2684B93277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337315, "uuid": "ece2cc86-6848-4651-995e-a85e6efa8e04", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337315, "uuid": "afce2c40-dcbd-4965-82dd-66968c4f572f", "value": "6144:Kfy+bnr+Gp0yN90QE/hp1XcQKSLLyti417fwNQslEvJNQoXgBDDZaWIX/L:FMrGy90NhXcQe1UQsyBaK6DNah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694337315, "uuid": "30d46775-1104-4bf4-b4f0-bb32feb276e1", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694337315, "uuid": "338f5303-c28e-4c08-8108-d53216b35709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337315, "uuid": "a24f2722-bed3-4bb4-b9b4-612ca37b1eb9", "value": "3f6cd06c9501a3d416c40183780965d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc88caaf-4fd1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694347326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347326, "uuid": "803ed4d8-dd6e-4d31-b024-c6dd3dab2358", "comment": "Malware payload (Mirai)", "value": "dc2d8f852accf843168a26cc30f27423", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347326, "uuid": "2371e975-4ad3-4ec3-bc3a-dab0cca67e94", "comment": "Malware payload (Mirai)", "value": "6df9e6e2e24f8657f89c718a8d3347637ead0697dc612d16e6c61aec9eae6a0c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347326, "uuid": "15805112-4393-46be-a5d3-8370fb820522", "comment": "Malware payload (Mirai)", "value": "f02068af28b03ed52d5fd1fa3beb59a23cd757e8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347326, "uuid": "8f2e378d-5db7-4c30-bd8e-1ffd002bb729", "comment": "Malware payload (Mirai)", "value": "a03362afe188fd233d4dab8c431755611c50ef078073963c7ae463b194ab66ac1af029a1f61ef62527fc9898176d54ed", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347326, "uuid": "f9af351d-b75c-4a5a-9499-123afe89d0d2", "value": "T133735CC8BA83D4F1EC5309B2513BA7728773E12A546AEE42C72DAD35CC92910E72735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347326, "uuid": "357c5a55-18c6-448c-8617-7316e2bd6943", "value": "1536:ui0zONnG/oKB5KAXxCwxlpdtqNEloSjot0r4Ceya:f0zwnAoKHXCw3Lt6k1jg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694347326, "uuid": "e08ae64c-0140-4228-b0c5-536d0325e7e9", "value": 80232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694347326, "uuid": "a114221b-aab5-406d-8101-3ffdb4aaa481", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347326, "uuid": "f1b43baa-f667-4ce1-92a7-6b16ebac1dac", "value": "cundi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d235a0-4fe2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694354319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694354319, "uuid": "7f2455d0-2d5d-49ca-ac8a-072b90881b35", "comment": "Malware payload (AgentTesla)", "value": "d0e4e244504e7e0295c6cda9e9628137", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694354319, "uuid": "f3e5a36c-fe57-4304-a340-53c66529bf7f", "comment": "Malware payload (AgentTesla)", "value": "6e1f4fd45f4b6a4213c14bbc5391af7924e6fb56869730f300f06bc620dd9fa8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694354319, "uuid": "e71146c7-fdd1-4f65-bba0-21c0b9392ec5", "comment": "Malware payload (AgentTesla)", "value": "7be2b7463bf76c2d5492898e306e4953d8b45129", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694354319, "uuid": "b0bd6bb5-9aae-494b-a185-0c1b435b1943", "comment": "Malware payload (AgentTesla)", "value": "8b1c1b531330d070954917eaa6caed8c9a43e0e80e1d0960682876ad223f7bd31e215a96dc202ca982dc5c04e81e406d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694354319, "uuid": "fe4b8eda-189f-4ece-a7a7-b60614984246", "value": "T10C556FF3FB442BE1C4824EBCA9F4D533A9D01E807560B17E7EA9B902557503AF25E8B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694354319, "uuid": "c5163331-f53d-41e8-98ba-313d0fa8e679", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694354319, "uuid": "64ee76f6-cfb4-4083-bdc4-bf8e6467793a", "value": "12288:FBC77m87YTVA9RhKiWaoauMNmITm+CjBDJriP7r9r/+ppppppppppppppppppppk:FBl8aV0PKFauAGDQ1qy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694354319, "uuid": "2fcb7b86-ad2f-4b6a-88ab-6e2300ed384f", "value": 1326080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694354319, "uuid": "7632ba0f-60d0-4ac0-ad12-48a5511635a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694354319, "uuid": "f9bb4252-01f8-4fa9-93c9-a87908e03dde", "value": "Invoice for part shipped.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2d4ecf-4f88-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694315977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694315977, "uuid": "f2d39f75-b844-4b18-961f-3d1d7102344f", "comment": "Malware payload (Mirai)", "value": "121f782aa90c3e0ac6858341e48a70b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694315977, "uuid": "66d8bb3b-ef39-4f3a-8104-0c4f6cad4e72", "comment": "Malware payload (Mirai)", "value": "7148676e78693770609471f2704d2b9e4938f68ef927cad382eae22372ef9ad5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694315977, "uuid": "e9dea026-5534-4f33-bd4d-2d91a909d979", "comment": "Malware payload (Mirai)", "value": "c1e871050906577a262067f7bf3e11ffe7d81232", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694315977, "uuid": "a921086b-026c-420a-a613-2401704e14da", "comment": "Malware payload (Mirai)", "value": "9bc8f01d8717423f840d0a4780cafa9a466f498ec84e838f6bc349e760d60d3533139f92f13221d6d61445ea1bf018de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694315977, "uuid": "a07b058c-ddd9-4830-93b3-e8e433e5f066", "value": "T1B9335B0272280907E5625EF0393F17E083BEE9A021F4F689694FDB5A8275E771186F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694315977, "uuid": "9186b278-03bb-42b7-a323-094febdb71ef", "value": "768:vEzWHwvpkRdevJNZvyZQpNmW9wR5co3mu+CI1xagpfSYGdu0jf:sKHGG+JyZQp906x6Iv6YWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694315977, "uuid": "55950c3f-023f-4216-bac6-a824bb5d29c0", "value": 54304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694315977, "uuid": "577359be-6ca7-43ae-a7b1-79cbecf1d69d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694315977, "uuid": "cdf6ad96-0e49-47f7-8acb-ebb49fd3efb5", "value": "121f782aa90c3e0ac6858341e48a70b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cdc1d4b-4fa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Neshta)", "timestamp": 1694326442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326442, "uuid": "d9d9536d-1b4b-483f-b0e0-f262e56e131c", "comment": "Malware payload (Neshta)", "value": "484f821662f2cce82ceedc25c63850c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326442, "uuid": "2944dafa-065b-42cc-bcc6-e8b31f7feeda", "comment": "Malware payload (Neshta)", "value": "73538ff2e8e3a4243c071eb7007086eea884c19db8e6bb92f6889eede28134d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326442, "uuid": "84a66b8e-8a3c-4f59-909c-13b7a6534114", "comment": "Malware payload (Neshta)", "value": "a750f3a757da50c3be1521ff7c6aa926862539c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326442, "uuid": "a2065ad3-5a43-4f3b-a4c2-d3f4035b51d8", "comment": "Malware payload (Neshta)", "value": "2d1ab4b59a8878857f460a73320431301000dc4ebd74bdd71f4396be96c804104ae19f84d8768104351562b9728006fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694326442, "uuid": "c421fb93-4a43-47bd-b2cf-22895c12a84f", "value": "T15EE423432E084B76E0A953F46B794529CBB0B5AF387EE75E58C457C324DB3831642AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694326442, "uuid": "fc6ee4f9-d5d2-4fa9-87ec-c530f002dfe8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694326442, "uuid": "90a4aaf6-9171-401f-863d-6fe4bfe4be1c", "value": "12288:U9/Xb7pcfykIxFGWCYpW4zEdU1V3YudHiJ/VI9N9K3Jmhn4ch5lkyCyWfU0Ns:s/X55k4FGjYc4Y+1pHiJiCmqWlkqWfUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694326442, "uuid": "d1c7bd02-1971-4d08-a550-379fc8dae9ad", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694326442, "uuid": "c31c06b8-8fd7-4420-9796-652a07acf776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694326442, "uuid": "3496599f-5707-49eb-91ec-75d620189122", "value": "RP0MDCG3.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cae535c-4fed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694359003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359003, "uuid": "08736321-d447-42ed-b23c-d9e1465973bb", "comment": "Malware payload", "value": "2afb82587a0fe4b043e775a45cb94736", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359003, "uuid": "9cc0185b-7ed9-4bf5-94fd-14514c17f783", "comment": "Malware payload", "value": "73d23e3291eca6018be1e0c85b13aa48e9cd9e36cebcc642cfed72e6fdd8a17f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359003, "uuid": "bba75df9-6568-4139-944a-f97aee71f728", "comment": "Malware payload", "value": "179c141d9862ba7fe0d444a7d35794bc40429872", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359003, "uuid": "e985b0db-9faf-4981-a42a-e5b7d317f268", "comment": "Malware payload", "value": "e8d9a4fb0c3ad76954237c45bf26996b7d0bab1a3b5eb3081f4fbc5b273a98ad0ba1ed323d698ee0e5bd72883d9c881a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359003, "uuid": "03493a96-c27e-494f-9ad8-093ad74fe7c1", "value": "T1A214D80AAF550FFBD86FCE3702E90B4529CC655722A43B763674C528F54A94F0AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359003, "uuid": "df3915bb-d2df-4680-835b-86e743337b9e", "value": "3072:/AbLzSf2eq1aJyjGreR1xieE95gZnJpLI8wd6:Y/zSf2Pire9bE9K/9wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694359003, "uuid": "a55bc6bc-8e0f-4236-a2cb-f68bf78cbb1e", "value": 207576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694359003, "uuid": "925cf811-aa48-47d2-b8e5-9edf088f8b0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359003, "uuid": "b1c6392f-d085-4934-8440-18d43a2bbf8b", "value": "2afb82587a0fe4b043e775a45cb94736", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2993bc26-4fdf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694353038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353038, "uuid": "0d37b9b2-cb41-47ac-abad-d6440b3b69c3", "comment": "Malware payload (RedLineStealer)", "value": "458aeb444a66350118741f27c1f40bf4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353038, "uuid": "afa5d287-5a98-42b4-8d88-21b3630a59c3", "comment": "Malware payload (RedLineStealer)", "value": "752823538da4481a5c018b006e45632bac790df88df756c6a54291981d953983", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353038, "uuid": "033e6e43-0754-4339-8a3e-240e9970be04", "comment": "Malware payload (RedLineStealer)", "value": "ca48d6c3dd2a2887dcd203c6207a024396cc5039", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353038, "uuid": "f151cc84-cdb7-4a4c-a05f-957034280f5f", "comment": "Malware payload (RedLineStealer)", "value": "6921591427621885b229152fa8f8d888d3bb3f00d6e310bd9eb14b41211eed6a290f86f1bf1e2b8f8e209a5127767188", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353038, "uuid": "d5823482-08b0-4a11-8033-20ad3ac881d2", "value": "T1A9E41216ABD89477E8B92B705CF64187073B7D22AA7883672B459C5E0CB33D0A43536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353038, "uuid": "1537c34f-f4ce-492e-84ae-d3081529464a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353038, "uuid": "48765b81-956d-4caf-b7f8-a45b8a7ab6f5", "value": "12288:hMrDy90Y5z/zy4NBqp6s3tvim9f5b2pzNr+cG/AsitfYco:6yZpLyOBA6kvim9R2phL1fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694353038, "uuid": "911af276-ad16-4cef-8f7c-0600f5ea7620", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694353038, "uuid": "ef1b0159-7da1-4bfa-8155-fde130968c72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353038, "uuid": "3eae83f5-4dc7-46a6-a9d3-257e1660e9f9", "value": "458aeb444a66350118741f27c1f40bf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecb4a22-4fbf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694339572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339572, "uuid": "df6ce0e4-fabc-4000-b1cc-5c35ceeefe31", "comment": "Malware payload", "value": "c089dc1af1dc70296de1ccf6943a2187", "object_relation": "md5", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "titanaquaplus-xyz", "colour": "#786C32", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339572, "uuid": "252b5b77-24a3-4a14-ba13-0db30fb9248d", "comment": "Malware payload", "value": "7a01c6d8555c26599c2b05347d92f7b07864d1f1169c79a213ca09b142c7024e", "object_relation": "sha256", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "titanaquaplus-xyz", "colour": "#786C32", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339572, "uuid": "6d467111-92d8-4879-bb52-b12acd06f099", "comment": "Malware payload", "value": "5164d96202cb16c91043497dcc5ec37bc64c1835", "object_relation": "sha1", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "titanaquaplus-xyz", "colour": "#786C32", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339572, "uuid": "f979b6ab-729c-4867-8c4d-6b9d7cee93ed", "comment": "Malware payload", "value": "4155e6f01c8ad56db7d8f05353403f0e0dd5c7f35dc0091e17db8bae34096f9c563bc6904952a86e995f8915bc55c17b", "object_relation": "sha3-384", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "titanaquaplus-xyz", "colour": "#786C32", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339572, "uuid": "dc9288b4-01ff-41a3-80ce-e7743dbb1a2b", "value": "T1F8C2EAEFF69A9C49CE09073544A786E96227BD611B6783CA778EF7125FB12C08613027", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339572, "uuid": "edd9c1fd-a36a-42cc-8667-de7b908fb5ec", "value": "768:S+ltKpbdrHYrMue8q7QPX+5xtekEd/68/dgAmAoWGF:jrKpbdrHYrMue8q7QPX+5xtekEdi8/de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694339572, "uuid": "62f84130-d7ba-400f-89f1-e9aaa9a5f0bb", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694339572, "uuid": "d05970d0-4bcb-4758-85b9-1984d81f4de7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339572, "uuid": "b43e9bd7-776f-4809-b569-59a538c39e2c", "value": "1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a5b751-4fb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694335206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694335206, "uuid": "599b6385-8e99-4f71-b149-fa0aabc317a2", "comment": "Malware payload (RedLineStealer)", "value": "3a0f9ccdeb01ae726b5f561035d7716e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694335206, "uuid": "7f898d0b-0e6e-4887-890d-4e0a6b216439", "comment": "Malware payload (RedLineStealer)", "value": "7a2d5b9f3f3f141508fe3610ca2d38beff37f8bba667f8336e6cf2b9191de4e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694335206, "uuid": "2e41dded-81a4-49dc-b63e-cbc2a7a82b01", "comment": "Malware payload (RedLineStealer)", "value": "7b63c2a5ab154a41ae12778be546ace14508eca9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694335206, "uuid": "db710690-f271-40fa-92ad-4828da69c991", "comment": "Malware payload (RedLineStealer)", "value": "f91fd57dd5c223e033a30e17b3fec11d55adb90fbc2e9b2f402a1dd79d1a330647b3e29d8de7b2040f6cf3f45cccf8fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694335206, "uuid": "40bf628d-7810-402b-aebe-5626be85cbe2", "value": "T13F94CF1371E0B872C66647300F2DFAEC7B6EB4517D65CF8A23542E5A29306B2D627327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694335206, "uuid": "ca680267-57e7-4abf-97db-4ec860403258", "value": "3681be0c4196dc1f0159e8326f6ce58b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694335206, "uuid": "ca9f797d-dd50-48bc-acff-3b897ff876df", "value": "12288:2xF0AAPn4PuCpSgTO9MWMl08tkjgWhSQr8R6ZZpj:2o3PnuJpSgTp0MpWhSQtXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694335206, "uuid": "2c483f35-ee7f-46b2-8357-2689e7745751", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694335206, "uuid": "485bc2fd-3416-4891-8eaf-d5fc8231d2ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694335206, "uuid": "cbcb369b-1957-4a18-8a1f-264352a74230", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab26098d-5028-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694384609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384609, "uuid": "95a29e9d-8d7c-4b4d-91b9-e81355af34fb", "comment": "Malware payload", "value": "a301a1b39c68bf46143aa907d6bcf9be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384609, "uuid": "34877e10-1286-4574-a3c8-17eef37ced21", "comment": "Malware payload", "value": "7bb3f573507ead70214a653606e0bc0dfa260ed8165db9a0d397a40fe310acd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384609, "uuid": "0fede320-cfcd-4253-a08e-6fd72ce7004c", "comment": "Malware payload", "value": "092d445c8b4aec22506b256c2ca0bb98ea74a9ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384609, "uuid": "3968dd4c-4312-4953-9849-e9fb505dfaca", "comment": "Malware payload", "value": "0a381ef6befe38ab7ed291059b7cd5d368f0c44afb03979a3ec997fa9d88e73ffbfb36b53fc845696def4e475db20ff4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384609, "uuid": "33de82c5-a669-4680-8a44-ae6dc8ee2393", "value": "T102D2D0CCA197B8ABC59C5CF142AE13510E6099D033CE86EC5B1188D8B67A7CBB14D5BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384609, "uuid": "91c421cd-2e98-4589-a08d-4d283afdcd47", "value": "384:wnNMYvOlmmDlHtaYNor0CwBxN8ZJWc4t/N8+lNxW6x0jnUObIZU0zirYvYuRWGVq:w6YWsmDlIJcBxNPc45TxajUxyhlqW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694384609, "uuid": "a00dd1f7-0df2-4898-8315-1b0dfa8ddf03", "value": 29292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694384609, "uuid": "5db97480-81bc-4701-918c-a0b671bbaa7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384609, "uuid": "3b21b2bc-13af-4b89-a51d-a9fa66b0ed1a", "value": "a301a1b39c68bf46143aa907d6bcf9be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0ae2b5-4fed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694359007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359007, "uuid": "1d83bed0-e50e-460e-b102-3b0575ccbaa7", "comment": "Malware payload", "value": "fcfef12901b0eb48e34e9a238d163089", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359007, "uuid": "e4341b48-b70c-4581-893e-d0eec21e5523", "comment": "Malware payload", "value": "7e0d2f07bd4352603e9e99a4aedc597448dc02f75cb2c14928226b4551ae403f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359007, "uuid": "fd790687-df84-4151-a7bb-c2fe7a6f20a3", "comment": "Malware payload", "value": "b2a222293be6918b9f9a9a9d7f617eebcc8c23f7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359007, "uuid": "6f434892-8ff3-40cd-85e9-6921fb972ea0", "comment": "Malware payload", "value": "e91421e0ffc1079e3c377b8f96706f6b22a9b81b20317c828ffb0d65f0800ccf04e5d6362b199a2bee122a10a6200cec", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359007, "uuid": "dedffa9e-41a6-484b-9748-5a6475cac5b2", "value": "T12AF34B0AB5C088FEC4DAD1B44F9AE136E972F4195134B6AF27D4AF621F4EE315B1D600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359007, "uuid": "5d808cde-a3f2-4c3e-97d7-fdd13cbd5253", "value": "3072:E8v+O7tDw4ykHSYXETJzzpMFvL0PggZdTjT++CHR:v+ORDJkgz0bCHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694359007, "uuid": "8a169888-3420-4f70-94e9-723aee42cf4b", "value": 159816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694359007, "uuid": "b9a30972-76c6-4cec-8094-78eb14ae3b97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359007, "uuid": "09abe171-42d0-4bf0-963d-71ad224d6a37", "value": "fcfef12901b0eb48e34e9a238d163089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea9b29c-4f82-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694313372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313372, "uuid": "7833c7b4-3549-4aef-a6c2-a8b9697bee86", "comment": "Malware payload (RedLineStealer)", "value": "8116febb9d5e772f8f527172f0bbb481", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313372, "uuid": "57a97526-5b70-4cc1-ab4a-c362a39e153c", "comment": "Malware payload (RedLineStealer)", "value": "806d1d42b45adf8a3ecd7fb0797ee658b207e5338efca502541dd2f91d6b2413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313372, "uuid": "6e6207b0-088e-4a2c-9acb-c60a8c152eb4", "comment": "Malware payload (RedLineStealer)", "value": "ffa774c779ae66bd2bafcd4ded9af4a205b8b14c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313372, "uuid": "f6fa2cb0-8089-4f10-b62b-1b52faa77cb0", "comment": "Malware payload (RedLineStealer)", "value": "8985796dbc344c7c88b7d66bdbd628643e680a897a917eb596c0d5e4a844607f9a97d26638ef0b9884006e875ef520f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313372, "uuid": "2291709d-7ed7-4b65-a077-2056cca8ef54", "value": "T1F855135474E681B1C4F246384DA0AEFD4E7D7C3289925CDFA7A44BEF4F3468286309A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313372, "uuid": "cd772f35-0f5d-4212-88de-8bf80de8a051", "value": "2627254264278e0e80567712e48122f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313372, "uuid": "b125ab2c-1d38-4c4c-955b-92e0cc66b513", "value": "24576:+xUevbWEEOz0mlEyyHyn4xUtTAWIcIooKRNkMsxq2mTaI1PUJ:FevyB45lExyKyAJnKw82meQUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694313372, "uuid": "6a007f72-7184-4847-ac80-86f92cac4c96", "value": 1394176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694313372, "uuid": "b10d0196-54fe-4044-a627-5b87d4c7cbfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313372, "uuid": "e0d2509c-9e58-4fa2-b75e-9f9fe1b746a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6786e1f-4fff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694367019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694367019, "uuid": "d65286cf-9e25-4d51-ae51-3bf00f1851c6", "comment": "Malware payload (AgentTesla)", "value": "521d8406835ca2bfc0b3a37b2d90689b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694367019, "uuid": "e443ae58-c4a5-4c7f-b295-81b8818b2c32", "comment": "Malware payload (AgentTesla)", "value": "80d693e1855d90cf197f60256e672882d39ae469d715a4f396cc1116647e4f83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694367019, "uuid": "b9b325c6-50bd-4db4-8844-d449e409dc11", "comment": "Malware payload (AgentTesla)", "value": "a844b458aa2e87ed6ff4a9fca94bb9ed821a735c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694367019, "uuid": "f79d4efb-92ff-46df-8fcc-1fc0c7d2b4ec", "comment": "Malware payload (AgentTesla)", "value": "0c989757a0173bf79b8b2431edfe7e2e8b837b0e40464953be86f77b29609813ec171d9e2f4785700afa41fe6650c4c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694367019, "uuid": "cb9a689e-a898-4be3-bde7-2d1f800aa5e8", "value": "T156A423092527A73EC66A93F842035D905F027A7BCF39D95CF1706E14AEDCFAC6A31858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694367019, "uuid": "7483e907-9f78-4a01-8bbc-2b2d0e91c316", "value": "12288:yByUcCiWqBb4HqJjjUEblD3OoPK3zbH/+8PoTTer9j/:syWAvlYClD3FPK3zbm82erJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694367019, "uuid": "531035c6-524d-464d-9d43-28ef1855498b", "value": 477236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694367019, "uuid": "a3351c33-a22d-47b8-acad-b49a5028e876", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694367019, "uuid": "a39f9bc4-a912-4a6e-bb4a-e01594db4934", "value": "SKM_C33501911071023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a35f248-502d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694386513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694386513, "uuid": "ee224a83-b5fb-4b75-a9b1-cb71e49417cd", "comment": "Malware payload (RedLineStealer)", "value": "2f8e4579a3a881bfb369235db56c848a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694386513, "uuid": "50ce435e-0150-4153-84c1-9f490449b21e", "comment": "Malware payload (RedLineStealer)", "value": "8163cf77c1cdfbe6998a74dd78c0dbbe8ca02c8df9932296dcfe5bada9c48a3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694386513, "uuid": "5ba6f2ec-c094-4f5e-8265-bd3c5405dbae", "comment": "Malware payload (RedLineStealer)", "value": "04f2abd1b95e4218f35f0927f9a0448308119336", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694386513, "uuid": "fca970b8-d1c4-4c6a-baa2-d2b3ec0f6d8c", "comment": "Malware payload (RedLineStealer)", "value": "5c6b8fbdaeda0e4caf5b61ba3ef579a30f439f87dc18437b64567265a34b0268f15a5dba5a132976ce74931648c685f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694386513, "uuid": "57b190e5-5a37-4f73-bffc-ba177e04810e", "value": "T16165221136F08672F976153205F6BAB9143AB9900B63899F97F01B7A5F306C4EB32E52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694386513, "uuid": "2f997ef7-047b-4583-ad76-995de0a042b6", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694386513, "uuid": "518e506f-4391-4f9e-ba5b-5740762840be", "value": "24576:wcZCJRHp1eJv+cHzubwRlFT0NVLX5MbyEyGoF0msNEI8N5p/0PZlkMZu1Hg:FZCJZegY6bwRL07/Ey4mRjNHcRlM1Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694386513, "uuid": "3c8c653a-a320-46ad-9356-a57959240c83", "value": 1535864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694386513, "uuid": "5e0c01a7-2e1d-4ff8-9be8-1eeff133cafe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694386513, "uuid": "1448d395-b165-4839-8853-ada61095b54a", "value": "2f8e4579a3a881bfb369235db56c848a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445a949d-5004-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694368975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368975, "uuid": "2c9166c6-8613-4c0a-98da-d8b4ad0798df", "comment": "Malware payload", "value": "6a577b3b91e5444776a628cdf63c5bf1", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368975, "uuid": "144bc265-169d-447d-89ab-07ee2686c8a3", "comment": "Malware payload", "value": "8251f2a1c52d5f0a4f46346593f56e80f218f8b758b859f221f3c75ea54d7a4c", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368975, "uuid": "fb22f55b-74be-49ce-82ba-014f483b380a", "comment": "Malware payload", "value": "e7a7fbe6a95f300d1ec4ce2dc12985915819fda7", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368975, "uuid": "5411ea17-5b2d-4919-bdd7-8722988cbd6b", "comment": "Malware payload", "value": "8260baa8b5c8f2d8816d32bb7b15469e6eba5527a27cfe00fe08bfaf7eaf46bb4d47721693742eeb50c243e8c4659360", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368975, "uuid": "d8f6c6dd-e1fa-4719-b7e0-527c509de191", "value": "T131D4236AA5779750C38EEB7C5087859A741CB42D61C3C60CF7536888277B43BCFBA1A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368975, "uuid": "97af3c9e-4e40-4212-ae1d-964e8547226a", "value": "12288:LLINpHxoos2iPZHD+zfZfveW5FuKP4t6XdZ1g/UbPi+HQEYnmTXaRgM:LLmxoq5sOXZgqPi+PXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694368975, "uuid": "57b8cbdd-563d-491e-a3b9-b40c89ef9b7b", "value": 631925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694368975, "uuid": "421649b7-aa5d-4bd7-aa41-73ed2a0a48d9", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368975, "uuid": "d42efa71-1572-41cb-9b15-d0dc1e9d7a17", "value": "Ningbo Overdue Account Letter.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b6e946-4f6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694305225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694305225, "uuid": "22ec6e9b-4b05-4d34-a879-7c3d8c6b960f", "comment": "Malware payload (RedLineStealer)", "value": "134bebe03d06ee2f3b059604ed93fff6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694305225, "uuid": "c0ff71fe-7c7b-42d9-b957-53f6274ead53", "comment": "Malware payload (RedLineStealer)", "value": "845f60706e697966f4812673a45f102db1d7f6c3c16ffaf57ca473ebcc30e855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694305225, "uuid": "9356a564-93f3-46f6-a637-5b55a8be7801", "comment": "Malware payload (RedLineStealer)", "value": "190c6aa2f5667fa0f60e73d2a4d90a50d057321c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694305225, "uuid": "86e01ad5-f608-4f1c-82e9-6492c1969cd6", "comment": "Malware payload (RedLineStealer)", "value": "ada0e67ac576f4d0ea2e67caa6960fd5d614ca08ba6d82fe259932970caf1953e69abda0dce0dc72b6ab7c605e44ddac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694305225, "uuid": "63c7e379-6644-4937-8178-78a672e313cb", "value": "T161445B15B04748EBD079D33DC6FAC15944FFD80421EA399A1A8EEDC52D1A2A6CDFC18E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694305225, "uuid": "30b48dca-a078-40a7-a659-0963d7c4ec18", "value": "13c0891f06f07df0fea8b9222c036d3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694305225, "uuid": "aca8890a-2667-4976-800e-e0d8821dedbb", "value": "3072:8dazncsg85Rhuya7+7ppYDtIJYbJ8anlVt2VXuJTowKBLrcQAXhgg4HIvvv3:89w5RoWppitIJYbTawSLrChggh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694305225, "uuid": "149410e0-dc65-4c1f-9532-1d7097dfcb97", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694305225, "uuid": "ba13d378-c0c3-4380-a19a-fbbdc3bfc989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694305225, "uuid": "c6e5ff1d-a579-4d57-a223-afd722ec074e", "value": "134bebe03d06ee2f3b059604ed93fff6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38640e7-5028-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694384623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384623, "uuid": "e1e4e7d0-4712-479b-9517-71bc521ee883", "comment": "Malware payload (Mirai)", "value": "254e2f95a9d3480256148ccf1aba6b9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384623, "uuid": "6cc50bfa-67f3-4d56-b094-59a22f017f4d", "comment": "Malware payload (Mirai)", "value": "87a272609b96ecdf81a38bb45f6f46ff0eddc767b437ac1974733dadfe1708f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384623, "uuid": "54a71f8c-0598-4d33-b61d-3c391616ecbf", "comment": "Malware payload (Mirai)", "value": "d0cfe4eed8685aa1c69b80ba11438e52bbcbf269", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384623, "uuid": "77e246ae-7216-4ed7-9281-cad96befee8f", "comment": "Malware payload (Mirai)", "value": "a3c15b901d36fe5ab25432fabf9b8c13e393b41cfcffdd48d13883a633c75284a6417553ddd073c91bcfb1019022fa08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384623, "uuid": "6fc52b1b-a2c0-4ec6-a9e2-51e3de75c72e", "value": "T1A133F13462233D958FA06A75F8310B1F7D319A7807E4B9BB154587390C8BA4DB2E94EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384623, "uuid": "9d70080e-47c7-4341-9184-a5c682629647", "value": "768:Px2FxGv/8mDLNDIqbTpsbEPNrqRt4IEd9q3UELkrvJZH/Nas5zXkaA5DBUZ:PK6kmfNzbUEPNELMJZks5zXkxrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694384623, "uuid": "fb741a3a-3bcb-44af-b400-1b7b260bad1c", "value": 50856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694384623, "uuid": "847efbc3-c33a-4331-8474-05cc41b81b20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384623, "uuid": "2e5b2dc8-b525-4c08-b441-9254e7dee7fa", "value": "254e2f95a9d3480256148ccf1aba6b9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b536e64-5016-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694376610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376610, "uuid": "198fcb6c-2010-46a8-805b-cb719a297f48", "comment": "Malware payload (RedLineStealer)", "value": "f275d4c11ee01b98a790d98ec7a6881b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376610, "uuid": "0e2a71b2-7c3b-445b-9c7b-aa7cdf2362a4", "comment": "Malware payload (RedLineStealer)", "value": "87a93f4ea20e45fe032aa2032650a9fcd2bd9b1f7979e1712b69219f0badb4e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376610, "uuid": "9a17da51-4530-4db5-bccc-780a0a6df611", "comment": "Malware payload (RedLineStealer)", "value": "ec050c78a2dd013c725d583f3a30b471b796aea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376610, "uuid": "83c58d4f-8b2d-4a14-b100-8d74225facb6", "comment": "Malware payload (RedLineStealer)", "value": "34ef5ed3cbb2d522811bc78ff5263ca95b9bc2089e695112f8a516c255084c3dee3bbd4d1dce093fd581eb51fcd19bed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376610, "uuid": "45b3eb83-ce72-4e90-b7fa-386ea1017694", "value": "T13C551240F2E1C832D936123625E8EB79093C7622C3F6AEEB535C4F7E57612C1EB29516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376610, "uuid": "c86a7025-5a17-4525-a950-4cef897552fe", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376610, "uuid": "83044020-91bc-4faa-8135-dc33f474095f", "value": "24576:N03CW8Gqp6wIa4RcyDsPbXRaFsWdqPqU43CQdXRwGAiL1s:e3CW8Gqp65nY8yWsHOPAiL1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694376610, "uuid": "a057383e-b5b5-4447-9a37-88fbd0e96728", "value": 1406272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694376610, "uuid": "336f6bbd-cb3a-49d0-a28a-9ac60d810fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376610, "uuid": "d449ed54-dfbc-45fd-a359-dac87c7d21bc", "value": "f275d4c11ee01b98a790d98ec7a6881b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7179ff-4fd1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694347357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347357, "uuid": "7e09158a-6563-4e7c-88a1-beaf97054b20", "comment": "Malware payload (Mirai)", "value": "f66b0e4ac25e4aca9d3968fc45a66eb8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347357, "uuid": "3392f20f-c18d-4ff2-bf5c-b6e258766226", "comment": "Malware payload (Mirai)", "value": "89d9669483ce6bf0f7782461c92198b6b687d7867b19d75e9574a95fd13011e5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347357, "uuid": "0979f9f8-db96-43ff-bcc4-307af9bf87fd", "comment": "Malware payload (Mirai)", "value": "39983ae06fa78f650a4735accbca90da693b406c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347357, "uuid": "0dcd7e88-7167-4a20-8dac-533875b9d623", "comment": "Malware payload (Mirai)", "value": "dff1a84d676605204a0fd810b5752ec1c6564f55abef2fccc85668e6739f1767f00d80c9453bea8fa687277afafd24fc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347357, "uuid": "f9475558-a37d-47a6-8c03-047a31dc899f", "value": "T102F3C70AAF610EBBDCBFDD3702E9060139CCA55722A93B753674D528F50E54B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347357, "uuid": "fa43bdf0-5e66-4b11-9f74-64e74cb155b1", "value": "3072:wt80kR0Aq4zDeLZDWnu7rpv/eLMnO7n3:weRVzDeAnWr1G4nQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694347357, "uuid": "6a2ae606-30c5-4a2a-98d4-832c5fa8bbb5", "value": 161512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694347357, "uuid": "1797e2eb-d7c2-4b84-8a2e-3017e2a1887e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347357, "uuid": "8a5ff46d-fa29-469b-9325-9439b3e35cbe", "value": "cundi.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7427c0d0-4fd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694347580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347580, "uuid": "c2a406e5-aa49-4f19-a486-96ba25f66b7a", "comment": "Malware payload (Mirai)", "value": "03cbcff7c6392c11428ab8e10dbc3cee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347580, "uuid": "200fbfea-16db-4b3d-9c78-b09079ff371a", "comment": "Malware payload (Mirai)", "value": "8abe25315471efcde98f09bd027de99a407ce8029de6ec1c1139a566fd9f7ee5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347580, "uuid": "c5e1fbf4-9a8a-48b1-993f-4a5517762b13", "comment": "Malware payload (Mirai)", "value": "b8af6aaf295d588ce843b60abd20370100ccfe01", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347580, "uuid": "b2489aad-19c5-40f1-98c2-30137a3fe5a5", "comment": "Malware payload (Mirai)", "value": "c0e5e426277a86f76eea4994032e6bfad933c1a768be3b8ec540019bdfa0c58feb06f316a8ba932d2f78161c3d0bbb50", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347580, "uuid": "c405432f-6ef7-4816-9b56-d9a8863e1676", "value": "T1DDD3F846F9819B12D5C111BAFE0E124E37131B7CE2DE7302AD246F647B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347580, "uuid": "93dfd1e1-4d94-4030-8bf1-d50efd044fe1", "value": "1536:EonIP+Khsou8oHUlZxx58BFMJBXyDt857ugg+aVQSitiqiiu5Xzb50C52E8z0m00:XlURnyKBX15agg+aV+u5X/6C52lJ/J/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694347580, "uuid": "4b3f0f03-f521-4eef-9adb-cdfaeae1feeb", "value": 131932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694347580, "uuid": "0ec53f03-de18-4a1d-8e24-ff6bbe64d26f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347580, "uuid": "353a2c68-25c0-45f7-9201-a213119eb6ae", "value": "cundi.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1c4ab7-4f8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694319035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319035, "uuid": "87013e02-d5e1-4a38-863c-f65f805415d2", "comment": "Malware payload (Mirai)", "value": "d0a3d3b99ab6a4da27cd8a5ebd165932", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319035, "uuid": "c58872f1-5d7c-4bcf-836b-a7092f62d0f6", "comment": "Malware payload (Mirai)", "value": "8b66cbbda26db9a503fac3a16c1f0a87ee927196ad90f0b3d6ba21d910a1dc2b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319035, "uuid": "41ad7f31-7789-4d31-b525-480adff0b194", "comment": "Malware payload (Mirai)", "value": "e6a01e85d3b83a9eaac52f4add31be1d04455991", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319035, "uuid": "0452a866-5e64-4047-8152-efef373baba5", "comment": "Malware payload (Mirai)", "value": "8dd7a5fdae9f6f558e624ce6f3f1f15d375ca346e5f73da2fa15b5d52384fc1e1e1604feb93dca4c24f776de56f4bfd9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319035, "uuid": "ba32e5f1-9f59-4663-881d-9cd711467207", "value": "T16CC32945FC508B17C6C612BBFB4E428D7B2A1758D3EE72039D256F61378B96B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319035, "uuid": "2e83934c-690e-425c-878c-2d3577552cf6", "value": "1536:phtOKHEq5XRFOAKBc4Va2/sTgdkIpTvi02EHAdGul7WfwywrFv7M82ptlaGKKO9h:phkwhFOc4pkMdkIpzc6Au5cce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694319035, "uuid": "a0bd9d15-f491-4b21-af2c-1191e233301c", "value": 121600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694319035, "uuid": "4164e7e9-c9f6-48c5-ba21-46cf026dd3ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319035, "uuid": "98b9763a-db32-44e8-9abf-c428407e9580", "value": "cundi.arm-20230910-0410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14db17c3-4fab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694330670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694330670, "uuid": "908c81e9-7820-4338-a8c9-dd514caa704f", "comment": "Malware payload (Smoke Loader)", "value": "0d223ae59e8285e57e838b1e19be662d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694330670, "uuid": "e78982c0-a5b4-44ab-b298-e4a7d947cad3", "comment": "Malware payload (Smoke Loader)", "value": "8c17d5b20427304dc69fe6c8b4e203fa8077ccb1a252caec921c1586132758cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694330670, "uuid": "cb9f6e0d-5df2-4e2c-9f48-d9ccfaa7c53d", "comment": "Malware payload (Smoke Loader)", "value": "6c55f1f879721fca7cb650ddb541e3d5bae20c23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694330670, "uuid": "89973a72-d4f3-458a-b0d9-1f1090654a7d", "comment": "Malware payload (Smoke Loader)", "value": "d5b3d26033efc64640718c12f9094fa40675658875d05ecab93d7f3254fc8ddae4e35ccb40b8b998dfba0be0dcd39c32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694330670, "uuid": "b9a5ab3f-36b5-430c-a324-51b3f5c42f06", "value": "T1D6448C2377E0BC72D66707340F6EAEEC7B6EB8515E61434A23141E5B1D702B1DA2B326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694330670, "uuid": "e5561504-22bf-482b-a514-5f700302709d", "value": "3681be0c4196dc1f0159e8326f6ce58b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694330670, "uuid": "29530d5f-df64-4905-b420-e4436ee4313c", "value": "3072:QBcFI/LHnUEG9JDE8SOE9y++Nz0NFbnEcH1MTYazNqFCaHRGoPX2:wR/LHIrYHt/2z0PbxH1MnocBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694330670, "uuid": "c179d58a-ba0c-448c-9274-b660d19cb6d2", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694330670, "uuid": "e9663ebb-219e-455f-8960-08ffedacda26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694330670, "uuid": "2d80cf3a-192d-492e-b3be-5bb858a622e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93c1add-4fe0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694353763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353763, "uuid": "9933db6a-3ab5-4c5c-9c83-136b7965f041", "comment": "Malware payload (AgentTesla)", "value": "2002892be48f5adf11e4ef635d21980b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353763, "uuid": "78657db3-b440-45bc-9b41-fca165480f72", "comment": "Malware payload (AgentTesla)", "value": "8c65e5e6d77923704d5841bd760646005c375730af91093f63b2f8489004222e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353763, "uuid": "2344c75f-e082-4088-a6f2-6d28ec04e5a0", "comment": "Malware payload (AgentTesla)", "value": "4672febcabf4a46c53946c595c6a9e59f52861a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353763, "uuid": "6b3495d4-47ae-44db-8497-82fd6d9177fe", "comment": "Malware payload (AgentTesla)", "value": "ec9a4ba942651e619d5802e4c08c5dcd564d2a0701d6e08e8311059d3039e923013d78f824a35e918503a68183ef272c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353763, "uuid": "951ade6c-2b81-49b4-b936-c18038f990dd", "value": "T1412562F3FB442FE281C24DACB9E8D233A9D406807551B6BB7F69E941441543AF25F8B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353763, "uuid": "426b8208-b944-4709-9871-989f9b60cd1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353763, "uuid": "163056dc-a405-4e4f-9035-c30ea82bf35c", "value": "12288:0BC7qnu7YTVAzlqTDQKNxFXb3D7V5/xEaK:0BzuaV4qTDQKjFL3D7TbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694353763, "uuid": "a3aab12f-f60c-41ed-b1fa-3aae077cad90", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694353763, "uuid": "ba1d6dc7-9564-4260-bb23-02dcc97e6570", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353763, "uuid": "ba7191e1-31aa-4071-8b73-7f18092debe1", "value": "Swift details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a31853-4fd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694347388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347388, "uuid": "74e6396a-3462-4c86-ba65-65f2992128f1", "comment": "Malware payload (Mirai)", "value": "7feea654f04e198bf49aa3dde9a335b5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347388, "uuid": "007b0bce-78f2-4455-9e82-01f7a736883e", "comment": "Malware payload (Mirai)", "value": "8cfbed88717cea4f0c4a1b4c88f17d9c28d4c82259d2ab40eba9649f92ac7f9a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347388, "uuid": "5db95850-f2f5-4d75-8740-d0b70b8ff1a8", "comment": "Malware payload (Mirai)", "value": "aeb09b476a14a52e9a637d0f0de5afb5c061bdf9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347388, "uuid": "60ec88bc-24ce-4e5a-90cb-935ed4111df7", "comment": "Malware payload (Mirai)", "value": "4d7ab6922ea627da65765d0d393b14b830e8d1bf353e47f5655dd4f57ba3f016a8826371af15a6b998dabaae42e4918e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347388, "uuid": "d9757343-1050-4300-a842-33fc2013b942", "value": "T1CFD33A1775D1D4FDC8E9D5B44F9AA13AEA72B02C1238B16B27C4AE272E4EE305F1D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347388, "uuid": "ef3498af-9c45-420b-ab56-d94db0d6f152", "value": "3072:PntXxN16wQ4MyuaogvXpmQ3xzJMAbl4E:PntXNjXZ9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694347388, "uuid": "e3770f50-47d3-4a5a-bb7e-442fdca5c6c2", "value": 131384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694347388, "uuid": "cf3d0826-5c18-439f-b791-071e122a1f5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347388, "uuid": "4160b898-6878-472e-a82a-73ec780832d6", "value": "cundi.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccfe6666-4fe6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1694356319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694356319, "uuid": "41e4fc24-e918-46bd-ab92-1dfee18e8aab", "comment": "Malware payload (RecordBreaker)", "value": "2d54c50c74f1c1517fe00cc167f199da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694356319, "uuid": "c574c884-168a-48b7-9fce-e72d7659be7a", "comment": "Malware payload (RecordBreaker)", "value": "8d5f481be0bb03f0e59effda0fc86a0c9a7da2fb8964f2b4d00530f24231fc7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694356319, "uuid": "d60822d6-8129-4514-a769-aacebce9aa37", "comment": "Malware payload (RecordBreaker)", "value": "6d11846a184b32ef8eee63774d353a0a24a5dd55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694356319, "uuid": "5b731d16-861e-4e0d-9983-086bdad95d2f", "comment": "Malware payload (RecordBreaker)", "value": "ad5852fdf4f2bc3d328896c14d31e002c17b8b17ba82da507ca130995d96c5697f066ec5bcbc52c8df61b79f1bc9cc1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694356319, "uuid": "7a2cb662-9c26-483d-a697-e1a4234b8a93", "value": "T16D24AD13A5E1BC67D31787704F2E9AFC7B6EB85D6E21875623081E1F19306B1DA1B322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694356319, "uuid": "3aa93aa5-88b0-4acc-a23d-b353942aaf5e", "value": "65a668abd4854f30a044638efbe0edbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694356319, "uuid": "8e9f6568-a522-41b3-9a2d-0a5a71ed5143", "value": "3072:nVgIL+2JVqTZHkORrOxNf84SBlwHh5frhy3b:VgIL+2JkVmbilwzrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694356319, "uuid": "d4a4ace6-cbbe-4470-b7a2-fd992e749f91", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694356319, "uuid": "5b51741d-bbd8-41ec-adff-5a3b584ce613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694356319, "uuid": "6233a096-06a5-4f06-bf58-054840ca6dd1", "value": "2d54c50c74f1c1517fe00cc167f199da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662ac7e1-4fec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694358724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358724, "uuid": "6cbe521f-7146-4f0f-91ba-c1dcad0210c4", "comment": "Malware payload", "value": "86650eab1625458c2c321d53da0e9b86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358724, "uuid": "13e94b75-db5a-4e32-80d1-bc5f300d087c", "comment": "Malware payload", "value": "8de50c812b56694ee6e2d5d4634680849ef5f7e75cb7dcdcfbb217c5aac431a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358724, "uuid": "a428f12e-c80f-4938-acd5-c739bf72aefb", "comment": "Malware payload", "value": "6fcdc5fa4d5872221dc54050877cba692595d94c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358724, "uuid": "780b7c39-8a77-4a5e-ac47-c4f69fea9fc3", "comment": "Malware payload", "value": "693603ed7b9bce979820a4f39cb88448aa971b5b31d62afbdcf21f04385e67b86418232ea643c62dc0073b85cf11031c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358724, "uuid": "0fd99dc2-a8cb-45eb-94bf-5c5923db4711", "value": "T1505339DBF811DE7EF84DDB7A4017050AB571A3624D030F677367B86BA9362A00572F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358724, "uuid": "99116e9d-cfa3-4f8b-9d0a-88b113b74dc6", "value": "1536:j0yCZTex8Xs53tY8qWT5q80Sy6fEBsZaSgv8m53:Yy2ex8Xs53zx9AsfCsZaSMF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694358724, "uuid": "d7a80f38-e329-437e-8a7f-3d143b3ba84a", "value": 64572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694358724, "uuid": "fd8178a1-afb7-4ffb-a8fc-6953acb18ad9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358724, "uuid": "e38fc127-181e-40c7-af2a-2ee8e10d48ea", "value": "86650eab1625458c2c321d53da0e9b86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1594327a-501a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694378345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694378345, "uuid": "2f45e4ba-1898-4ee5-8877-1c31c3ae94cd", "comment": "Malware payload", "value": "aab45679f168655475ec95961c2ac816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakebat", "colour": "#66E9D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694378345, "uuid": "7b441e38-ed3d-4af4-a59d-374a061048da", "comment": "Malware payload", "value": "8e8e43a2f0069f081f5ffb77237faebcda9a46e8f8fd0e128500e74bbc9ea3a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakebat", "colour": "#66E9D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694378345, "uuid": "b4a7cf6e-edba-4e79-a4ff-60f39d6abb0a", "comment": "Malware payload", "value": "84517f91d1e894207962f4c7968b64c2b35b2517", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakebat", "colour": "#66E9D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694378345, "uuid": "e652261c-ed17-4210-805b-d16705e14940", "comment": "Malware payload", "value": "c53ff1415c8d105adbe6d82bfb5828740d92e415f2bb9ee6eb83013e234109f700544f6a50e9e3e93f3416a1f6a7b1f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakebat", "colour": "#66E9D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694378345, "uuid": "54e78a9c-71d0-493c-b568-a07cedc9dfb7", "value": "T1E7D164C7D75261D9D9B9C1398387B63EB8B0316943784BC7A940494E17B2BFAE43D348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694378345, "uuid": "5f2883ba-9571-4375-bd6a-cbe05fff12c2", "value": "96:UM5BVSj0fgfv1GI8Q36cI+mdbie/oRl+Nx:RBVfgfvUI8JRdOJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694378345, "uuid": "733ffddc-3336-4008-a05a-1453618540d7", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694378345, "uuid": "c25027b9-11c3-4e94-ac91-e6c1bfa2451e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694378345, "uuid": "ff65fef6-d845-406e-bcd3-7779d8fe8335", "value": "selection_596fc-5b0fb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07ed35e-4ffd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694366150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366150, "uuid": "4204dc2f-762c-472e-836f-b7cc57720828", "comment": "Malware payload", "value": "07572f6aafe13bd2fe54d078ee7d0b07", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366150, "uuid": "52c39332-5873-4869-a89e-fba4a2829f1c", "comment": "Malware payload", "value": "8f32c6e7a855a19ded8617330188cb214f0f28c9777cf633c0421e11446aa1a1", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366150, "uuid": "c031d626-8fe0-433e-b63e-eab66ecc8658", "comment": "Malware payload", "value": "1770e0e18db503aa0b3b9a242276e7f9ca8eaace", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366150, "uuid": "7aa78283-7e08-494c-8074-4939296fb362", "comment": "Malware payload", "value": "f4e800dbc1d9f019db620218e7c993a7680a100d8bbbd7bfeb53b987bd5d626e03d1b027bc3e1cbc526106f73243221d", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366150, "uuid": "9e3ec489-8e11-4a58-a34b-8ad94ebe23fe", "value": "T12B9423364533A0C7EFB31DF59489E04C17B107AAEA3012D53A9F9C8A87689B5835DD3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366150, "uuid": "3853ccc7-b1fb-4de8-beb2-6a9321c07405", "value": "12288:ex4/Nb7KzFz035e+yi+O29DRJkormkl0ZoALui2dee:bNwpo5e+DcJko6kymOpiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694366150, "uuid": "2731a5ab-476b-4f63-9168-c109f9b48a14", "value": 431385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694366150, "uuid": "1f8a7aa3-585f-4946-860b-842b0af917a7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366150, "uuid": "4302bf63-83bf-4c39-b48b-6da6462d4899", "value": "Swift details.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fd506c-4feb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694358190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358190, "uuid": "44658a7e-0513-437f-9d74-f2c671456e66", "comment": "Malware payload", "value": "0acfa00c8a016593ca0bc8cace616c37", "object_relation": "md5", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358190, "uuid": "70bf38be-a953-4231-9c90-e0e31a8fabd5", "comment": "Malware payload", "value": "909a6da6a41002e9de52506cb2ea023bf448506e70f9aaa6667f669ca4381d13", "object_relation": "sha256", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358190, "uuid": "1906bf97-bb77-48e6-ba72-871d6b7631b7", "comment": "Malware payload", "value": "d699e9ed4e4fd62194a4f00af452e84af9dc9aae", "object_relation": "sha1", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358190, "uuid": "0de9e596-9573-48ef-b6f8-03408c549267", "comment": "Malware payload", "value": "9ac8a0ac69cdf84b0d3f24d92d50b68dead6ed7c8124525a98e29100a96dc232289ffd6d2ee2d25ab6de9b2e9ff2f05b", "object_relation": "sha3-384", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358190, "uuid": "7a7ab62b-85a9-4112-94ef-bfb9f7b1aab2", "value": "T1A157337092158597E9EE403F6C4FDC2D0277AE856361E88E0364A7389F737A61E3AF50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358190, "uuid": "80213f0a-0722-484d-a6fc-658803267c72", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358190, "uuid": "ac5003fe-2121-4491-b3b8-dc5f5c97a272", "value": "393216:7qPjLFXlrSHHNxZzvdV14A+QhZw/UDOETgsvcGvVgmo4nWnpMpDfzvUAQy7m/JX:OP3FXNqtnzWA+QXuEz5dZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694358190, "uuid": "8caf50b4-fad1-4731-bb17-e7148f43c9d8", "value": 28749117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694358190, "uuid": "e7dc6c1c-e388-47a7-8f4e-5c43edc06b91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358190, "uuid": "69d38166-736e-45db-8d10-ad0afd248a7c", "value": "7WsuHrx0ZEN4cHdz6D5p4jPI0ErwTPE1AznDYx9G.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d567cbc-4faa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694330362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694330362, "uuid": "ea80e253-d238-414a-9314-5f0b874bb1a7", "comment": "Malware payload (RedLineStealer)", "value": "fd16028b1ee0c8f4e2e988937ed78fc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694330362, "uuid": "64c6cd31-27bd-4bd0-a6c2-8b264336f73f", "comment": "Malware payload (RedLineStealer)", "value": "954e904601dc53f7bb0ec45c5aa258876d4a5b9f3fd990fdc0a37b018ab6e825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694330362, "uuid": "f3104551-58f0-4278-bf40-9499dca13900", "comment": "Malware payload (RedLineStealer)", "value": "a8ddff2ce415710c4654cc8f9b20172442ba3ee4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694330362, "uuid": "d0bcaf9b-be52-4fc0-a77b-7765df623ef1", "comment": "Malware payload (RedLineStealer)", "value": "96bbe3e57d42b394e13278dbfb3db3e41d369831f576e78ff0caac4dee7ed5a61d76ed2b39c1098326919f6b1c96aa3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694330362, "uuid": "80284fc5-be62-42ce-b370-2cead9ac275a", "value": "T14594CF1335D0BB76C616433C0F6DEAEC7BEEB8615D21574A23241E5A1E306B3D62B326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694330362, "uuid": "ab32d2a3-2c84-46df-a0e3-7b6c753d8ed5", "value": "3681be0c4196dc1f0159e8326f6ce58b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694330362, "uuid": "93f8bfb1-1741-4ce8-bfe5-5266c8be94d8", "value": "6144:7eLNLWLQZABmscNWi+TW4jhpSfAWRDglqwq6FNmJf19RpAbFgcXf62:7ICLQZABmscNWLj2Tiq6FNi2Zgcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694330362, "uuid": "009cc595-284f-4403-9e3a-6ab101516f41", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694330362, "uuid": "20f6b3cb-e618-4c94-b0f9-87fa3c5a36de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694330362, "uuid": "5a33b33c-47a8-4565-969d-15a46a3f4698", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b87697-5027-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694384112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384112, "uuid": "e8a1771a-37eb-4dbd-ba01-90ad8e785d7d", "comment": "Malware payload (Amadey)", "value": "beae0b845f4357820704d8800a3294f7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384112, "uuid": "058f4dc3-e1c2-4ad1-9194-455381374e06", "comment": "Malware payload (Amadey)", "value": "9639194d52836b05f842c10260f9e93bb96d17fcca0a492d870455c6c6640a74", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384112, "uuid": "ae03a065-2c5b-4e8c-a35d-037a143cd130", "comment": "Malware payload (Amadey)", "value": "abb4e710bc8d674613b2e977289ca885ddadbd72", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384112, "uuid": "a50b4747-2119-4285-bcdd-bff1d0676e11", "comment": "Malware payload (Amadey)", "value": "c246fd52b33938d467bf99831ba3b23ea46917906dc9e989e2a45cb1e19d338c17f02149e6ea90690cc3a8b6fd6d18b6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384112, "uuid": "a3f72208-0c3e-4721-9cb0-5d2c42ee9f8c", "value": "T1AF65123879A29833D870193709E6DB305D7DE52156526DFBB3530AAF8F6028E93F061E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384112, "uuid": "caa4a204-ab7f-4293-8d05-6337b063b2df", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384112, "uuid": "ba8d9190-f87a-46fe-946e-72dd29082c25", "value": "24576:4q8CJ6U4bS0tjYRRYzql9qtJktklrxtGil9izAQsrJNO2ER92EvPrku1Hg:X8CJX0QGI9qHAG1zEsGx9/vPF1Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694384112, "uuid": "de488162-f413-4618-b2ea-b861eee510a2", "value": 1544568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694384112, "uuid": "7c09b921-cbf7-40f2-abb0-16d34b770deb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384112, "uuid": "78a91f2d-1e70-4938-9b53-15566b352ee8", "value": "beae0b845f4357820704d8800a3294f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb6098b-4ff9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694364398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694364398, "uuid": "e9285415-a1ed-4bad-81f6-0508db9461f9", "comment": "Malware payload (AgentTesla)", "value": "7a6d74cec3b7703a41fa781fd27fb344", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694364398, "uuid": "6a35d44c-2f22-4b6a-88b4-a78ed566f71f", "comment": "Malware payload (AgentTesla)", "value": "98b573325984121ad424ac5fb1cef7dd4800cf3f1fc4c66e86f3146b8d9c896d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694364398, "uuid": "b02a5246-0926-4bff-8967-48df111e1f4c", "comment": "Malware payload (AgentTesla)", "value": "c1360e7df73b7ced236326e3fb260a765147e614", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694364398, "uuid": "237d521b-4cdc-4f74-9ef0-82e6adf68d56", "comment": "Malware payload (AgentTesla)", "value": "10b7d23234d6e5bf0f74322ffde0619b486c2265aa59e0a08a5e02eb55d04e47e004725ae67aacda3b65bccdbe2091a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694364398, "uuid": "4f94176b-9b0f-4af5-aab0-6242fbebe40a", "value": "T190B4237F84E3CAF51021E9E739D99AB6ED3891301749483E943117BEB9B939C2D0B05B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694364398, "uuid": "d3120c7f-191a-40cf-8c95-8db7a8a86c51", "value": "12288:Ey3xNxwP3PIMmCLU80T5yEnml06fhBxg6HxIz0AClswlf2I+EI+tW5guI:n6vPIpCLUW7vFgVQswFp+JSuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694364398, "uuid": "acf65986-f5e6-446d-a2f0-93a40016592b", "value": 542627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694364398, "uuid": "14f37d74-7c47-4061-8d57-f8078ee4d60c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694364398, "uuid": "f71bc544-b00d-4943-96e3-2f8b0120c374", "value": "Payment confirmation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a976e982-4fa3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Arechclient2)", "timestamp": 1694327483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694327483, "uuid": "2a818b06-5a7a-460a-9191-da06cb94c909", "comment": "Malware payload (Arechclient2)", "value": "7da882933f44b450d3fc5e9915b7313e", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694327483, "uuid": "0b87e25d-aec7-4f10-ad67-0632940b8d32", "comment": "Malware payload (Arechclient2)", "value": "99254891543a79f2a6ea6163ff10dfd12c839655e8012d199ccc6b6c530d8f5f", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694327483, "uuid": "9113748b-93ff-4405-8026-2369df22cc8d", "comment": "Malware payload (Arechclient2)", "value": "27c71b6fd51fc8d1c869ddb773987b55354e017f", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694327483, "uuid": "fed48f6d-416d-40d9-be40-c3948aaef9d3", "comment": "Malware payload (Arechclient2)", "value": "b321248f259682895761a4025d6102d185ac28a9a360a660501c4d6c7e0e45e2868432708167c0a1d6d6f25c7fec1449", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694327483, "uuid": "037bc858-c93b-4bf9-921f-4b952c4f4200", "value": "T1E1B4272D764B9A36DED8F33881FF4A1C95B94262B2656D0F198C9CD02F8579DC34CB88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694327483, "uuid": "e03327cd-6ea1-40fe-8d2b-d9f041527ae2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694327483, "uuid": "bb0f79f2-96f6-47ec-81d0-ef6883a74943", "value": "6144:aDpKBbd2xAn8aRzgQqx0U2B/p4Igq/ya4iKj9MYYNW3ajkUQbug597uZ8bPH7zyj:Jf2xqWQ80UQuhWVNcaQUQbug592", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694327483, "uuid": "2691b480-053e-400d-8a44-314b90f7d753", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694327483, "uuid": "3a095846-8421-43fa-b62c-c789a8ccc04b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694327483, "uuid": "5aa98d01-9b4e-4772-8975-20f85f27436a", "value": "4ytaulfxfuv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33981802-500f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694373671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694373671, "uuid": "24f8aafa-77cf-4496-ba1c-345590b46f39", "comment": "Malware payload (RedLineStealer)", "value": "38247038e5918ea4638da0e13754e9cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694373671, "uuid": "b3ecd9aa-8743-40b1-85ff-7b172dd187b9", "comment": "Malware payload (RedLineStealer)", "value": "99fa84a8c38cf6d7c5340672cc129d5d24a2e30e565651d1778ade3b43d2b1ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694373671, "uuid": "ece70efd-59c7-43f1-a69a-fd660c41085d", "comment": "Malware payload (RedLineStealer)", "value": "dfee3b7f33cb9486e0006d8a409e8f0d9cda21ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694373671, "uuid": "f4a951f7-a846-4df4-ab5b-e34db7940de4", "comment": "Malware payload (RedLineStealer)", "value": "2efd530329035e8c3c3db808ca8bcae7e8609d75ea18985606ce71c96db535b80d31b12d00339e8a7026f119810a6bde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694373671, "uuid": "74fb8b38-ce07-405b-afea-9bf3dba68b4f", "value": "T1E584D0D365E1BC22E2568B340F2EAADC7B2E78A19E61975333041E2F19303F1CA57356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694373671, "uuid": "1a967d5f-8428-4bcc-998f-c769dec1e30b", "value": "4cf103460b980a8c131a7789354b386b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694373671, "uuid": "69f1ec5c-8211-494c-8f2d-d1dd41db00a6", "value": "6144:qLTnnZRgXpZ2rD2vaUPRCEKxA3GyHgFyBPJjuONhJ2sPtfY:qHnZ7DsaUpJKyWQeUNhJTtfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694373671, "uuid": "d6720695-efbc-4e82-b2f9-8252125c39b2", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694373671, "uuid": "9ee90dad-c4da-4305-97b7-2dadb65cf4d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694373671, "uuid": "1634840c-2b69-49e8-a939-d5be1010bbf3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6458e50-5015-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694376521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376521, "uuid": "e86a8661-6dac-46b1-9946-a635c0ec9a79", "comment": "Malware payload (RedLineStealer)", "value": "083ec102d3c3e745d9847adeafa6d4db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376521, "uuid": "9624182a-6f77-4b5c-ba2f-f7489936d0df", "comment": "Malware payload (RedLineStealer)", "value": "9a2f15ef6438df44074160f2011be55bcf6373a0deecf4b85bacc571cc8f48c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376521, "uuid": "bb275ffd-b1bd-4d73-b025-b0e03ade2d2a", "comment": "Malware payload (RedLineStealer)", "value": "49e518c095c9b3e9dd83d870018cfbbb216b27ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376521, "uuid": "589fb7af-ad74-40f6-bb44-02ece7a51243", "comment": "Malware payload (RedLineStealer)", "value": "c2b82734a5b318978b683edda6e14a59bdb05423f321b17ecf8c277b74d429ede7e24b0dad22dbcc709c86ddead74665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376521, "uuid": "dd5336fb-1615-40e2-8a20-df0e85d99c90", "value": "T146558D337C8C8171DFE150F906ACAB24C16FE0A48765CEC31696A6EE9F145F12B316DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376521, "uuid": "910b98ba-0bd6-4e90-b966-bb94aec0b69b", "value": "33ede84b4cb0967ffb7b14e9a46c056b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376521, "uuid": "fd334bd5-8796-4bb0-882e-681cc2d94308", "value": "24576:SlG6qqgrdGAtbc41kIk3T+qh9LqhF8fZ1B4P6xwU7DqrDh:fqgrdGAZcikzh9WhF8B1xaDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694376521, "uuid": "1bad61bf-43e1-4f45-9933-74683f1c930e", "value": 1289728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694376521, "uuid": "a124224c-c030-41b7-96f2-cbc17e72b559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376521, "uuid": "a34e6946-ce14-4564-8a83-4523933807ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259c2394-4fdf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694353032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353032, "uuid": "3df4169f-803d-400a-a688-9f00c0f554b4", "comment": "Malware payload (RedLineStealer)", "value": "a83da008a50c181d242cdf446df21ffd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353032, "uuid": "0d0591d6-ea19-4fc4-b2fe-3d4005f5a3e4", "comment": "Malware payload (RedLineStealer)", "value": "9cdf38cb0da9f91a8db0766d4de59676c4231ec590e9b3b29405e7880ce35c64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353032, "uuid": "5e48e579-4d8a-4604-8fc6-ca73c1db0ba9", "comment": "Malware payload (RedLineStealer)", "value": "eff0cc10facf05ed7fae76c5d81efa9cb1e1a5bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694353032, "uuid": "c3ff7213-5bc5-41fa-a0e2-96a4c2c524df", "comment": "Malware payload (RedLineStealer)", "value": "da7c57227611a78628a43babe57f1a05a970f8b8156749dca5539b1f9b07aba56dbcc2f51c8aeb1b698a68e703e538e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353032, "uuid": "4545251f-56be-46ef-884c-046190876ed2", "value": "T1EFF4129377D89066DCB92B708EF507931F3ABC520D78836B3655895A0CB3B84A93533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353032, "uuid": "03543f95-0a0a-475c-a42c-1fb92cbe11f5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353032, "uuid": "9c7fe75d-01cc-405c-814a-b770006b7663", "value": "12288:HMrmy901k6EO9Ay0s7pgCy+L66GMOxr1LKb8cLlCPVn2VN0u9eKFP/I49cX4dowW:VyCk6D9Ay0s1vxLV1OZ1LyLlM0D0u9ex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694353032, "uuid": "74019bec-0e52-4dad-be64-eab2a19d6ab5", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694353032, "uuid": "b1219251-dadc-476b-8a46-2a5ac1b2d507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694353032, "uuid": "7dfb3ea2-2de3-4cd1-9481-945e4b9c4689", "value": "a83da008a50c181d242cdf446df21ffd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52741f16-5023-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694382313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694382313, "uuid": "f7bc6161-93b4-40f0-b0a9-622343969f95", "comment": "Malware payload (Amadey)", "value": "0afb98205880c8ab435ca59bd2a502ae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694382313, "uuid": "3609604d-321a-4027-9d56-f4a72e5a0454", "comment": "Malware payload (Amadey)", "value": "9dbd99fa1c2374f30796069965e0e29d727295ce2a700a3a27cc7c384ab1a60d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694382313, "uuid": "5e837d96-73a3-4ea7-94ac-0851c12b6edd", "comment": "Malware payload (Amadey)", "value": "fee290ae1af41c3ec1d108bbbb64556bb633052b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694382313, "uuid": "55a04e7f-d7dc-4f49-8af4-e8de4d75946a", "comment": "Malware payload (Amadey)", "value": "19f5f1e35564a65b448f2498bdbdd12f7c0c2ff4f4415e63f77388fea49d73986d621c79b69090a7978ff22725d908f2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694382313, "uuid": "11e9377d-e287-4686-b961-8c260d426640", "value": "T1E6349D10B4E1C472D833153609F0FBB65A3EB9610B6199EFA7E40F7E4F302C1A675A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694382313, "uuid": "0a21a19f-0eb9-4384-8de0-9a33f9807243", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694382313, "uuid": "0b7d1d2b-b4f2-4768-8c73-e80ad5f29b71", "value": "6144:j09VU9z6DCGbAR/VeDC1tAOXcCiWqqzm5urBiIg:gw9zaC+UjStWj0urBiIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694382313, "uuid": "803b8f63-8afe-4c0d-958c-76c41e94c17a", "value": 253304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694382313, "uuid": "2a56fed6-0f35-4be8-92de-f5dd5dcb7c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694382313, "uuid": "0959a2a4-a2ca-4259-8b52-39233537ebf3", "value": "0afb98205880c8ab435ca59bd2a502ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4ec4c3-4fd9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694350493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694350493, "uuid": "939a879b-9b14-4151-8ac8-7d94b6ed4e3f", "comment": "Malware payload (Mirai)", "value": "661fc6a684c3c4417d005d609ab58447", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694350493, "uuid": "b9e83669-1946-4033-bdfd-b297386b6792", "comment": "Malware payload (Mirai)", "value": "a13469b887a3bc51c7d35b2b3bb174609bd5e7acf9a121b9ad77514efb66e03d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694350493, "uuid": "53ba4345-39d4-4000-8635-819b17125784", "comment": "Malware payload (Mirai)", "value": "cfbe3c53969493bc9ddfb29c5424935ddca3b88e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694350493, "uuid": "664c213a-c7be-4df9-9155-7a128f920aca", "comment": "Malware payload (Mirai)", "value": "c90232621faac75138f81c6096bfe578b8025e593412e6e12bde0c4330cc6257a87c49982832e67a1206803ee1bad633", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694350493, "uuid": "356b4445-f108-4681-955d-a7324434c474", "value": "T168C32A05B30C0947D2633EF43B3B67E1D3EF9A8121E4F640255FAA8A92B1E325546DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694350493, "uuid": "190861ad-f93c-4289-b854-23dcfaf80582", "value": "1536:sM/aSzDQvjwccxpZvT1N9u5fdzgU/dbM1bmvArId+9WzkXqwPVkaBCi6:a7UccxH71SvgUFbM1rMaBCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694350493, "uuid": "adbf8fdc-0f04-452f-b705-3fa9862c04e9", "value": 121720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694350493, "uuid": "c307428e-8f4d-4f2b-b48a-6ee4c37fdfc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694350493, "uuid": "8402abdf-fa3a-46df-8584-d869d62d7494", "value": "661fc6a684c3c4417d005d609ab58447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513f5829-502f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694387465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387465, "uuid": "adb3694c-bc29-4db9-bc3c-57346ff5449f", "comment": "Malware payload (Mirai)", "value": "0dd261b4b1dcf353d88cb9a8f494ece5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387465, "uuid": "459cded7-472e-4851-87cc-2bbaa0913278", "comment": "Malware payload (Mirai)", "value": "a14b1ad555d5ced0b547cd67f14f1db71e73613b2f888d88ea264491c1b56cdc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387465, "uuid": "fb1424e6-ad82-4aa5-ada7-2ae84fc67f14", "comment": "Malware payload (Mirai)", "value": "c4c4793b6dbc32ba90e638a55dbe8b9cc6319511", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387465, "uuid": "6214723f-99f8-470e-82ed-6bd0081c5d53", "comment": "Malware payload (Mirai)", "value": "59db3ae03445f9e615855bc3d4545c3642e36c3af7629651350e3d2f7783825f9d8a31582b013d960ab99cb120f79f17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387465, "uuid": "bb68d4d5-d767-43fb-961e-80eddd7eeb96", "value": "T192635C85A8028E7DF98AF67D50510E0BB520631165D30F2BA7AFFC93BE73169AD31D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387465, "uuid": "7fb954fa-a5e9-4919-bc37-016e2641998c", "value": "1536:cn7G+9XRoYmy0jHkFtXxMav88JvkkkwvpWsT+BB/:c7G+DE2Xx/NRvptT+BB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694387465, "uuid": "49202e4c-df05-49fa-8b69-e06535525cb2", "value": 67384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694387465, "uuid": "46fe59ab-3cb4-4ecd-a11d-d6b86befcdc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387465, "uuid": "75dbccd0-8b68-4899-b5db-6f194bd49478", "value": "0dd261b4b1dcf353d88cb9a8f494ece5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c452fc-4fed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694359015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359015, "uuid": "7d9e9b80-0ac5-4dfe-a284-2693435cffc8", "comment": "Malware payload (Mirai)", "value": "da9c20869ea74324150686ff61dad737", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359015, "uuid": "bebfe53a-f816-4040-96b0-6521b517ba5f", "comment": "Malware payload (Mirai)", "value": "a2d3763d65108aea92fcbea331ae846d7f9d4ce0e8da0102b807b74eaecc7b7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359015, "uuid": "c38f2fba-7996-43f1-b5f7-b868e6e54fc6", "comment": "Malware payload (Mirai)", "value": "a1e0d9c0da532a1d192ead3ce226d37c95fc735f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359015, "uuid": "22a33e62-b057-49d8-8f08-42e9c88d6ac0", "comment": "Malware payload (Mirai)", "value": "7a6314fda069bf8640be62a87d3cbbe9a8bd01383a849fe0941faedca22e5869ea7ff15a4ce33b0c5f994a5c8070feea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359015, "uuid": "da9d317c-c0ea-4ad5-ad91-732307d80f00", "value": "T1F3E30845FC509F22C6D2267BFF4E42CD372A5768D3EA720399255F20378A96B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359015, "uuid": "57567ef8-3aca-4a10-a94d-2a1b2ee54081", "value": "1536:cFxpdn/OxknROkFfc3Ho4l1dtfIEkKrNV7HfPI8QyADRgGT1LMvWf7OyFvqmRR0d:sPng3kFfcbZDD7//AeGdM+nCSB0rJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694359015, "uuid": "606fca6a-1942-4a39-a904-bda2dbd31e4b", "value": 154272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694359015, "uuid": "b5a0c5e6-45b1-48bf-a4e7-9e4918da2ae8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359015, "uuid": "446d54ae-0a09-4e95-87a5-5d78ddfccc9d", "value": "da9c20869ea74324150686ff61dad737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425c9148-4fb9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694336759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694336759, "uuid": "86c5081e-7170-4578-90e9-12e91a222317", "comment": "Malware payload (Smoke Loader)", "value": "417a8fe949369083cdedef1b45efd596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694336759, "uuid": "74c10f2c-a499-4e7a-b81a-0ef2471d486d", "comment": "Malware payload (Smoke Loader)", "value": "a2f28321fe155d154fee2fa53c6116b193e1c908ea0ae3aa7157ea739f38861d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694336759, "uuid": "a700174c-c0fb-4c65-8884-936ac96b9599", "comment": "Malware payload (Smoke Loader)", "value": "7fde2eb10af2a853f5b010af08e274cdf7db272f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694336759, "uuid": "22a4a220-293a-42cf-9731-3ac3c8322b4f", "comment": "Malware payload (Smoke Loader)", "value": "8c01e9b5407f9a5676ccfb53dc8e55eff6cb0f5496305083d3bdf38c2a08d89546d200dfca948f6f1b0acf0edd8fccee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694336759, "uuid": "7d2e9fb9-73e2-4229-95ce-a48ba9316457", "value": "T1945512207A9EC432E97181321DB49BB78E6EE4E31E92859F53D41B7D1F342C0D638A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694336759, "uuid": "d856a7b9-ddf8-45fb-aab1-80c693263ac0", "value": "2627254264278e0e80567712e48122f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694336759, "uuid": "21d12bed-116f-43e9-9a29-745b287f35b1", "value": "24576:trhavbW+Kmo/81PshfTPmPZzgh70t9MwYFL0NRa+/kM+kXWdcZVZqzTJ:ravy+Fd1Cfa+h70t9ThNSM+EWSZATJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694336759, "uuid": "a98b00c6-5718-487b-97b3-d82111646024", "value": 1391104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694336759, "uuid": "382cae8d-e75c-4503-b1a2-0b10c4b11d8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694336759, "uuid": "218047fe-2798-43d8-b85c-21f77fdda057", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee63497-4fa5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694328432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694328432, "uuid": "3527f5d6-b1d4-4a4e-8464-b33a72caf098", "comment": "Malware payload (RemcosRAT)", "value": "01db651e342f6ad0f21a21bde1c6e4be", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694328432, "uuid": "40ad8a69-7091-416d-8d72-9d3dae3e5c19", "comment": "Malware payload (RemcosRAT)", "value": "a3b8758d2b0c4bdb9568a41eb6190e648d0f15f186e5d6294c2361c13ce6ef03", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694328432, "uuid": "2ca176ee-1a00-456f-976c-7e3893d1c81e", "comment": "Malware payload (RemcosRAT)", "value": "9031f9e3bd5322401e1ad952ca4855224e414c77", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694328432, "uuid": "eb90f070-2b96-4103-ba53-1723290c93b8", "comment": "Malware payload (RemcosRAT)", "value": "1a5a84e38b02d5e99bb15e9b4507b9c6564a381ee58849cd27c6c875e42c0f58db8ae7f28a46ff0c939645dd22ae1409", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694328432, "uuid": "c96ef754-1017-4cdd-8768-3f54755d60c3", "value": "T1CA84234822B09CEE22EA4151D845441AE8E76C36224E69D95478530FA3DC3C6FFDF6FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694328432, "uuid": "f0dba4f0-ab78-4910-9798-df6877ebde39", "value": "12288:0sPKX/tG+zAEDCadZUa2+QTAPt4l64dhxO:AnznvUbTstkjdhxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694328432, "uuid": "ad759de4-d27e-47e9-bd14-0fcd24d4ac4e", "value": 396570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694328432, "uuid": "f65abeff-e680-4bb5-875a-ed5d6112f8d6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694328432, "uuid": "fc6e2519-68fb-4e60-9ad4-f1ce85783943", "value": "QBPOS Purchase.doc.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e175bc-5012-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694374906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374906, "uuid": "b939373f-7f99-4150-8fb8-a2ccc8accdd6", "comment": "Malware payload", "value": "b4977403c11e69daab9a02c8d625989b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374906, "uuid": "710bc61c-21d7-466a-8b21-8eabe2217f54", "comment": "Malware payload", "value": "a52b1bac7fc89df6491f6528ef4ed0f23b35d7e55b5c133ae6488f3efa80fba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374906, "uuid": "56773de1-3cfc-4515-81da-0920f30e6d5d", "comment": "Malware payload", "value": "80e598aacd94dcf91b7b7ef0e0022b87279cff8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694374906, "uuid": "e71bc2a8-6655-490d-8385-58ccc8e59652", "comment": "Malware payload", "value": "2571afe1856f1d5244ba65b24661a7ab1a3e2cc97fb5c6d955b2401171abb58c1996edc827f9172611d05d97f99c4417", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374906, "uuid": "0df5f613-1b5b-47fb-ab03-d2d6c72b46e5", "value": "T10C655B2139CCB571DDE210FB86ECB922171EE07107F569EB56C4D6EE86185CD2A3328E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374906, "uuid": "af904550-d326-4b58-bad8-595fe7c9eda0", "value": "e4946bca3cf74c7fc3c827baccb3d9fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374906, "uuid": "00dee3a3-96cd-47dd-b1c7-b082aba02027", "value": "24576:gaak+9VhfeBeoYK3M1yyJES3xfb2dZwR:ga2hfeBeQe+efbowR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694374906, "uuid": "4fa791f9-7347-41ee-844f-6ae3227fa353", "value": 1483264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694374906, "uuid": "5fea7958-4586-4693-918a-61613bb6192f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694374906, "uuid": "e3cc7360-0656-4224-9e2c-69fcb70cfc65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b7c5e4-4fa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Neshta)", "timestamp": 1694326616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326616, "uuid": "167250f6-75c9-4de6-bb04-5d84dbb7d7a6", "comment": "Malware payload (Neshta)", "value": "e996ae777960ec9ddf1e07c7b97fa73d", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326616, "uuid": "2f725ada-8b21-4db8-8307-a4e22839b52c", "comment": "Malware payload (Neshta)", "value": "a70f78b6e6c7b1c253d80e595a0303df422aaf88dcf13265435a2296b9221fc6", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326616, "uuid": "d72f8166-aea4-4787-9771-7f3633daf24f", "comment": "Malware payload (Neshta)", "value": "8b1fc27da2aba418ca9c642d292485ccd89c00f9", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326616, "uuid": "ea5e598d-5479-4d34-b5a6-1b7209a7411e", "comment": "Malware payload (Neshta)", "value": "b011dd7d2c5ddb788fc24592f16a4ef56ecbca786dbf340ebade1942b57b62ddb45854778e82e63c3baf57b7c2637007", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694326616, "uuid": "47b7e920-b456-45a7-940b-abc5da0dba89", "value": "T1264523906E6D473FF49857B984BA009C83F2651B186BE60EBF8C77C51BC37822861667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694326616, "uuid": "ac37124a-33a1-46ad-ae2d-fe6a34af8a34", "value": "12288:09/XENJgOFPXywz9Hrraz8pI5ZYOZjSpiwgWzsqrtdWzp:M/XCPfycHf3yYeGpiwgWz9J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694326616, "uuid": "12528c0c-cee3-4f44-91dc-334c1894af53", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694326616, "uuid": "08aaa646-138d-4c98-8de7-cbb618d88384", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694326616, "uuid": "2e7bac00-ff76-405d-b422-ed518a31e29c", "value": "PAYMENT SWIFT print copy.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecde443a-4fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694355514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355514, "uuid": "9a2eafda-d843-40fa-aa1f-481d041c9e27", "comment": "Malware payload", "value": "d233b6cc0a9d05ec3992300cef77c43f", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355514, "uuid": "eaa432ca-ddae-4feb-bfea-575d6e3db937", "comment": "Malware payload", "value": "a73491dfcdbec9944b93d3585f2f839f254c149b3153e3b861e40a365d8bf4a1", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355514, "uuid": "53f0f80d-1a39-471a-bb97-cbfc291d8762", "comment": "Malware payload", "value": "36bd41ef455e54b303cf3566c4dabdb20aec4d4d", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355514, "uuid": "cadd8076-d1c5-4550-9697-0f43125547e1", "comment": "Malware payload", "value": "a9da736337fcc0789f9f65b0cb3d0b0579d33970bdf9fea3d52031097807d710c57b4540060c1c70073f3be9f474d53f", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355514, "uuid": "fe498ba3-e8f5-4179-b800-bdaafa470e93", "value": "T1ED6382D13E88F055C7590A350FE1C9ADB233BC0C4D16AE4B3539B7BD2E715ACA872A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355514, "uuid": "202af15e-c9b4-46e0-8bfa-d509ca5db4cd", "value": "1536:yAPxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAlpqHZrEY:BPxEtjPOtioVjDGUU1qfDlaGGx+cL2Q7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694355514, "uuid": "e1e927a3-f67e-47a7-82d5-8855379ea9f7", "value": 71168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694355514, "uuid": "29f59110-12d8-4ebc-96b2-c3d02ff7a020", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355514, "uuid": "bff60bff-2e85-4bfc-8bad-afe0c46cfb9c", "value": "Lista de comenzi.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9332fa7-5028-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694384713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384713, "uuid": "33243b00-8827-43f1-9f13-1c7987cae780", "comment": "Malware payload (Amadey)", "value": "e43ca6c6bff0b2ff9c4c3621ba1a206d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384713, "uuid": "96e1ac05-6042-45ee-a911-b984708cc471", "comment": "Malware payload (Amadey)", "value": "a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384713, "uuid": "1d9516be-51ed-4a53-abc1-38effb26c4f1", "comment": "Malware payload (Amadey)", "value": "20b794ce89c8192feba8200bedf47a4d3b2f032a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384713, "uuid": "6e4249b0-3203-45b5-9fb9-3048d5a7fb83", "comment": "Malware payload (Amadey)", "value": "4c8cdb195a7d6c6ddf2be747de7b895cebac36d73bb4f746060fafcfcefe102c39c33bbc58f26d33b830e5cf01a038df", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384713, "uuid": "84c7f05c-92fe-4703-beca-3c3ec976acba", "value": "T106349D11B4D1C433D832153609F0EBB55A3EB9600B659AEFA7A40F7E4F303C1AB75A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384713, "uuid": "69f6f98b-1eb8-4f64-b1b0-93b315977e11", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384713, "uuid": "0f551544-5408-4a56-be5e-685602475f39", "value": "6144:kM1Ukz6DCGbAR/VeDC1tAOTcCywRLYurBiIg:kdkzaC+UjuLwuurBiIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694384713, "uuid": "aa161917-8f04-4f51-ba62-227e982fed57", "value": 253304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694384713, "uuid": "7b62caf2-f3f0-424f-9c6e-9eb2e1d8fae8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384713, "uuid": "6e816e50-a79a-41fa-8c74-f010873a031a", "value": "e43ca6c6bff0b2ff9c4c3621ba1a206d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e4287e-4fe5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694355909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355909, "uuid": "4a235356-ec74-46c5-b48f-945757b58e1d", "comment": "Malware payload (RedLineStealer)", "value": "c399d561802271d65a57e75ad93f4f6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355909, "uuid": "8598c6c2-29d7-40f4-939a-830e0089abf6", "comment": "Malware payload (RedLineStealer)", "value": "a86c40b7336f60749b61736fdb2192f3079baacf4893fe9d572b1891927b7ef6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355909, "uuid": "d1f550ce-a50c-4397-8df4-163c6ac67581", "comment": "Malware payload (RedLineStealer)", "value": "ab3a3c814c4bf194ee45e071606025c8281bc612", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355909, "uuid": "c3f82107-5843-4a90-9697-a1bb84c62c65", "comment": "Malware payload (RedLineStealer)", "value": "c5bf46fc45d7c26048a5d5c8679334474ac80a11c80b8b830c723cd98566c66a801ddbad97cd8fec392a9821c84f8352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355909, "uuid": "43a29b45-911b-44ec-b1af-d15f10fbcf2b", "value": "T10A651260B4D3C072E6A606314AF1DBB20F7BB8211790E69B57A41EFF4EE43D046716B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355909, "uuid": "59d09a04-9943-42ed-9bf0-41c84b452519", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355909, "uuid": "49d3401b-b5dc-4cbd-9289-1b93724395e9", "value": "24576:JmyCWngNFXwfP2k8vfJnEAUBY3ReZzW7XEFnGl7yfzBVc4ktuHIEwd6oE1:oyCWgNFAf9At9U4gZzCXEamLBilBlrE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694355909, "uuid": "7c6363c2-0a93-4b3d-9b62-35ad7485407a", "value": 1441280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694355909, "uuid": "1981c7d4-3735-4c4f-ab37-a8562456debd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355909, "uuid": "1d2bede9-5e1d-4b19-9371-137894bdcfbb", "value": "c399d561802271d65a57e75ad93f4f6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87bb44b6-5013-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694375530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694375530, "uuid": "24213a78-d69b-4146-b460-887ca07451ea", "comment": "Malware payload", "value": "8a10220957fdf2698ebdf8acaa62013a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694375530, "uuid": "f70ce234-3d80-47be-bd28-7751496f1998", "comment": "Malware payload", "value": "a8b91c111eccc6225f33b06f8ff5e5ec0093df0ec35db93fccd98136dbb65e94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694375530, "uuid": "f9233e18-d02a-4bda-858a-77b255050606", "comment": "Malware payload", "value": "c4685bf4167a8be08d435a72fa46a2679e92fab4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694375530, "uuid": "97afdea0-9f4e-4b1b-ac14-5c1dc927ee9f", "comment": "Malware payload", "value": "bd7e9e068d1ba0a1cd33319bf5b22e241c9776f3bd1386e97469ff92fe572e53d05889bca4311be129289c0019d1e5a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694375530, "uuid": "028f65eb-6450-4405-85b6-972dee723aae", "value": "T107249C1364E1BC62D55B87344F2D96DC3B2FB8619E659B5AF2042E1F09323B1CAD7322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694375530, "uuid": "99efd903-c5d1-4e27-af7f-842f55afb6d3", "value": "4cf103460b980a8c131a7789354b386b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694375530, "uuid": "dfb74654-f968-4757-afeb-015bb728734a", "value": "3072:aUfeLq1RpputBScJN9NQ6nsUyt9ho0jZL9FFpWSB81593P4BVGix:rWLqP2tI7Rbd9FZBq3cE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694375530, "uuid": "87cd162f-55ed-44f1-9216-5ceece363261", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694375530, "uuid": "93e21b89-04bd-4089-b5b0-03a7651d2ac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694375530, "uuid": "85f554f5-a908-42f1-ac31-d6445eb16429", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e382fcb8-4fa5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694328440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694328440, "uuid": "a7f10bdd-4256-4503-8318-8eca679dc138", "comment": "Malware payload (RemcosRAT)", "value": "5a5e01532d13cc779f1ad7bbc89b843d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694328440, "uuid": "ccaec69c-4e99-4889-8a14-76b3e9d046b2", "comment": "Malware payload (RemcosRAT)", "value": "a94dc2ec5ba36249dcf25e76a013cad2ff628acc349e5478705c0cb92bc6050d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694328440, "uuid": "3cbefeb5-432a-4da0-ad3c-3f92a9950444", "comment": "Malware payload (RemcosRAT)", "value": "47f6e0e4ab46672bd631d3c4813832de3fe4c92d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694328440, "uuid": "aa23af8b-1af1-4f27-9e41-66d48c7f8621", "comment": "Malware payload (RemcosRAT)", "value": "d58abce19474cd4f7b73f500655cdccef3e479f7be4b07a31465782c8279d54f8357af400033d0a8f19dc318f1007db7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694328440, "uuid": "5d864ab5-c75c-4937-b27b-ae0c6e60022f", "value": "T156357EE272588C71F0A23539C80972D0357BB8FDAD3E5C8D466D390A5AB2B91792C47F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694328440, "uuid": "05c24098-8ee6-4b97-933a-929482d32d21", "value": "e7e2298ab9c4c8059ee2958188f46ba7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694328440, "uuid": "65a5245c-fb51-4be5-b999-995156692198", "value": "12288:xU9TRsANxDiPickb0YJ10//Or/5nF9jt0Bg7jsLOM1IRywStDZRA3+B9dkchjuhr:xUhRD2Pilr10QBFf0eFuPD+4mwln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694328440, "uuid": "1c805e6b-f5bc-4fe6-bbdd-dcf32d1fb5fb", "value": 1125376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694328440, "uuid": "1dbb00fc-5d29-4148-b9cb-1272b3d0c0c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694328440, "uuid": "6a7bfe96-f571-47d8-bdcc-2bef1155b41e", "value": "QBPOS Purchase.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e73bbd7-5014-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694375864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694375864, "uuid": "7ad60d7e-bf41-47d9-9583-0344b85a051c", "comment": "Malware payload", "value": "3fe0f2bc8d6b9b20bf959dc6c49a2c5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694375864, "uuid": "d5d69948-d103-4903-be54-9bfbbcd9a201", "comment": "Malware payload", "value": "a95af7f4c5471dd676469218acfd1e904c89b9a1e413f0dd2bcfa5b1eea46431", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694375864, "uuid": "81053ed6-dae2-4ee2-9e64-cc564c54a629", "comment": "Malware payload", "value": "a557292d750ef6625b706f760703a12d7695b168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694375864, "uuid": "b9375d65-6aff-4185-80e7-46a0dc386e73", "comment": "Malware payload", "value": "afa1cdedf8859e2392bebe0af81a39f530297ca01f22fd0d536e43a4d6daf42fcb89fba229e6ffa54e30bdbd3e4deeca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694375864, "uuid": "f4ff78b6-86e6-4b6d-aaf7-b8fb2704f903", "value": "T19A249D13A5E0BF32E46783340F2D96DC3B6EB8615E658756324B6E6F1D312B1CA93312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694375864, "uuid": "a13dc89f-dfe0-4026-b1ec-ccf212c24466", "value": "4cf103460b980a8c131a7789354b386b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694375864, "uuid": "0dfea2ef-4ef4-4e38-94a3-e356b17c9e58", "value": "3072:b5G4LxU4Rqz7guWO/VKhcwDANC+SqTbwH1K1592466x:1pLxxe7gy/VChDANC+SK0m2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694375864, "uuid": "16bbc9f8-8a35-40fa-92e0-7f94448e4fe8", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694375864, "uuid": "dc598429-1910-49ba-bcb5-0a42577a936c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694375864, "uuid": "24cb8fdd-d171-4b0b-92aa-8dc9fe15ca3c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8844f16b-4fac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694331293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694331293, "uuid": "ee554555-73c9-4430-ae01-ae6196cff011", "comment": "Malware payload (Stealc)", "value": "479df8b150fe48b3b1dda6405214371b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694331293, "uuid": "e6282ae5-a42b-4c95-abb4-bd6f4d35a9ac", "comment": "Malware payload (Stealc)", "value": "ae124eaa39189cfaa3cd5a74837e40732efdf6e1850e3dccebd903fb0d619482", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694331293, "uuid": "52b5e384-c8a2-4336-9905-853555e5f5e1", "comment": "Malware payload (Stealc)", "value": "cf6badcdf1d3104aa14754b6534c156ac8d57706", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694331293, "uuid": "eff57b48-5553-4c9b-b7d2-30480eead8ca", "comment": "Malware payload (Stealc)", "value": "9e759a9c9a57e5234759e1ab0fcc585e0a7dc41ce4906fcdf21fc991ce017925d7e27330bb8ad11c85de44349546be16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694331293, "uuid": "0d42e6e8-cdc5-4abc-a45b-93b41659fc6b", "value": "T145447C13A5E0FCB2D66747304E6DAADCFB6EB8605E614377231C3E5A19305B1C62B326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694331293, "uuid": "e1098c70-e073-460a-a864-3baa2181b343", "value": "3681be0c4196dc1f0159e8326f6ce58b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694331293, "uuid": "fb2d5243-ef43-46b6-a98a-490a58a6ba22", "value": "3072:qByI/LHnUEG9JOkU2jORzGprTugB49y7F0jsHRG5ds+X2:Sr/LHIrOk5xBy2uy6jfw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694331293, "uuid": "c497d8d9-d6e9-46d9-ab85-efc737f9559e", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694331293, "uuid": "944ab28f-9bd7-4433-abd7-57f81ad40e00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694331293, "uuid": "57f08608-c5ab-423c-ba06-8f75e5cf1b75", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d016aff0-4fb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694336138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694336138, "uuid": "bd4f50b1-ca7a-41a1-b142-3b0c2897f296", "comment": "Malware payload (Stealc)", "value": "0c988bbe4a1db9c20909e79de28b013e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694336138, "uuid": "b5fa83cf-ee6c-4f24-beae-d423cfaf20fe", "comment": "Malware payload (Stealc)", "value": "aef16c0c7295575a58ce7e963c271b5007589ac404af1ec5a186a34ff080fb7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694336138, "uuid": "6f45d9e4-3fda-4c33-ac71-563cb5c79c65", "comment": "Malware payload (Stealc)", "value": "588b459fb76ecf67bec77f281f77b7074bd51271", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694336138, "uuid": "23c33340-7527-4e27-aa7e-e159a36678c8", "comment": "Malware payload (Stealc)", "value": "44678c5799c937096826e44e76a80c1eb796706db2f7544492a8a0105a1b3ee856eb186a7b7516fb34bff8c4d59000b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694336138, "uuid": "30be86c2-9f08-4e63-9749-74ff31521e14", "value": "T104348C1325E0BC7ED25703354F6DBAEC7B6EF8605E66C74B23141E6A1A302B1D61B326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694336138, "uuid": "40c5645c-9446-4b5d-9dc4-f8459d1a1e30", "value": "cda48ebb1fe57d9b31da3a94fc154bf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694336138, "uuid": "61204d20-6674-4dd9-821b-81b910f68a92", "value": "3072:ojuTe8LI8UF82KICODSRVHCF07FThMCCgm3OBfAp0fl1Z53Zy+h:GuTe8LW8mCiSRlAghk2RO0NNZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694336138, "uuid": "8f4f336d-4a45-472d-855a-9c3ef67b3fe8", "value": 248320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694336138, "uuid": "5e841a40-1b3e-41b1-bc37-c538e0581432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694336138, "uuid": "440ad6b0-5c29-4457-88f5-35c03fc42ca7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2425a1-4fff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694366953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366953, "uuid": "eb41ea57-2a2f-4dae-868b-25e41033452d", "comment": "Malware payload", "value": "30b2b8976783b2d54677d2b27a3298d0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "javaw", "colour": "#D2895B", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366953, "uuid": "69281c14-56d1-4569-b654-985bed90cfae", "comment": "Malware payload", "value": "b0c5cb853ab96f7dcde49f806ae104a08e2a3ceeaee7a16e58ea00cff106c84d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "javaw", "colour": "#D2895B", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366953, "uuid": "a960f597-9650-41ff-a8a5-74121c7268ca", "comment": "Malware payload", "value": "ed002da8af67e0d0d636610284d1f028009b410a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "javaw", "colour": "#D2895B", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366953, "uuid": "834513a4-323d-41de-a425-6bf2643adad3", "comment": "Malware payload", "value": "15868e6caa3252338cfea3fa021f74392ff17d220da500b5e62787f532202931895d2fd043790ca9e2a4da7848616922", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "javaw", "colour": "#D2895B", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366953, "uuid": "5f9389a2-cd1c-49d7-b108-feae676c8c3d", "value": "T1F935F12366F9D07DD97343B7A65446E6FE2B03A8D10AD87018B137C368A9C0BAF5674C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366953, "uuid": "25c46524-415a-43ff-b29b-0c0e77367aeb", "value": "24576:hKL7CWGa7hvQKaikK21SHCJ3ny+SGiPsGSabtLC2/e0cU8cb7:hVghYKai1viny6iPH5BZ/e02W7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694366953, "uuid": "59dfae78-7970-4254-9370-525a931fdcfb", "value": 1082007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694366953, "uuid": "13f26159-5b7e-4868-b160-6668582b4ff9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366953, "uuid": "261171e8-f6ce-4d8d-858b-27383e01edc5", "value": "SKlauncher-3.1.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d235dc2c-4fd1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694347308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347308, "uuid": "cd3a07ea-82c5-4e7f-8ac4-e2978c784203", "comment": "Malware payload (Mirai)", "value": "24fa628603f35c7daea6f25378a05aa4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347308, "uuid": "a38cea2f-c015-4f17-9ef1-e7b780b005ae", "comment": "Malware payload (Mirai)", "value": "b10dbf49f44202c1e8584fe6bc913b010ff2ded484c324828c300043fe832bb3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347308, "uuid": "1867b1a3-bdb5-466a-a1e8-cbbba013df0e", "comment": "Malware payload (Mirai)", "value": "a804f32a1eb332e16babab692bf5298abb5d0283", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347308, "uuid": "32523157-2c22-451d-a9a2-3df54e5446de", "comment": "Malware payload (Mirai)", "value": "7d136bcf37bd6486f2eb9ec25a7f47be16e0536d788c8460307c1b67f263c29db73638f3f42766d089b28f2554335ad9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347308, "uuid": "0f1a0b22-7fee-4d0a-ab94-5c430934810d", "value": "T118F3A95E6F338F6EF668873147B74925975923DA22E1D684E2ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347308, "uuid": "4894f130-e877-4915-bdec-725d25fe130a", "value": "1536:9MXVmdO9OdSAZTZtZd9BG9rc0eNsslP1zKTfNYoDF8jkmxWy0K:9M0PhZtv9BercxssDwYo58jPxWy0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694347308, "uuid": "f79687c5-3f53-4b3c-a235-0f5a6b6deefd", "value": 161416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694347308, "uuid": "5ad3db17-bcd6-48fc-bcac-073e606b5653", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347308, "uuid": "e907e586-6643-4628-b27a-9882e8d1056a", "value": "cundi.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5042e842-5023-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694382309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694382309, "uuid": "154055b0-2c9f-4b8c-800a-f410d3ffe774", "comment": "Malware payload (RedLineStealer)", "value": "221dd954d9bfbc1f41f5b30953401453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694382309, "uuid": "f8cf7447-5359-4315-945b-8e1edf33bd65", "comment": "Malware payload (RedLineStealer)", "value": "b1e2a3c398285245e9f23bcc6ed924620c76a703f6403495e29fd13df598131a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694382309, "uuid": "d2a12dc8-58a2-44ed-8df5-19ebdc13d545", "comment": "Malware payload (RedLineStealer)", "value": "d870cde7bd9c2da0c73483cc958b70df82cdea9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694382309, "uuid": "7aa5a4f6-4f26-4d1e-bc9b-c0e0d689e071", "comment": "Malware payload (RedLineStealer)", "value": "819ca5cdd9ba8fc9fb01a4f9ec0426c6eb382f891cd9475e734058ad2c677e92069443b098c4faee899bdcec1d52c25f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694382309, "uuid": "a5e11389-6179-4490-87b3-7d522c77a118", "value": "T1A765121170E1E973EC232C3549F4D6B8493DB8910B8998EF63C90A3DD7A53B186B497B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694382309, "uuid": "2123c147-17ce-4ed1-bc46-19d71ee97061", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694382309, "uuid": "8a78979f-26c0-470b-ad78-81cc490246d1", "value": "24576:KIzCJKSWDErfNqTYwuHrxLAKZQJneWkARgD51kbAw2arTMHnGXgu1Hg:TzCJKg7NqTqHdLAT9eWLRgnk51XsnGN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694382309, "uuid": "2c9a820c-4b3f-4b68-8f0d-65f1f2881c7c", "value": 1544568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694382309, "uuid": "8b33fe11-8405-4659-954a-a63586dbb4ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694382309, "uuid": "eeaa0fe3-cf7a-48a5-ae57-93ee1a480fa2", "value": "221dd954d9bfbc1f41f5b30953401453.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2dd4135-4fff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694366986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366986, "uuid": "2c47d19c-dac9-43c6-b97c-87e5480a4dff", "comment": "Malware payload", "value": "18066c35c98519270a4fa9d1e5312661", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366986, "uuid": "6033bb56-fbad-4d28-bb1f-9bd0a59e7474", "comment": "Malware payload", "value": "b23980490a512200d8d9b799a7f6a11279859862a5a151730a9548bdd079565e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366986, "uuid": "cb965425-d410-45b5-a16c-8b0e18412729", "comment": "Malware payload", "value": "bf528e7ee2871ce4a01e63662df9b63dc64257dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366986, "uuid": "ece3762a-6345-42c8-bf80-8e6dcebc5ec4", "comment": "Malware payload", "value": "dbbd03fb5b06a4791bd42f4fe6a27eee45c25eaf6e302ca131b36f01ac1a85ef06de77ce4ef6078b5a8a8b9a29390a66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366986, "uuid": "b5db2fbd-d777-4da7-ad14-34b9d8bf6367", "value": "T1F2634B327D770D27C0D4A87561F7473AF6BB974725AC8A0A7D720E8CAF662402217BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366986, "uuid": "b4da2f56-1dc0-426f-9aa0-9e5bd7e7f4bb", "value": "768:sMMGXl2XDgMFpnOLvoJJodlXI+KFCqn1JO+IrhHQT/lH+E0DHm:s9GXegKweudl4+wCqnLI9HQLln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694366986, "uuid": "686a7046-a1a6-41bb-b866-1f361ba11ff4", "value": 66996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694366986, "uuid": "8d9d1247-12f0-4522-8399-645d16bce4c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366986, "uuid": "b69505f8-7e08-494d-b08f-9879cc7c0985", "value": "SecuriteInfo.com.ELF.Mirai-CFR.30224.26703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ca82e3-4fa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Neshta)", "timestamp": 1694326866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326866, "uuid": "9c3007c7-15df-4c9f-88a7-4cc9b694446c", "comment": "Malware payload (Neshta)", "value": "0e7fc013ebc7eff6c13bed84c29174bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326866, "uuid": "b5e9d938-8f3b-406f-968b-bd34d1d8c6a1", "comment": "Malware payload (Neshta)", "value": "b63557e2a7e7fd2c0fc2e0d5084da08d62586963b22ad22e6b683fb9ee2934c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326866, "uuid": "bbb5b540-ac26-40f9-8164-7bad72a48558", "comment": "Malware payload (Neshta)", "value": "0387efb0b1c783a4ce6cd0fee605f8e229ca20ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694326866, "uuid": "74b34a2e-89cd-4d24-ab3b-ba75809ed370", "comment": "Malware payload (Neshta)", "value": "a5852bfeb9bd8c0f413cc36e338c0d90a2dc61beaf60d08543f0cb2e011439f9e21bd1b314c17c2f50d9c795eee532ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694326866, "uuid": "c98f7885-a912-45fb-86ae-f0bf892757d1", "value": "T11FE423907EAD473FF49857B984BA049C83F2652B186BF70E8FC57BC615C37822462267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694326866, "uuid": "69dc1cc9-92b4-4522-aef9-45b23c0c9390", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694326866, "uuid": "37392abf-cff2-40e1-85d4-87df42cbb105", "value": "12288:/9/XENJgOFPXywz9Hrraz8pI5ZYOZjSpiwgWzsqrtdWzp:F/XCPfycHf3yYeGpiwgWz9J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694326866, "uuid": "6051028d-1c85-4772-9b14-1c48f88bffa2", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694326866, "uuid": "3ff7ef3f-9aca-4f3f-9292-dc9ce78489f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694326866, "uuid": "32f1b6e0-e1ca-4ad2-bce7-25c72f235c00", "value": "LYCWZUVJ.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1fa9a1-4fee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694359812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359812, "uuid": "eca885d0-8287-4af2-8dfc-65e7fab90141", "comment": "Malware payload (RedLineStealer)", "value": "8b9272d38a1fc39423a9ae0ada7c1197", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359812, "uuid": "748a0745-e2f2-47d8-ba28-16f3fdff148c", "comment": "Malware payload (RedLineStealer)", "value": "b6dbab0251f7dc75749babd8a98c8072df0ae4bd9767198cf2381d667e2222f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359812, "uuid": "6129c7b0-f0fd-4f18-befd-d69f6f438883", "comment": "Malware payload (RedLineStealer)", "value": "acd50f2b220e40f8e6a73d3fa622cd9d1b3320c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694359812, "uuid": "bd7eee2c-929f-42d2-9182-83c2009aced9", "comment": "Malware payload (RedLineStealer)", "value": "48920fadd74695ee4ea183d0b9eb8ec5f5945379bf889f0e4dcfa53700af79cda7f411d8b070623e89ed8bc062b4a56d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359812, "uuid": "b62b977d-b629-4087-828b-d21c6fffe20f", "value": "T1C165124075E5C473C92EE53208E2A7BA9E3DED38837326AB93F45E7F0B911D1A170856", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359812, "uuid": "dbc5d92a-02b6-40c5-a4b1-289bebf99b3e", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359812, "uuid": "1118480a-2615-4ea7-a6f4-5c0217a7c4b5", "value": "24576:Y97CWkGIOF+W+Wxh+YtHzTjziDWHbzNciqGGS7cQ42KAUttR/1:c7CWkGJFHxjzHziDMzNH0S7cQ42Ktn/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694359812, "uuid": "7c3415e1-7268-439c-bb33-fcda01b31d76", "value": 1439232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694359812, "uuid": "6e130f37-d74e-4a49-85c9-58685491ee56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694359812, "uuid": "f342d4f6-a996-4e6f-ae01-8784ac4153ec", "value": "8b9272d38a1fc39423a9ae0ada7c1197.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77f8bab-4fe6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694356310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694356310, "uuid": "a252e411-8037-4d35-b287-b5e0db41094c", "comment": "Malware payload (RedLineStealer)", "value": "1a18fc4db3affaacf43f4022df7a2c32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694356310, "uuid": "8c0bc401-1a05-404c-a176-79a009935506", "comment": "Malware payload (RedLineStealer)", "value": "b76a4488c5fa797828b85f998054f6e879b4c213d639f4501c725337b71e6c32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694356310, "uuid": "f534e701-7bea-4c0a-b668-c11de0b531b3", "comment": "Malware payload (RedLineStealer)", "value": "2ef240262c43bdd5f6a9db9f7e6abb1e408366ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694356310, "uuid": "3e1086a7-9673-4b76-af8f-415fc698c12c", "comment": "Malware payload (RedLineStealer)", "value": "75d742ae157655c2441f45939fbb541950bfcaef58831c59987c31199b6e551cfd87071c826f3a1145081fa0dfe0f6fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694356310, "uuid": "2bdc9301-11b3-4b7e-a258-66d14520fc59", "value": "T19A559CE038BCB121EFD223B941BC67E8A5AFB4B5072945C716B406E9D7115C36BB3C86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694356310, "uuid": "9d19dbf3-8343-4045-bbde-bd1191eb36be", "value": "33ede84b4cb0967ffb7b14e9a46c056b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694356310, "uuid": "240575fe-02a3-4e7d-9454-273847f56fec", "value": "24576:RlG6qqgrdGA97sAVkIk3T+CBlrVd/3IaCWzHrDh:OqgrdGApsKkzplpOaCCDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694356310, "uuid": "e48668d4-cebe-4f04-9f8e-9a007bb8fc42", "value": 1289728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694356310, "uuid": "6a4fa368-9a07-46b5-b059-58de366941a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694356310, "uuid": "e5be8dfb-2a2c-40c8-8314-2b48f3b99f06", "value": "1a18fc4db3affaacf43f4022df7a2c32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02dd64a2-4fba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694337082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337082, "uuid": "9a1d40fa-b3ce-449f-a60a-4308deb7af3b", "comment": "Malware payload (AgentTesla)", "value": "cee2a5a00473314ba50670556319c531", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337082, "uuid": "42262f72-fbf6-45e1-9090-e9409daff392", "comment": "Malware payload (AgentTesla)", "value": "b7eb6f772c63ec369da67b5ece3075b71122757846e5783917d8d0a2ed34ee6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337082, "uuid": "9e67c488-a6ee-4a6f-bcce-b2a001f27312", "comment": "Malware payload (AgentTesla)", "value": "bc742ff053d78e51e53ba688dff92b08c56e012f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337082, "uuid": "6ce257d2-0eba-43cb-9b3b-b32b06863d6a", "comment": "Malware payload (AgentTesla)", "value": "f7829502162eb46dd97e5c41ad5f4d75b7af10a0849f47261a6e868439f9d9d58bc320049215cce5a2ecd7542ed44564", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337082, "uuid": "af7adc18-67f6-4d0a-ada6-f750dacbb480", "value": "T19EE4237B7953A3B6C064823283CB81E1C6A35759A2A57C995FE87CFF05D709BE210B4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337082, "uuid": "c707fe28-2b1b-4710-b928-0ce68d5b9f7f", "value": "12288:s4nW+I3s7zem4fxwK50d3IEv/ASjpB1ydRmJsvpLlXWEmOhlvRX30P0hxRQuO2Aj:la3mec3kSCRLRRmF4lGIPQuO2AeiCqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694337082, "uuid": "24028cf4-1dff-4a05-aa28-c7b2b1ff1a03", "value": 691713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694337082, "uuid": "6f2f746f-d95f-4fc2-8a83-af51750f0622", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337082, "uuid": "30b0d768-5061-43a3-ae49-140b38a2555d", "value": "Remzi Tacyildiz PO184383.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567fc904-4f9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694325196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694325196, "uuid": "fc7c503c-911e-418a-92f8-4edc8242d0bf", "comment": "Malware payload", "value": "9aa04a8cc01243dc3e71e62d9aa786f8", "object_relation": "md5", "Tag": [ { "name": "anydes-cc", "colour": "#0F33B4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694325196, "uuid": "80f9ad39-dd4a-43a3-855a-dc3d673a18c6", "comment": "Malware payload", "value": "bbc7b6d4e2448c205430a73b780933c7b66c2712bb623479e10ec0dec8643842", "object_relation": "sha256", "Tag": [ { "name": "anydes-cc", "colour": "#0F33B4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694325196, "uuid": "ecbc9942-6334-4409-91b9-2274aac0ba5e", "comment": "Malware payload", "value": "3edd5c19ff476edc745b50b4d65da5deb282f346", "object_relation": "sha1", "Tag": [ { "name": "anydes-cc", "colour": "#0F33B4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694325196, "uuid": "ba8140d0-a8ef-4657-bbc3-d76ed42411f2", "comment": "Malware payload", "value": "f30e86c9aeda0eb57aa9e2faee873a1645db2b688658390fa785eb6a56586b7a6558291f1578c010ec6eb0eaff250177", "object_relation": "sha3-384", "Tag": [ { "name": "anydes-cc", "colour": "#0F33B4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694325196, "uuid": "a274e154-27a8-49e1-a573-61e24d74cef7", "value": "T1C031450BE20F42B5FB9956D2F5946D0ED844984F6606BC75B6E893C0AF260B5834B05F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694325196, "uuid": "97eeb6a4-5e88-4ba3-8c55-b7fa1dcc1ecf", "value": "48:flIc+fttLEjCY41Fc05GKWUEk7WYYlaVcmDt:flIcSNQCYmcMGKfEcR3Pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694325196, "uuid": "acf9b973-0863-47e6-bc5e-7ba2b7be4e70", "value": 1771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694325196, "uuid": "eebc6a46-79b0-4df8-b6a3-c47d5a9e17b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694325196, "uuid": "a25d3bd1-e86b-4156-ac6c-10e733421242", "value": "kin_mix%2Bnotion%20_new_21.08.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84c8ce4-4fc5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694342084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694342084, "uuid": "d9844585-0338-4f69-8a74-72bcdf812ac0", "comment": "Malware payload", "value": "1a6a20c93ade1b8af9f326140a92aef4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694342084, "uuid": "af973083-e00c-42ec-9037-93ba60c2523c", "comment": "Malware payload", "value": "bccd4c8104367f0d9f96167c71f5ec348f163ede23e31cb86cfde28e2d3132cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694342084, "uuid": "35fab113-cef2-4c29-aba6-985c913b6c80", "comment": "Malware payload", "value": "41bb82a2026019b7e7a85c93679a2c99edf3c51a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694342084, "uuid": "da6327cc-fb8e-4eeb-a83a-e668c68b43a2", "comment": "Malware payload", "value": "51508fc72689c630cc519e0dc18d3bea731e218708cd04983692192ba8aa2dc69ad01fb745433718d98897940182639a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694342084, "uuid": "b795ceae-7c74-4362-b74d-de5300fea489", "value": "T184C52302B7C180B3E97318321B59AF91A6797D301F3589DB93C46A6DEF235C05A327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694342084, "uuid": "dff8a457-b77c-401a-beec-e0a6e05b76a3", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694342084, "uuid": "2219c3da-075d-4186-8a0e-f75b497a80e5", "value": "49152:rLLfR5IX9tkAzSLS0tS3kOeogXeQT55OsEP4d6bA1:rnReX9tvSs0bogXeQTXpiV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694342084, "uuid": "9a172cec-1ccc-4df3-a031-135d61c59872", "value": 2509412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694342084, "uuid": "1a2872de-2301-47f7-96e0-2acf98f7dbf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694342084, "uuid": "50b2b8c1-3088-4e0c-9390-32acfb561a7a", "value": "SecuriteInfo.com.Win32.TrojanX-gen.27344.27838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09576792-4f91-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694319484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319484, "uuid": "5bf13adb-384d-43e0-be04-3b2b00110237", "comment": "Malware payload", "value": "97325593f51f6ac58bfd2983c98da85e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319484, "uuid": "a05066db-6c5a-4de5-ad5b-0d144ee387f4", "comment": "Malware payload", "value": "bdd9226e47b60c21d1bdfc794e223d1f52b9f67441e5d021fc5f9f463fb4125e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319484, "uuid": "8887ce52-ccff-4ed4-8bc2-57780a4ae24f", "comment": "Malware payload", "value": "3df290a132f91a1fda8f45d8332349004c0d6455", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319484, "uuid": "1aa8f967-48cd-40c2-a03e-5b7e8a70582c", "comment": "Malware payload", "value": "04f124bf8031d9a2b587483c43d0179d3a9ea3c90d3c37aec4c2b431cac9cbe6156fa9f119e30e012fbda48432f7c1b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319484, "uuid": "96604cf7-02d8-4911-ba70-7077c93aa949", "value": "T1413623F694DFFCEBEB18E939A7605423DEA34069540F0934D48CB803D68EFB56A5C660", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319484, "uuid": "3848bb69-06c7-42b4-bbcd-ef26e7aace3a", "value": "829c09b185702c1f62f61f818604057c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319484, "uuid": "d46cd0e0-2d49-4a99-9e3b-9c4c1260debf", "value": "98304:VXI+UKBIPs2VEJ1ki3smtma78CSj40CI4kIXLG3M/myLow8AS:eKBIkZJ1k6URVI0mdLXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694319484, "uuid": "6e614568-2332-4afc-8e31-67d1e0ea9106", "value": 5331688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694319484, "uuid": "de2f3a6d-0557-448f-9968-d05ef79993b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319484, "uuid": "884ae419-efdc-478d-a794-81d465273ce7", "value": "97325593f51f6ac58bfd2983c98da85e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3eec0f2-4fff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694366988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366988, "uuid": "ef7f7aa6-d684-469e-b86a-c1dfe663c5af", "comment": "Malware payload", "value": "d40178720c9ad27e2daf7b317a330952", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366988, "uuid": "bdb4f081-5ea3-4dae-9db0-2d2ba7a0c9c2", "comment": "Malware payload", "value": "bf037eeb26080f3562031b3a3e77cb99de9f8541c4fe6947feccd501cb75eddf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366988, "uuid": "e82690b2-2a79-4c42-ab26-c2079b26bbd6", "comment": "Malware payload", "value": "3523e9cd579e8d3ca5d5e3ad2ca851102aebbbbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366988, "uuid": "37029ee5-16b7-4edc-a4da-26a0154ddd99", "comment": "Malware payload", "value": "b05f785b05a87576ddda6e798148d5869dd5c2ed6ae383a39c72c0fbff139acce881aa31f38ae114b42d140bf494735f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366988, "uuid": "b89c61c4-6b18-4ea3-932c-bd1cc3a3e534", "value": "T172430A30114176BCF4F9003EF41B12B661B3072EBFEEE7DBA4A2A139E6605442976E75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366988, "uuid": "aa564bf1-e10d-45ff-bb6f-edc781b90840", "value": "1536:nY3FzqJL1nuyf19FE3GxCk3JUH0j8NSi04:nYVuXuEr8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694366988, "uuid": "9de998a9-e7a8-4b9c-b199-6133e9a8122c", "value": 59932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694366988, "uuid": "70339146-62e1-4705-a698-21088c526568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366988, "uuid": "c98b6472-f666-4dc5-b1cc-9f86efc8f080", "value": "SecuriteInfo.com.ELF.Mirai-CFR.5044.24556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcdf915-5028-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694384613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384613, "uuid": "508b9e3b-64ad-491a-8d0f-a5ec65c9050a", "comment": "Malware payload (Mirai)", "value": "fff9caf399880febe84db4f2a717415c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384613, "uuid": "06f80cb8-e9a3-4d30-8f9f-3fc7861fae40", "comment": "Malware payload (Mirai)", "value": "c0b2b6e1973dff62f693121ca3bd37b936436c9224f5c67adf336472b05ea00f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384613, "uuid": "ad2a6633-6ebe-4faf-bc6f-6326b78ae251", "comment": "Malware payload (Mirai)", "value": "f4863299b89c3c06a634eb7dbd2bb3e225c1d51c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384613, "uuid": "9df618d9-b02a-4b64-994c-8347980185cb", "comment": "Malware payload (Mirai)", "value": "dd863a581b3a4e7d573113c14402706bdc4fb3f471db90c5d2ca202058af81941c0725b9cf588c6266a8a206f32bbb4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384613, "uuid": "ffa8167f-0ce6-4705-b145-38978eb687ba", "value": "T18AA2D020A68A9D74C5B02479FF30CB8355B547F4D3E3B2432501B7B2B64B90A5AB899F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384613, "uuid": "e453a694-804e-4bca-9579-25d86c28820e", "value": "384:csy5nw1slwz37vLwqYANye4H12ky29OQsJxF5+20vplhymdGUop5hKd:csywsoSg4H4H295sLT0vpls3UozYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694384613, "uuid": "870d1101-afeb-49f2-bdda-493cfabc00c4", "value": 22508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694384613, "uuid": "c864d1be-218d-424e-8758-bb75e290589b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384613, "uuid": "f4e97b50-72c2-477d-8164-a68ba39cf749", "value": "fff9caf399880febe84db4f2a717415c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8960eb-4fb9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694337043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337043, "uuid": "e6b7b636-8624-4007-b3c0-a5ae949b6ab9", "comment": "Malware payload (SnakeKeylogger)", "value": "11cc764dde7f7ac7b07e1b5d743e0013", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337043, "uuid": "12b20275-04e4-4dda-83a8-afc625007f71", "comment": "Malware payload (SnakeKeylogger)", "value": "c1c786f11398b34c1ad810db36dff9e0880b36cd3580098e6b07c3bcfc84c787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337043, "uuid": "38b385ee-93e6-4246-a895-cdf9e28a6a29", "comment": "Malware payload (SnakeKeylogger)", "value": "992f8587f960b930d8e891d37635a1a68a09b412", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337043, "uuid": "8ef8f792-fdb4-4fc6-b658-d0c424eaac74", "comment": "Malware payload (SnakeKeylogger)", "value": "fbd9d9fa71bb94bcde9684fd6fb104956927ed673345671190e389c34224bd9b6c0173105e3468320d8a138b70d8b63a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337043, "uuid": "0376f64b-9059-4f9f-ac48-263ae6459da0", "value": "T1D5B4023827EC8B59E5BE9739F470904007B5F26B1223F65E4F4220DF2A667A49904FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337043, "uuid": "9b7ec74c-3614-4277-a8a3-0e90eee17538", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337043, "uuid": "35d0e6c0-2944-4b2e-b2c6-d671538148dc", "value": "12288:GjVtXd/e1pd/upd/E2PKhk246c4MrgrMU0OViUYQF2xRTSns:GjTXdG2PKWTQMQViUY1Xss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694337043, "uuid": "6e1d76cc-7d2c-4dca-8b16-558da25d1afc", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694337043, "uuid": "8c16b615-fccb-492e-b432-42f324a77ccd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337043, "uuid": "b81cc282-9066-4145-a3ff-08f1c3a38659", "value": "11cc764dde7f7ac7b07e1b5d743e0013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbda575d-4f9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694324508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694324508, "uuid": "ad6dffc0-a29c-460c-a82a-03b2fedb66fc", "comment": "Malware payload", "value": "0787b3b6049ce57921fa6f32fcc33c67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694324508, "uuid": "317e7d87-decd-4dd3-b660-97950b1d82b7", "comment": "Malware payload", "value": "c27968c70424a38c6f692921062abcdd71714ad0ab1e6a16abaf28fc44602253", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694324508, "uuid": "a40d7344-6aaf-43b9-a33e-39362b502db6", "comment": "Malware payload", "value": "68f8f51a33a5f4aaf34392ecf43f53cca9816cf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694324508, "uuid": "fd0f3661-f315-49ba-a59c-71dd48d83237", "comment": "Malware payload", "value": "a96d5c419a0bc6c3d29971e557c5ce7f9d81a4f9a870993a5e95b78e40b3b53e529b5a355917f2169081301d61530b60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694324508, "uuid": "ae81c26c-0aca-437f-945e-0d277c2dabb7", "value": "T15C45BE078441307BFBDA87F03FA7882CD8AA58D8F507D494B71A12D183A5EB96F0569F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694324508, "uuid": "e9c83495-2fa2-4270-81d6-fa1c8c9e4667", "value": "f8a3459bab630e159efff3fdf5aa1788", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694324508, "uuid": "c6df8f6d-566d-41ff-88db-7e0f4f5b6844", "value": "24576:nCpCajB3BZcVYwg1PqwaxMu6eo89TZ4fFq0Y:nu1ghr1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694324508, "uuid": "fffe9669-8681-4ffa-ae29-9318e2e6f45c", "value": 1179288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694324508, "uuid": "7a36d377-a8fb-480a-be61-5b99772a3bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694324508, "uuid": "20359138-19bf-4ac5-8318-a4db3c4b38f4", "value": "0787b3b6049ce57921fa6f32fcc33c67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f025c8-4fff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694366984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366984, "uuid": "dd0e6ac9-cb36-47fa-ba3e-9d09f177bbfb", "comment": "Malware payload", "value": "fd17b96479aa754e9b39f18cc126b6ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366984, "uuid": "255bc835-8eed-40e5-b486-1c121e656a74", "comment": "Malware payload", "value": "c2d57db0733962630a62af61e4c5150469715c967439ab17b224a5e0e28e8915", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366984, "uuid": "b7444da7-d9a1-4d3e-bb1b-8524c60dd8e0", "comment": "Malware payload", "value": "38703382d5326d59b47c8ea39a2a49628c23f126", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366984, "uuid": "baaf2cc0-686c-4c3c-aee6-a24a78d201db", "comment": "Malware payload", "value": "79d0284a8872e05d2e7715538ce05e6af19828dbce0cdd1e53bed600d9cbcf2ca0a23d972bd16d1fa664f18c5213b941", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366984, "uuid": "0f757d16-e73b-4841-9c26-e6b066931f8f", "value": "T17D532A41B3280983D46B6EB0363F27D593AEEE5020F5E284755FBA5EC171E321247EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366984, "uuid": "10b92bc1-72d3-406c-a421-cbda1682ae33", "value": "1536:WfJhhRPJl3bB9ldg/iUmJYmaB9ldtr+H9zB7+dZJ+nwzcqId25ELoM:8fPJpbB9ldg/iUmJWB9ldtKdzBidZ0nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694366984, "uuid": "e50075dc-0f2d-407b-9be5-cd80ed2d509c", "value": 60884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694366984, "uuid": "9c19ea68-1146-40c6-b815-9597abe8229e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366984, "uuid": "2dfae67b-6d1e-4e51-afd7-0ade693f4667", "value": "SecuriteInfo.com.ELF.Mirai-CFR.22258.16980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8cb2ea2-4fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694355507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355507, "uuid": "9a6010fa-c8b8-40d4-a390-68a6bc23f275", "comment": "Malware payload", "value": "84caa8d3849caeb4264e54aa95a81d70", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355507, "uuid": "ef4b79db-ae59-4a35-828e-408e85ed821a", "comment": "Malware payload", "value": "c35a6ebdca67922ec242d49395daebe8295a2508a6557a19e05ee75bef455702", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355507, "uuid": "a26b3e8b-96ea-42e2-880c-a11eeaf31c24", "comment": "Malware payload", "value": "8e1eccae7927d8088e0fa502291d0ebae70ae0ff", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694355507, "uuid": "971a6f47-128c-443f-88f2-ca88a36b0736", "comment": "Malware payload", "value": "a82cf0370a2d62ba97a9600ce4573336723c2a4f606993c8c4dd1af3c9295b12c7397894e189ad1c99189e3db79d0ca6", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355507, "uuid": "247f0556-ac22-41ba-bd73-f97185a3c129", "value": "T117532F5635CFBC68D6661E33CAA3B2F72E32FC105E2582073214F79D6A739404D6663A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355507, "uuid": "5cb0feb0-bfb3-4bb8-b31c-3c01e2721c34", "value": "1536:yPxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAPJHY6M+k:yPxEtjPOtioVjDGUU1qfDlaGGx+cL2QA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694355507, "uuid": "f57862bc-0e52-4a9d-80f1-31f539d04207", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694355507, "uuid": "b272090b-575a-4558-afd6-d16bd3b36902", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694355507, "uuid": "fcb5d043-63ed-4469-9d67-364892cb497d", "value": "Order List.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0931a02-4fbf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694339575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339575, "uuid": "dcbdcbff-c058-4931-a3f4-66f4b7095dce", "comment": "Malware payload", "value": "fbb81188661a2ded094de4c76fbf8fc1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "titanaquaplus-xyz", "colour": "#786C32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339575, "uuid": "d6e6db7d-2421-4d7b-a1af-a0c85427e9f2", "comment": "Malware payload", "value": "c36f8349b5d678490922834069b9ade80c374cc649a021d3239516124bd879f0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "titanaquaplus-xyz", "colour": "#786C32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339575, "uuid": "684122c0-e2d9-42fc-96f3-ea40a50b9f22", "comment": "Malware payload", "value": "df75f6c3b98d6a4a0be06b29f514890198594d6d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "titanaquaplus-xyz", "colour": "#786C32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339575, "uuid": "3c759127-ce08-47e1-ab6c-10c35c0cbf03", "comment": "Malware payload", "value": "4328ca70b0157eb80b25ba4c40689bca3368a4350ab983644af2b87bddb5775f79d754e58b067fe46a3655943a738873", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "titanaquaplus-xyz", "colour": "#786C32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339575, "uuid": "72d0a38b-a994-4c66-9656-ed2d2458b457", "value": "T18B5127102BFA0720F7F39B797CBE561484B7BC45EA22CF0D4051494C1975A20E8AAF7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339575, "uuid": "9cf72508-f4ce-4d7b-b6f1-d10908253de3", "value": "48:8g5abUExPAyCOfHzBIIM+xPh/ypO2dNZx2N7CZx:8g5cUEeyCOfHzB2+v/ypOHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694339575, "uuid": "013db8d3-8feb-4eb0-8fde-3a7906465588", "value": 2828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694339575, "uuid": "471369b9-19e4-4ea4-a140-6ddbef7b49b1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339575, "uuid": "5e7800f7-2f66-4ff2-a5e5-e051bace3569", "value": "Allergy_List4.xlsx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58dab4e-4fec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694358910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358910, "uuid": "5c0fd1b6-3f86-4747-9533-79bf8ae106cd", "comment": "Malware payload (RedLineStealer)", "value": "2535f8cb82709b30fc6869167bc53d51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358910, "uuid": "00c9a623-1301-4689-9afa-833ff7191f03", "comment": "Malware payload (RedLineStealer)", "value": "c3de8f808b7c5b3b37549bb8b6bea11463eed6a74532797f9a4214c1b5ea747f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358910, "uuid": "9782b4f9-62e8-4428-86c0-d91f13acf5f2", "comment": "Malware payload (RedLineStealer)", "value": "f55c2b4694af43ebcaa26cf55b7347748cf11a41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358910, "uuid": "905b5842-f6aa-4ff9-a68e-4995b86af490", "comment": "Malware payload (RedLineStealer)", "value": "f64aeaf14246922636754c13ef102d1d781157df9288662d8320e3614f89bb4e6b7d36309e62ed33f35cdf9ec69bc7f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358910, "uuid": "4a53f8ec-9985-4918-b02f-99b88fbf5785", "value": "T13F651210BDE2C533C3B60A718EB19276463D79A24B2255BFB7A40A3D4F65EF0C362752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358910, "uuid": "e82e4abb-8025-4ddd-883e-791e8e7201f7", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358910, "uuid": "23fbe659-ba85-418f-bc6e-e76959993f88", "value": "24576:lwnCWu1Nf1tVl3Nq4I8zryaxejICXOlAR77M7sTiALgBKUL4eKbCOJR1:6nCWuff1tLkSzrIjLm47YIPLbHXbCOJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694358910, "uuid": "b2107bd9-3866-4dc1-b1a5-0fbfe369ad65", "value": 1441280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694358910, "uuid": "02c0dfda-4ea6-4462-97c5-bd999396c889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358910, "uuid": "58181853-3c97-49d6-858c-9b43796e170d", "value": "2535f8cb82709b30fc6869167bc53d51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c322967-4fba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694337125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337125, "uuid": "e959388f-5497-4f49-9b79-80fd2a3a8ecb", "comment": "Malware payload", "value": "1c19d362dd5a626698b23df4485adfc6", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337125, "uuid": "39299f25-d9dc-408b-99d9-dac919ab6ffb", "comment": "Malware payload", "value": "c8004f944055296f2636a64f8a469b9db6c9e983305f83ddc50c0617950d2271", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337125, "uuid": "e4b2a907-e0d9-4404-ba26-a74161f38fb7", "comment": "Malware payload", "value": "08302f5e4eaf4a62c88eecb157e0123233bee766", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337125, "uuid": "00737a00-00b1-4340-a9f7-a77ae26ce369", "comment": "Malware payload", "value": "288fca9589d98adbb52b6029e805c11e7066281f272292a0d8a09f27ea2751efc529b9f378fd1c58cf0d6ec346bf966a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337125, "uuid": "25d8e01c-0674-491d-8177-fd9a3f6c4ebf", "value": "T143212C0829DE1B21D37BAA37547A931689777453FC738F5D015085CC2906A11F9B5F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337125, "uuid": "2d8e6cc7-9a7a-4582-bf7c-5507ac80d391", "value": "24:8wLJtnyUlVefXXcmlz3L+PsBAkI4I0W5/2lC:8ujmxbFBBI/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694337125, "uuid": "1c28e3dd-a1b3-4c75-9b15-c65ad16a2684", "value": 1182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694337125, "uuid": "92c9c5d7-3366-49f4-b177-34c5a8a5afa8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337125, "uuid": "c607b816-3780-4c04-9de0-131e33db27f4", "value": "document-07september_2023 (203).lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ec028c-4f82-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694313066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313066, "uuid": "f2f1b1d0-488f-425f-8f92-52e7d670c4ba", "comment": "Malware payload (RedLineStealer)", "value": "ea5b12ca6f15b2f612d0822401901f0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313066, "uuid": "085f8b6c-3ad6-47ce-85c0-58959b87d507", "comment": "Malware payload (RedLineStealer)", "value": "ca54c6e3edac0185342ae18baa70ba469bdafa338fc67fba81fad6796e963ff6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313066, "uuid": "50f61938-94f7-4f76-a63c-fd4a2eb51186", "comment": "Malware payload (RedLineStealer)", "value": "906c38add63fd200b65fda56d7c17b6240a619be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313066, "uuid": "88106552-995c-44e5-bdd3-9316e4d8baa8", "comment": "Malware payload (RedLineStealer)", "value": "5828feaf5885efe6ee746c2db4d9b5e9aabf5a5fe48b651af30917f9aea27714fed7c3d069bf4acc25d7b47637ec1990", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313066, "uuid": "4eb6d2f8-0cf7-4918-8d23-d540ef4f2bec", "value": "T111848E313750846AFB35103254F8ABBC6938A42216D1D9932F6ADBFECBE03F0D26565D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313066, "uuid": "24fcadfd-2ceb-45b3-aed8-3c79a2e3f747", "value": "2627254264278e0e80567712e48122f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313066, "uuid": "ed142f60-2620-45fb-941a-863c03551f59", "value": "6144:R/tRV8mUsbkvb6ZzlU9o2gLBiiAOs2l2zedXidSLVZLpJzcrTtyn+:RmfsYvbgBlXCui4LzcrTty+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694313066, "uuid": "f6e38507-a837-4b11-8c67-9e9376fb3331", "value": 401216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694313066, "uuid": "60af1d15-995d-47a9-a146-cd4f71f95666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313066, "uuid": "14ad61a1-fcca-4f88-80ee-bbf03f334560", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8194ac50-5027-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694384110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384110, "uuid": "1724f36d-0d2b-4e2b-8e6b-86620b40477e", "comment": "Malware payload (RedLineStealer)", "value": "d2bdfa6969d2c56c598f74eff6f6a154", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384110, "uuid": "c4b8e91d-2ed6-4c7c-a0f3-4b47cf5e96af", "comment": "Malware payload (RedLineStealer)", "value": "cca65a9ffc4cc09af8e29a65071ff6b5c2b10086caa8ca201322fab28d46a48d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384110, "uuid": "04a298ce-f856-42cb-aef0-f14439dbeca3", "comment": "Malware payload (RedLineStealer)", "value": "4749ebba122128889cd1da4c808e54b735c931fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384110, "uuid": "b7e61a7d-90e2-4f83-9b3a-8898c08be02e", "comment": "Malware payload (RedLineStealer)", "value": "348f768d03042add0f51edc8488eac86ad2d989a643f9a9f6a8d7515c1b03807fd8cce4e37f020b0b4020fe8c614529f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384110, "uuid": "2d4464b5-e381-4e0d-9f24-c8b5d12fd1c8", "value": "T17E65227134D18975F823093607E4977B59BAB5200B918EEB9B84467FCF303C1BD626AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384110, "uuid": "84dd2f53-b2d0-4e77-b43f-f028fb2d3b79", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384110, "uuid": "2623660c-f888-4f5d-8470-3376fc89e96f", "value": "24576:AstCJbGF6i99M6u77mlaZIoK2X7wWjQMaCfToRMQ3B3mDQPu3cA1R52HzUx4vu1A:ltCJfiHqNtX1jXzTwMQ3KNcqUTUx421A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694384110, "uuid": "7e473e9e-5043-4b44-9043-15bf70c1def3", "value": 1469304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694384110, "uuid": "b1afb19f-b164-4fc1-b5f7-dd2921483bfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384110, "uuid": "450b759a-8bc1-4854-b7b7-662e44224d51", "value": "d2bdfa6969d2c56c598f74eff6f6a154.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1dbb56-4f7f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694311814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694311814, "uuid": "9dd29494-66a9-4b27-b1f0-128968058af6", "comment": "Malware payload (Smoke Loader)", "value": "023639133dc8dc68e1b04b92cec084ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694311814, "uuid": "b6966eb7-e13a-4dfa-8f30-0dab2ca4f209", "comment": "Malware payload (Smoke Loader)", "value": "cde192b77c6ce93394a5f59b592127da02c7366401c6ed2b249a1a8bb947908c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694311814, "uuid": "263c9f6b-4d03-4c98-ac9e-fa85fbb48bfb", "comment": "Malware payload (Smoke Loader)", "value": "0e5b3b20133af5661ba2daff460d5cad1db206e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694311814, "uuid": "57dc29e9-dc10-4179-832d-4eb22f3ccb7c", "comment": "Malware payload (Smoke Loader)", "value": "eee420d38790a33a7668dfdd4c6c2bbe4b11fe0b1832d5129895edc06b65209e444764476122a6c04ce6685cce9b1dc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694311814, "uuid": "f83f0fe0-5c4e-411c-b988-0587bd14d8b6", "value": "T118448D2376E0BC73C66707344F6D96EC7B6EB8515EE1474B33241E2A19306B1CA2B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694311814, "uuid": "3dae861d-b469-4503-ab35-b66b27d967e8", "value": "3681be0c4196dc1f0159e8326f6ce58b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694311814, "uuid": "033bb673-d72c-4163-a08a-a1b1b9f910a6", "value": "3072:dBb7LL9aUlG+J/dPVcn6+8x0pZ0/dTCfh5Yj0mHHRGePVX2:nfLL9UY/Up+TCzYj0mYeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694311814, "uuid": "f5435ea4-e15d-4f86-9be7-9db39107b0bf", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694311814, "uuid": "930169a1-bb75-40eb-ae12-c57283c74ac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694311814, "uuid": "2542c9d9-daf7-4ed6-9c3c-874efe80dd24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17162909-4fe6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694356014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694356014, "uuid": "302d8611-5c59-424d-a323-83e391170256", "comment": "Malware payload (RedLineStealer)", "value": "264e03f2c4b3c9b812f440fe60bf15c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694356014, "uuid": "5a230fa1-bf95-491b-9831-7154ff33e238", "comment": "Malware payload (RedLineStealer)", "value": "d03f483c84ba8fec1d84b160c90c7bddf1b7b892dd600ca18fdea9ed7205afa5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694356014, "uuid": "1df232a9-3929-4d63-b6f9-3d49ec24d82a", "comment": "Malware payload (RedLineStealer)", "value": "de26cd5bafec9961499cc3447e5cdcca9d6d6dd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694356014, "uuid": "b48337fc-b723-4756-8905-bf7cfd529c90", "comment": "Malware payload (RedLineStealer)", "value": "dbbd419c440bb501280e4b196a006490c76b9d3322ff57f2c8179cc66f992e8e63cea300b3ebc39ecebf4acef4c6aa78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694356014, "uuid": "2f56c9ec-f0de-49f2-b469-09ae5bdba8d9", "value": "T1EFF41223DBCC59B6D9B61B309CFB02971B317E918D74532B2789AD5E0CB1A806272737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694356014, "uuid": "0dd599ca-be17-4d93-a63a-228b0b3ae19d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694356014, "uuid": "73382861-d0f4-49e5-8289-b492fbf23cc0", "value": "12288:vMrmy90XzIxWZFj5tj5hV1yNqfEwWpORnyU+8d9KGOZUZ:RyEUI9tj5r18qOSnyU+IOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694356014, "uuid": "6756b748-3d9d-4a4c-ba55-286d9e19cf7f", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694356014, "uuid": "8a949b7f-5a27-4b36-b33f-07d71f5f22fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694356014, "uuid": "71705e58-7eaa-4c69-b797-c007598eef47", "value": "264e03f2c4b3c9b812f440fe60bf15c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c250e214-5018-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1694377776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694377776, "uuid": "41064953-a681-4a55-b9d4-29ad5beb0f8d", "comment": "Malware payload (Spambot.Kelihos)", "value": "99cffe97a251670b6c06faafa3ae91d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694377776, "uuid": "30038ac9-2d74-4d2f-ac97-72ac7af50146", "comment": "Malware payload (Spambot.Kelihos)", "value": "d27809504464823d84d0b88ac03760fa68d8a361e9709ded0b3f5cd17ab4edeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694377776, "uuid": "42a24838-55bb-48c5-8a4f-7a2803591e14", "comment": "Malware payload (Spambot.Kelihos)", "value": "0643d567aa8e5e451af11e5d15257df4db2e2736", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694377776, "uuid": "52c35ca0-66e1-415a-aaf8-6189b193d63d", "comment": "Malware payload (Spambot.Kelihos)", "value": "bd25657bd5346014936dbb4d05a1e249af48348fa35a8ef3231704364386730b7408933bad7e67e6d23cb191e608dec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694377776, "uuid": "0fd5ed25-e82d-463b-aa0c-792012bbeec3", "value": "T1C2651282F4C0B8B6D0731D7209F4DB745FA2B8A04B054EAF779C4A9E4B2CAD0F621756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694377776, "uuid": "8c13e0b0-0bc7-48a3-b8fa-fa7a6777a079", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694377776, "uuid": "9dc01a97-bf87-4091-9e28-22026a1ba818", "value": "24576:8C8CWsXnF0SlyI9rj5RDKjMaguXL3EJTaQFJCuOj3IlOfpUfML2d1s:X8CWcjyU3Kjrz0JCeOqOM1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694377776, "uuid": "b4f030e6-a91e-4cfa-8306-29af1b6aa7b0", "value": 1429312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694377776, "uuid": "1f7e2d40-da68-446e-a27c-00cef385b928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694377776, "uuid": "930e40fb-ca45-47d2-8a50-e72f013c6d45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0db3071-4f8b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1694317241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694317241, "uuid": "156f81b6-87ce-4848-8005-5b0f9e851c3d", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a210b264a0b8ffdc98d2b0201a37b6e3", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694317241, "uuid": "f8d15e69-2009-4bcb-b43a-16bf6ec07597", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "d2eafbfcd0dc07d49081b9b8324b549b08eb7aefd87ca6175046a9dd11b1d350", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694317241, "uuid": "c09844e8-9d5d-43bc-8ede-3118f0024e4f", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "491e806ed805cadce07b5092f661c1fa234d8f51", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694317241, "uuid": "aa256402-fb04-4d90-b2f2-4da06a4fc145", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "05b937062af97a39133228bc20c587540cbb779184b9100cf1603a0f13cee13a8da953a6aaebadf95f247efeea1b1b59", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694317241, "uuid": "11323a87-74b2-48f6-bc36-7bf4fd946b4c", "value": "T10B5533216642D4F6F173DDB89C75C480E96A7E393028245C7ECF482F6F6B189C198B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694317241, "uuid": "e9ac7f3e-8905-451b-b485-6d71782ffb8e", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694317241, "uuid": "8bd10c5a-016b-4254-8397-4dbc1f85a5f7", "value": "24576:YI39dbs+ImwiLtTw+5+KUsXQSA6g3j9Vf16kX1KN2fYvhs3s7xQ0LoNsXZNBDRGp:Y6db9HLFZ5+kXhA6g3zkkXw2A689C+Xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694317241, "uuid": "40966d62-79b9-49fd-b6a2-d1a604061349", "value": 1361742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694317241, "uuid": "7a4ba390-6bc9-4d9c-807c-d75d23eef219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694317241, "uuid": "764f8c99-704c-4785-87eb-252b1f1ca2d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a59a846-4fed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694358999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358999, "uuid": "45c4abb9-4753-4e80-8e8b-bb6fad483118", "comment": "Malware payload", "value": "cbe02a023a59b8dd32efc44905a0c18a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358999, "uuid": "957d0bb3-4863-46c4-a4d2-4b0c3ed8b65f", "comment": "Malware payload", "value": "d36f3c629742f780da8f8a520381eb82bd8b3df8ad89a3b95d133354b3c836f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358999, "uuid": "80f9cf77-928a-43ec-b2c4-4f55e3aceecf", "comment": "Malware payload", "value": "00e01b4d99aefe7ba9472e2655020cc1727826e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694358999, "uuid": "bdef509f-622b-4148-aa79-a4c52deb7a03", "comment": "Malware payload", "value": "c93fbdd54dffb7a3e5555542bd19597434c3c04be148355e7993b5ad10c265af6de083647e7e3d33454a275e443e5d7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358999, "uuid": "9ca286f2-d3ec-414c-bf19-789d1a70af07", "value": "T11DF30946F8818B15D5D151BAFE0E128E37231B7CE3DE73029D246F707B8A8AB0E7A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358999, "uuid": "3282b2d9-b7b9-4ce9-94ff-c3df2987950d", "value": "3072:LqVNRJcXPA/j0RP8f+LaF1YOc6uxZ3wsw0FsxS5zcX2y:OVQq4+fwaFiOc139FKS5M2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694358999, "uuid": "042f6f2b-7294-4cdd-bc04-1725d0a90617", "value": 164892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694358999, "uuid": "8eeaa032-7b15-46f0-afd1-17e69d87af03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694358999, "uuid": "263a5054-ff95-455a-ba62-07282fd9bbda", "value": "cbe02a023a59b8dd32efc44905a0c18a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad90f15-5004-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694368878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368878, "uuid": "604b6171-a00f-454b-87b9-c6ec09647bdf", "comment": "Malware payload (AgentTesla)", "value": "e81881e91f2c61cf71aef1267ee75cef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368878, "uuid": "d474a715-0b6e-4e0e-967c-7d78c223b714", "comment": "Malware payload (AgentTesla)", "value": "d4aa45c833cc82d4cca13194e5527652a176e1f3e10264af2b99c1d80781fb96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368878, "uuid": "06dc847e-ad8a-4b71-943b-352aa1ccc484", "comment": "Malware payload (AgentTesla)", "value": "e6f8872cb7f185b0f093a1e22afdc0e3377760bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368878, "uuid": "45a250d5-e85f-4f9f-aa9a-6b0294e89aac", "comment": "Malware payload (AgentTesla)", "value": "123a514cf730109fd30114bbf96e4c1425e89840cd4e627bc0e63056904d3872fad0a4c5e227f6f21da420427201e69d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368878, "uuid": "7e526eb8-2d65-4759-ba2d-4d4e8a6b90c9", "value": "T132E4334F4FC0C9DDA406C09C602973114A63DAEBBAC7747612B5B0E25C6E52D3A72E7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368878, "uuid": "9f6c2810-0392-4adb-bcd9-86f045305eea", "value": "12288:gk1KqL/HCoDYT+SVfDcEnTnS0MKnDA8eHdb93ZkId1pMuNVf+:gk1KqLaocTRDcEe0NDAfTphs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694368878, "uuid": "814ae9d6-c1bb-4892-aa70-1701c29bb74a", "value": 671025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694368878, "uuid": "fc08d5f4-cfd3-44a9-b856-2e69d2a75dcd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368878, "uuid": "a3cb3024-6965-4ebb-9bc7-18f48716aea9", "value": "Transfer Copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01765550-4fba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694337080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337080, "uuid": "7678b336-4a62-41db-8b54-de93ce504b03", "comment": "Malware payload (AgentTesla)", "value": "5df5b2aed28c2f95652cf42c61270b1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337080, "uuid": "ead05446-8d52-4285-b694-aaea05ffdee3", "comment": "Malware payload (AgentTesla)", "value": "d74a8eaf2998510ed7edd3c92fda1bfb127937706ba5fd1f932fb1d3808735e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337080, "uuid": "ccdf7d58-b6f9-48f9-89cf-1b361228871f", "comment": "Malware payload (AgentTesla)", "value": "c1ab58e2b5ad0454f04b93db566869ad8fc17554", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337080, "uuid": "0a82111e-8dc3-4c1c-9110-16dcef246001", "comment": "Malware payload (AgentTesla)", "value": "2d9ccae9cfc0b7753d214514d15a41e0260aae77540c322d0ba74888e2376141c24c5f92eef1fa7f8a128d227da771f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337080, "uuid": "705ed46e-19d2-4619-ba7b-1b506c607c2f", "value": "T119E423A64A3B545FE2F6D4F3D3A304C58A5DB269804F7B339D29274E3D329E805AC90D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337080, "uuid": "d85df499-42d2-42df-b516-5827507ef7aa", "value": "12288:R2nWxXjSb0SMoYcrgYFsglL4slZHaXRzhiwqebI6a8cKEA01veHWPF+g/tjAa:AgjFObrtFrl9faXR9iwvkr8cKk1veUFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694337080, "uuid": "cdfbf60c-bc37-4d65-bc95-83acb2a8140b", "value": 671733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694337080, "uuid": "a99ed6c5-e124-417a-aca8-b323ee02d125", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337080, "uuid": "3ffd4691-aee9-40ed-8470-40cc4ff05727", "value": "Qingdao RFQ.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48f9daf-4ffd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694366156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366156, "uuid": "94f3d198-42ee-4660-9b0b-d4b28ff809cf", "comment": "Malware payload", "value": "f06d9f7dfa7051e8bbe251b077215e11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366156, "uuid": "ab907c25-9812-4dcf-95e9-d8787548ec8f", "comment": "Malware payload", "value": "d77d34766b273aea2bebd3964afd58c99dad79f610413a9a018d4ef4710cc0a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366156, "uuid": "571394c6-65e0-4b89-ac45-2c67c7b260c7", "comment": "Malware payload", "value": "c7d234f1171805f251b99347522cec9ff305764d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694366156, "uuid": "fe64a291-700f-40a0-b906-242e8bb6356e", "comment": "Malware payload", "value": "ff8f8518ab2e06f6badf6b7734c84246306167f2f1f0af5ac7e0cbc9ff1f29a7d799166397ed612aa98ddecf6ad0522c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366156, "uuid": "03cb45b4-dbdf-4225-97d4-db73be6e2c46", "value": "T10C1531F3FB442FE284C24DACB9F8D133A8D406803551B6BB7F69A945445543AF29F8B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366156, "uuid": "53e115b7-b6cb-402a-b99b-4dac04436dec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366156, "uuid": "d8e5435b-8fdc-4d3a-8785-5f229b8ee028", "value": "12288:srnnZJ06ZGAFTOGPKqBpzX/x4AkYf1PwDHST:6nlrFSGRdX/x1kYf1P8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694366156, "uuid": "6826e999-b6de-4095-932a-8a82a2c2938c", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694366156, "uuid": "0225cfbf-b271-4434-9e3b-55d1b7e55fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694366156, "uuid": "e5cc4a9a-3d4e-403e-a4ab-c8eba0594bd5", "value": "PRODUCT REQUEST LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563a3b18-502f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694387473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387473, "uuid": "c6dc717d-f691-4937-9309-19cdafbb6778", "comment": "Malware payload (Mirai)", "value": "ce0877176bbf16b2d346fd4fe20f1ce8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387473, "uuid": "ae4a7a98-43e1-4978-85c0-f8c537b87338", "comment": "Malware payload (Mirai)", "value": "d94ac5c5140646ded963a925a71c92d305bcce4ebef4549fe4e05a918d7b61d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387473, "uuid": "3c5e6259-9231-43b6-9c2a-7b5b3eb5d3df", "comment": "Malware payload (Mirai)", "value": "ad790f489f2607a62474c4729e1f5922d91bbfb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694387473, "uuid": "0336d34f-0c27-434d-8e7b-a7ca52251c35", "comment": "Malware payload (Mirai)", "value": "d5c5e6f2e5dfd057f3bee06aacf4187add3ad54593a85d79d37239cfcd06fee866e419e4a0afb9744e981b0a896f803e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387473, "uuid": "f83d0d09-3d1c-459c-be49-a7276aa75ab8", "value": "T1E0E2D173466A64A3C7A82C7E7C1D41DB3D6B4FBCA04F3992522861BC2F55C4139F51C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387473, "uuid": "ac0aa1a7-9713-4cc1-95d3-b9c7324755da", "value": "768:nEbYnktpeynXsPJCuyaYeyossG7W/tj9q3UELhA:EbYkFncPJCcDWsCW/tiL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694387473, "uuid": "2d994134-be77-4e71-8f3c-dd98669aa080", "value": 31248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694387473, "uuid": "86f338b4-9c55-4857-9038-e864046ee3ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694387473, "uuid": "6de96a4f-8cd0-4262-a005-748534c4a75c", "value": "ce0877176bbf16b2d346fd4fe20f1ce8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b36abd-4fb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1694335823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694335823, "uuid": "47f54330-ffd5-4578-a2ad-8984adffbac9", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "38af423446b36d0a629ea0a8dc230137", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694335823, "uuid": "004b3a9b-ba5c-4f81-afa9-c27e367bf63d", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "d99188eb6d65ecfeb7586bfb3566766fd1c68f659fbc57c7ce2bf1580452fd69", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694335823, "uuid": "f7a41deb-a18a-47bc-8fd8-be2435e7cd31", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "5486884f41809fda9cf652a14d4117f6a26e351f", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694335823, "uuid": "aa4b69d4-b792-44f5-8be1-6dbce2ea8423", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "f1841f426b14d620ef69a12ac17ca4681f6d22a84f1ad08c2ab0dd7366deb3ef0eda9666613059312ca76dbdf8f8f833", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694335823, "uuid": "e7a54ea4-2217-419a-a375-3db519de18b8", "value": "T12B853343C395ADFDF5E18D718CA9A61B0032BC516C3F596832DD3CAF3F1160EA94A689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694335823, "uuid": "c2bba699-d4fb-4602-98f2-7f924827fbee", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694335823, "uuid": "c0ab3283-9a2a-4e9f-9a38-0e14e011ea39", "value": "49152:G6deXVzJYXp0m8l8SZ0l0iCLA9HhiYVbvfnpD:9deXVzKumo863in9HBVb3pD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694335823, "uuid": "78b64945-f4f9-4d92-ad66-794b9345b276", "value": 1752659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694335823, "uuid": "afcb2a4a-f251-4d5f-bca5-a991ac23adf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694335823, "uuid": "d1ca4bd4-8ef4-4cdf-8255-700bb6b929cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5e9dfb-4fc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694341584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694341584, "uuid": "8129d2a1-a88e-433d-94bf-85f355b6c63f", "comment": "Malware payload", "value": "edc38632e444821497a8cfe9e8bd2d6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694341584, "uuid": "36706a3e-9a74-4481-83e5-dcfd98a30fe8", "comment": "Malware payload", "value": "dad0e778fc1a82e5cbb959f0f7517b30ae231d2580fee1dbcf10e664bf0ac421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694341584, "uuid": "96c202f0-5c39-4d0a-bac8-b0b576343552", "comment": "Malware payload", "value": "8ef1344b050a80b5a57801b222cf7f0320ff1490", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694341584, "uuid": "6c04c879-38cf-4be2-9265-b072ed5ddc4e", "comment": "Malware payload", "value": "a2e443f9f060c91fdbb92aadd581207b66646d55d5cfde783c3ebc421367fcfa47aa50f28f83073b8e3aa209d04da54b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694341584, "uuid": "e0e24770-dc91-491f-b413-ce0960b136be", "value": "T1E94143507C0814761AEDC268E68E52EAF530536B35513C38BC7D55B8CF2637360FE698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694341584, "uuid": "425c1f33-84b3-4830-b853-d2222847d350", "value": "48:ePCoNzoOZUJjLYzzlFlwpOTaT8TiHAEMuFkQVuOmOtQOOIOQQ2gkelHOH:RoV1ZUJIz3qOTlEqQVubwQnIC2gkSOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694341584, "uuid": "45af7323-dd2a-4e7a-b22c-d286e78eedf4", "value": 2365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694341584, "uuid": "0f28041e-da85-40ea-88ff-3d10fc3a7eb4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694341584, "uuid": "71825a4b-37ee-42ca-a0cc-46235d4551c4", "value": "osq.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ff10d5-4ff9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694364352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694364352, "uuid": "b1f5d857-12a6-4cf0-bb10-ffcc63f243e0", "comment": "Malware payload", "value": "7f10813c9f225f8f5ae2fcb547498eb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694364352, "uuid": "a721f912-fe29-4811-a634-938bf7a0acfa", "comment": "Malware payload", "value": "daf6829c4e7d04874e29c71677e7e5ff9856c6d38bc103c9a01c4ae423734dc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694364352, "uuid": "83829f1e-eb64-4e71-95e5-364e1440de3f", "comment": "Malware payload", "value": "915a06f9c53993fce56644ccd93c1c09f8286a50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694364352, "uuid": "ad1af433-5be4-4f12-879b-7dffc4804cb3", "comment": "Malware payload", "value": "20423d9cbcf8b5d8f0ce50dbc33d30837b8aa06489d4e99871dead8281107e0984e803dfa9664f8a17aa20baead3833c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694364352, "uuid": "fe2daa14-2fcb-4fae-80a4-dc51e7bb9bb5", "value": "T1A2456CE2A254DC72F06A3579CC89B2D0396B7CED6D3A5C8D166C394A1A73761392C03F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694364352, "uuid": "46e46711-2ca4-4190-9beb-6f6dab5d3fea", "value": "24576:cRTaL+A2f8Zhp8bYm1EnyWjkf0eFuPD+4m:aTaKsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694364352, "uuid": "e7c845ed-6958-40c6-a176-3c510efee4ff", "value": 1249280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694364352, "uuid": "885591db-a145-4011-9587-69ace7164480", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694364352, "uuid": "0bde4af3-aeb1-4a1e-81a6-fb72a41066e6", "value": "Credit_Details1983165205090023.tar.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451b445a-4f96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694321731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694321731, "uuid": "8a5b8da2-f300-4063-8e8e-4b738389d01b", "comment": "Malware payload (RedLineStealer)", "value": "3175d7e2cbc25c7d9d6591bd8214bdba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694321731, "uuid": "c7fc7ec4-5aaf-4527-a6a6-da37c8bfb57d", "comment": "Malware payload (RedLineStealer)", "value": "dc12f604268d03036dcfca8802df65746d49e73696f9c2b4902dc5b7f5198762", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694321731, "uuid": "8f856446-d3d6-4df1-b136-ce09df8f1443", "comment": "Malware payload (RedLineStealer)", "value": "60f103480f63ccbbfaee0ab11aa82e72aa7f269a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694321731, "uuid": "2cb1a4c4-53ba-42c4-bcd8-4b6acb0f3a11", "comment": "Malware payload (RedLineStealer)", "value": "fe35bd0fa88d40cb798ab73c68162ab3ff3f597c888750268312dace5d5c90841571994ec409d031039642212409d4c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694321731, "uuid": "14a562be-8047-441e-b10b-0a80e5808c17", "value": "T15E556C1DB3F9EF8AC3DD5A36D07B1861CB76E6091D73E30B29370161BC566A8294B1C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694321731, "uuid": "7be20034-3a47-49d0-b472-ff663755319a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694321731, "uuid": "789974e6-aa8c-469f-b60c-c5627296cbc3", "value": "24576:MfNMi54ii9loeel2Nz4FzvmGzgGUhb41kA/Bo+sA3/8:gSonlizeUhb41l/fsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694321731, "uuid": "7969aa6f-bfe6-4e35-b011-13cdad133c2d", "value": 1401344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694321731, "uuid": "280a5b60-a377-41d4-949d-71a43af6c0be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694321731, "uuid": "1ecc5679-0d94-49bb-9fab-2b02b97c9a39", "value": "3175d7e2cbc25c7d9d6591bd8214bdba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de3cd05a-5028-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694384695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384695, "uuid": "6adc4c3b-00d6-4857-b3cc-5afc0d7b103d", "comment": "Malware payload", "value": "3ae69de8e1657ee1a85efb0d7691f545", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384695, "uuid": "742936c1-0b95-47c5-bfb3-0bed4a9959b6", "comment": "Malware payload", "value": "dcb1d73014afd6974bf9962458d7fb2924b2bde2993c9cf68a1eec3731a46b1a", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384695, "uuid": "aaeafe0c-5454-404a-bc61-60cf1322ff57", "comment": "Malware payload", "value": "2420e83a935b18bbdf46b9f5e2a9c37fe1be44e4", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384695, "uuid": "ad649226-0435-472c-968c-5ecb4add426c", "comment": "Malware payload", "value": "cf1ab43582aadfbf40b06f1ba2261fdd5b248f99f444834c8663e6d10bde88ce1c09460bf73fcc284783826cedd74ead", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384695, "uuid": "590e8552-2e97-4dee-9e2e-95553d35838d", "value": "T18C863370E9D40A6EF0ADC3745A9A9E3FE62D6C005B2CC52E1653FB61697EDFC00CA512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384695, "uuid": "efe000c5-5068-4280-a9c5-e7509d46bdb8", "value": "196608:UrCGflorCNnfMxkQVxdbvB3raLGdGiaCMIC:mhhtfMxNVHTFeGdGiZMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694384695, "uuid": "ab3dd4d8-f447-4625-a7f2-554b7a20b319", "value": 7988176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694384695, "uuid": "6b6d84cc-c8ba-4027-892e-d8c9f1b90bba", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384695, "uuid": "69135dd9-65fc-419c-941b-309791385ffc", "value": "4cc5af.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878c7352-4f83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1694313682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313682, "uuid": "6e9b145d-a7d9-4d62-8842-7c2f148619e3", "comment": "Malware payload (Fabookie)", "value": "041e25de5761f62f2a32c674dc5c0577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313682, "uuid": "6dbff322-6e00-4d65-8354-b0143c34567b", "comment": "Malware payload (Fabookie)", "value": "e10be62dd99f927dc48568c4ec02966c35577ae42a9184b44f5f72b502b7c07b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313682, "uuid": "41496248-ecc3-4d53-abad-c0a6f927562a", "comment": "Malware payload (Fabookie)", "value": "00ad5cb5099498f9df2063ef1b7462e55b3a5c59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313682, "uuid": "f0244886-ddfd-4f90-a60a-17fd46ae3ca0", "comment": "Malware payload (Fabookie)", "value": "e78c200346976b968288a20e23e6ffc34c2c2be516726e672bec47b1c040209fba34dfe9a007d7d55af73546c77c2739", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313682, "uuid": "30c04764-4c6e-4250-8fbd-ab03aca4991e", "value": "T1BCD4E062F7A810A9E1E3D23A9AB66371EBB17C141F2047CF0120966D5F33BE54E3571A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313682, "uuid": "eaae7cf9-4a91-44ad-ac55-65f22191c425", "value": "0b788e8ff3124c2dd648ac7a27e0b5d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313682, "uuid": "1f1dc9b4-24a6-494b-9a45-41bd971958e7", "value": "12288:97GJfUlayYXIB7GjFO7yZ11VoGWBo9uW/rW42cqG543Pl:pyfUGimG61X/OoMarWrcqzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694313682, "uuid": "b6ff1c0c-eb75-4f22-84b7-f2c0c5e28705", "value": 606728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694313682, "uuid": "73f139cf-f3fb-4f29-8251-ef82ece6d2f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313682, "uuid": "21e1a509-b62d-43f4-9acd-b8a5908a5794", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5d6c79-5029-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1694385012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694385012, "uuid": "228471ba-6219-41d7-8d40-a954c453f732", "comment": "Malware payload (Spambot.Kelihos)", "value": "0f96b59d9e6cb78c85ee220b194a7cee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694385012, "uuid": "cf341349-0440-4fee-99ec-e9878c762be0", "comment": "Malware payload (Spambot.Kelihos)", "value": "e5a1c853297478d724f1f3380dc016de2bfdd7c208685a2f367759c451fc51f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694385012, "uuid": "34df0c98-934b-4415-a2eb-eb8d01eec102", "comment": "Malware payload (Spambot.Kelihos)", "value": "5053da7243448f77a941f6f4f7dd2a60fa59f9f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694385012, "uuid": "d6beba1b-d2ff-41f7-b431-809c51f1ebba", "comment": "Malware payload (Spambot.Kelihos)", "value": "5427d8e45fb5f7abe2b3eabd83b29172d40eae0078e975743e85e725e32ee1aaa68c54d37441128c95064d62016e3f84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694385012, "uuid": "b75c718f-447d-47fd-8d09-fe8fb24b601f", "value": "T1D0249D13A1E0BC61E52747344F2EDADC7B2EB8725E649756F6081E6F09321B1DADB302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694385012, "uuid": "e5b273d9-6407-40d5-82ee-905d8caeb942", "value": "f815858bb8146375fb6d659cf6f7de7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694385012, "uuid": "5acd8977-4fa4-46fb-b5a6-3746fed4e99f", "value": "3072:IUZegLwB+Kgvw8hIiXVE42VVLY0qMXMqgDkS5AIG4Dxp:ICL03pLRVLloqgwLIG4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694385012, "uuid": "e736e870-442e-483b-99f6-0bb9d8948f19", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694385012, "uuid": "bd5171ac-6fa8-4a2d-a139-4b8363d30df0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694385012, "uuid": "66593e05-9e25-4d09-8aea-1d5c3d27e121", "value": "0f96b59d9e6cb78c85ee220b194a7cee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6fb81d-500e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694373342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694373342, "uuid": "084e1889-f75f-4576-88e4-349551c3fbcc", "comment": "Malware payload (RedLineStealer)", "value": "d3fc5ee0ede98e3e4333e6f73e214308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694373342, "uuid": "acfe0932-0ef0-4a8c-85c5-47144c0ebd1e", "comment": "Malware payload (RedLineStealer)", "value": "e6bf0f01bd6fe616d8f3f65fdf8c1fead831e5607a406a256661b0d9ab0098b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694373342, "uuid": "b04eb49f-8979-4d7a-81ca-f900663f642d", "comment": "Malware payload (RedLineStealer)", "value": "bc05306c0696e8019cc6a67c147f9d7ea9d89f85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694373342, "uuid": "346ce773-2bf3-429e-953a-68dc591786f9", "comment": "Malware payload (RedLineStealer)", "value": "caaa7971b217534e8b29c8a604b3b7ef83dd2bd4f08caaaa8398432735e3cd2ef52351b1e5ba75cb95c22f4823ddf0e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694373342, "uuid": "8bc9febf-a861-4647-a0ae-3c611cf12c85", "value": "T19F845A43A0D1C0A2DE0D0D3426B29A68457A79A267819B8F77903DFFD73C642C7ED29D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694373342, "uuid": "d78aed35-4cf4-4e80-92a7-302078c80da0", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694373342, "uuid": "30e4d76f-1845-43c9-8d74-088aa7c226c5", "value": "6144:M+tRVFUKtKqCVkYdkEktqoigAOfbCne8qZFsgEgfnRyP73dVhkurBi:M1KtHCOPfVbsgEQRyP73dVvrBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694373342, "uuid": "570b0f91-5b15-4755-8316-5c438261a863", "value": 391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694373342, "uuid": "8fae23c8-eeb6-4eff-8610-539f8ab4404d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694373342, "uuid": "a5f15d18-0846-4f9a-9735-d619168e5eb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39bbafc9-4fd9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694350489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694350489, "uuid": "8f0f5e5d-2021-414c-877d-fbe7c17b9b32", "comment": "Malware payload (Mirai)", "value": "a546d82362cb385677f10e40d8d922fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694350489, "uuid": "29fc84b9-b611-468a-a239-5efdc6c6196a", "comment": "Malware payload (Mirai)", "value": "e718ccbbe941ca8e4b11fd58b7558745557bfa635e5d67c8764a35452fa94c94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694350489, "uuid": "6f6560ef-b7a7-45ec-bbf8-50e9a7383ea8", "comment": "Malware payload (Mirai)", "value": "7e4b23f521aff225a075a7963568e6f06d98f08d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694350489, "uuid": "72a5f291-a7b7-4a12-b556-513369fdfa3c", "comment": "Malware payload (Mirai)", "value": "278c0e43d9527a4440ee3a8d5357a7f27e5f704e95ed40801c376a149efb3f243cffdc927c02a8b6f5dc6a621173fcd9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694350489, "uuid": "87fb4950-7e49-403a-a749-f514fd1ca622", "value": "T176B34C73CC256F68D665E1B0B0B08F796BA3A950818B1FBE1567C3758043D8DF60A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694350489, "uuid": "11d3960b-36cf-41e7-827c-b74b6b573bbd", "value": "1536:Ea0UAvuDzvAiKeC/K+RV1J0aF/OqdWyXOqKmad5f:E9qz4iKez+saF1dWmOqhO5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694350489, "uuid": "55596d39-94af-4a60-9f4b-b5777d53877e", "value": 109376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694350489, "uuid": "08b0fc93-e65f-4521-86ad-6ed0279b961e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694350489, "uuid": "df9fafe4-6e8b-432b-a5ff-ff6af9e6f1fd", "value": "a546d82362cb385677f10e40d8d922fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3706c189-4fd9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694350484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694350484, "uuid": "a0045198-9181-4823-857e-4e8fc06e3132", "comment": "Malware payload (Mirai)", "value": "30057fb5b604e1a3607961ae81bb524a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694350484, "uuid": "f27892a4-01ef-4ca4-9b2f-deed67ed184a", "comment": "Malware payload (Mirai)", "value": "e748d4fca700b70b43f209638a86158f795fa690d768060efd24eff825378adc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694350484, "uuid": "6ec49657-ee66-4e81-932f-b77a3be3b7fe", "comment": "Malware payload (Mirai)", "value": "4709a3ecf3cb0ccfd5dda744b937807fd0e7e6a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694350484, "uuid": "e88acfb9-7403-49ca-9a34-a501b1a2b553", "comment": "Malware payload (Mirai)", "value": "ab0f06d8966a00f73321160282972420299885f9432dda230265ea2c4886baed93841846ea379337d683f69ccf8fdc7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694350484, "uuid": "d5c23fb3-7b54-4a0e-a9e5-ba607bdc0391", "value": "T186D328D7F900DDFAF80AE33748630806B130BBA645525A372267357BED3A0991577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694350484, "uuid": "2adec7df-13af-4f79-8511-5fbdac48fa29", "value": "3072:FWW/h8B7+C2EG300wPAOxf31SVrjbiWLlxisTyjjDU:0Wxt3OAU31oLlxJyj3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694350484, "uuid": "bdc5272d-c621-42a9-b2d1-5ecedab4682b", "value": 140480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694350484, "uuid": "f0253afe-905e-4d0a-8d46-ea4b1e6e4749", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694350484, "uuid": "7b1e14bd-1e78-489c-aee8-24fb193471f1", "value": "30057fb5b604e1a3607961ae81bb524a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186340d7-4fba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694337118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337118, "uuid": "1eff1716-b8e0-48de-b2ff-ad8298e3ec1d", "comment": "Malware payload", "value": "909463e42e2099325aebb64a75f6c4d9", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337118, "uuid": "afc1968a-9486-4ea6-a4b7-5380c9cb0f76", "comment": "Malware payload", "value": "e748f97fb4a629f74388012a83fd6eda2c3c740de7cdc4394e3bec54d1f46599", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337118, "uuid": "92cc13cf-a862-41d1-854a-c43f2396fda9", "comment": "Malware payload", "value": "1b3fd32c3605aaf21d610dd55281820436662a66", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694337118, "uuid": "c8f7d32f-761f-4a89-bd97-9bb404cb66dd", "comment": "Malware payload", "value": "0f90879deabe61a4a83df0ea89dd5331eff9ca12dcb402a851fc3f17d061db5832fbbaadb179df0e4a69d7f68842a040", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337118, "uuid": "e0187351-d1d3-4081-9bfe-eabc45ae7053", "value": "T12E2159042DEA1B11D377AA37947A9355CA377892EC728F1D0050814D2957A01FDB5F2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337118, "uuid": "050349b5-2c35-4b0a-a3f7-4a8b50fc4904", "value": "24:8wLJtnyUlVefuPXc2K+pF9OeekI4I0W5/2lC:8ux0MLAeI/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694337118, "uuid": "72871fdb-51ba-4621-876f-028cf8a524e5", "value": 1180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694337118, "uuid": "50516abc-6380-4488-bcfc-285a0024b900", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694337118, "uuid": "af1a1457-d87d-445b-906d-a12e5a82107f", "value": "notify-september_2023 (655).lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec56f8a-4fd1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hajime)", "timestamp": 1694347329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347329, "uuid": "95295b24-e149-40d9-8822-984e0b31827d", "comment": "Malware payload (Hajime)", "value": "6ae148a99b68f64c2a873fc5f64d5755", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347329, "uuid": "289c1133-b6a8-41f3-b109-15a86c975f70", "comment": "Malware payload (Hajime)", "value": "e7b1e0d341de5d9e1dd08117cb4385ea11126a8b67ed5c10b1909041a2fb0059", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347329, "uuid": "3548bc60-35a3-43a4-9700-7b188e9018f5", "comment": "Malware payload (Hajime)", "value": "6ea906a6bb2b0804b40b5f5b39b48f03237d3b4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694347329, "uuid": "26812922-c34a-4e3f-8749-7dfe0df43f63", "comment": "Malware payload (Hajime)", "value": "ea392d12e9297ecaf1b57cbcde899101adc063aa347d7717682d6afafe9365ac0de51007667216d11748f9fd770ef8a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347329, "uuid": "51da8539-05a3-4f7d-8427-dde0ee9a49e1", "value": "T101917C337F1327C2F411DCB43A5C2609925ECA3930BC6E6778A44866D620B68A97DB1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347329, "uuid": "32ddea2b-22d3-468c-afc7-b99dfd513208", "value": "96:A4iZPaoUUW4Lyiyhl2ZqofwLyzyMt4cwpe1jTwhMUL6ZFipKs:KXs4Lyi82so2yzXtb1MQFGKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694347329, "uuid": "16046ddc-cc44-40fa-9442-53eca75f8bf9", "value": 4356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694347329, "uuid": "e4123e8d-c880-4f31-890a-d23b2e8a8133", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694347329, "uuid": "b51340c1-a6e7-4cf7-8a25-58a89392d94f", "value": "SecuriteInfo.com.Trojan.GenericKD.34055387.30138.4222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1753139-4f8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694319014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319014, "uuid": "409d12c4-f3b4-433f-8e61-a1660d2236e7", "comment": "Malware payload (Mirai)", "value": "7108215058fdff048a3b7714e5d4c266", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319014, "uuid": "af95bb4d-6698-457c-83cb-9327d89be88b", "comment": "Malware payload (Mirai)", "value": "ea698007083072ef5d05f9d68650459eb3ecf8aa521538c7ece8f53d1bbf48a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319014, "uuid": "c70e7fd4-caf3-445c-96ac-d345bf93ded0", "comment": "Malware payload (Mirai)", "value": "d422099d7dd7fa513f07452f478ac27cb595338f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319014, "uuid": "82f6c34f-ab84-4373-a456-28b8584455d9", "comment": "Malware payload (Mirai)", "value": "16e5a44d2e96a20a499588248ad5cc7c62aab0bf562b690cc93fad4acecaa99988672997afecb7069c7255e02a3a6275", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319014, "uuid": "1bf943a4-affd-4f51-acd5-446b66fd6c9a", "value": "T1C4735BC8BA83D4F1EC5309B2513BA7728773E12A546AEE42C72DAD35CC92910E72735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319014, "uuid": "fe9e532d-5383-44d1-9db6-355770098e39", "value": "1536:ui0zOunG/oKB5KAXxCwxlpdtqNEloSjot0rhCeya:f0zznAoKHXCw3Lt6k1jZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694319014, "uuid": "6585c48b-7458-4f89-b41e-38bd9138a969", "value": 80232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694319014, "uuid": "0daf2ea4-1122-4100-b6af-271561fe53f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319014, "uuid": "0c72ccd0-f15c-4a06-9f7a-7dc917192ea2", "value": "cundi.x86-20230910-0410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfded9f-4fab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1694330977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694330977, "uuid": "d9e1ee81-e51b-4cc8-991b-0b18ef93892b", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "07a3d70c3c1314817b86851d5781a4d9", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694330977, "uuid": "1aa9eeaf-7e4d-49a7-9081-81e06c98a199", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "eaaf1823c34ea385dc3fa483a071b9a5f6122c8ab347b83da00a887ade466a0b", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694330977, "uuid": "ca47ea54-366e-4679-8cc0-705bae416414", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "338c267ede717b609e4130825533d22e8e00bd41", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694330977, "uuid": "4d0cd08f-3ec0-4f08-bb8f-b1fd10c2eba9", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "4048850d964427c581e52fccbc59007984a07dbdf630e1cd1725552135d26c8ada0a63d174b3a9354b88e788126a87df", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694330977, "uuid": "98e9bc28-ddf7-4a7f-84e0-2d8a095cfc28", "value": "T1DA85331C846878FEC3D7C3B9BC274A240AA73A137A342E1D567F5C9E2B578240554AEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694330977, "uuid": "49d76205-f284-4b8f-bbf8-50afc51d8e16", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694330977, "uuid": "7c1149ba-653f-45f4-9a81-8006503ff7e1", "value": "49152:K6dxVt8B54+KHJ8iofA8laNmXIA3gUetHVbvfnpD:hdfqJKHvofA8lagXOUe5Vb3pD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694330977, "uuid": "a7a6affa-7ff3-45f4-bedd-df208e86dd68", "value": 1746762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694330977, "uuid": "aec0d46c-ecb9-4b7f-a555-c3b56e8a852a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694330977, "uuid": "fc37b234-089e-45e0-85e8-61facf995b2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e17ed4-4f90-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694319052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319052, "uuid": "293ec9ac-6e53-4504-bcb6-08d87cff7407", "comment": "Malware payload (Mirai)", "value": "eb7fd80b2d331dbba59574d1f49299f0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319052, "uuid": "362300c5-1f5c-4807-b9c0-b5201d169a7b", "comment": "Malware payload (Mirai)", "value": "ec2a3cc8122c4bd3f7a9d990cbc984e42020175ec53c59206d19fd39ffba6b17", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319052, "uuid": "048985a7-dc1c-4d10-b688-c2a415943355", "comment": "Malware payload (Mirai)", "value": "16fdac2fafcaab68c2b999afc551ed31fb9b6461", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319052, "uuid": "8b17af6c-da6b-468b-9df0-56a3ac5143b8", "comment": "Malware payload (Mirai)", "value": "6dff685bb401d2452babc4e5bfb830b1a15f2ab49c236a5c7d3d4d93f9a7ffd0fd59c7fee0367a20be6353b40540711f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319052, "uuid": "7cbe0437-4f2e-450a-92b9-d959ed2bd194", "value": "T1BAF31A46EB408B13C0962BB5FADF43513323AB5497EB73059528ABF43F8679E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319052, "uuid": "e6bbad0d-75ab-45fb-a213-25a80371a22b", "value": "3072:xcqO9NVn9koa0TSp2xTvik063Pnj/szDDohM/RMp2BF:09NVuoa0TSpqTKqPj/cshM/RRBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694319052, "uuid": "02ea91dd-6675-4bde-bb56-280ee42118a2", "value": 168100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694319052, "uuid": "2026ca85-acf5-4ea0-9070-e5233ec889fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319052, "uuid": "cea0ba39-bff3-49b4-b6db-4646559f17cb", "value": "cundi.arm7-20230910-0410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0c40df-5015-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694376178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376178, "uuid": "caf59bca-a37c-4191-ba53-c64b8ffeb01b", "comment": "Malware payload", "value": "227f3728ddd134a5a59749332a1138f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376178, "uuid": "76683e47-3fca-468a-b4c6-3d637190ba74", "comment": "Malware payload", "value": "ecaac624787b63516573c5d7be7407b21e894b8e2f51eaa59611cca1e5f9e6e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376178, "uuid": "271ba2bc-c0ef-45ca-9c14-e7dde5af92f7", "comment": "Malware payload", "value": "0e24edbe2ce7398e5ac8d00f9fd8df44d4acc1f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376178, "uuid": "5bd69abb-4023-494a-a083-75097034a72b", "comment": "Malware payload", "value": "4de9560eb377f64ee43776b13105614ce05375d9bc8f260a3a0612ff0d66cbebd139bc244c9251c092f99381b6d40c93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376178, "uuid": "0c3538d7-4cf1-4a18-adbb-7d1d406d3d59", "value": "T1FCA5F151F7C2D076E9E201B192FE9BAB08397E25472984CBA3C0295D5D305E37B3B71A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376178, "uuid": "8425abf5-597a-44fe-8f55-b31f065873d7", "value": "86d1c3345fbce864b170c94f7eeccfb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376178, "uuid": "03676da1-21b3-456b-88aa-8b8630053dd5", "value": "24576:bY9uMoRJ5H+Z4UaOsXyDMrKCmyPT4KkLMkU6ilmiEfce7oVf6VjdEYqcjPDgLvRI:81oRJoMrKCBLX9qemiEfceni/v8VWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694376178, "uuid": "6c875f6f-553e-4151-b9c3-c29e16dc9acd", "value": 2080685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694376178, "uuid": "95c6382e-8de1-45fc-af4d-d384732f596e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376178, "uuid": "37f69289-4483-480a-8fba-070b20d97f7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d99fe4c-5003-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694368588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368588, "uuid": "fe316c73-4eba-4347-93c5-0d8bcacdd3a8", "comment": "Malware payload (AgentTesla)", "value": "2ce200cbc9ff2151d3c42f20d4bc098b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368588, "uuid": "d63b2755-6383-4288-96f0-53103d416e05", "comment": "Malware payload (AgentTesla)", "value": "eecb2f388a5f27230307236106ba3a80ec3a4de290569e514125880ce64fe6c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368588, "uuid": "52863414-9344-46d9-968c-1d5c338af9a9", "comment": "Malware payload (AgentTesla)", "value": "d4b3b6ce56255686d967397ec37cfff895f8fd22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694368588, "uuid": "2825d44e-f234-4c58-b5a4-c9843d38bbc7", "comment": "Malware payload (AgentTesla)", "value": "670b499138649efa9de8e713ea3d65f2f7592eff1e856b2492f75e30365ffc7e405e1f287471453af2eb88c78ce749f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368588, "uuid": "071cd5b2-baf9-42ab-adb1-01ef142b6107", "value": "T153D423ECCA7EE121C59729AF41A7EC80563592F10D1E8B5F6E5BE8385E11330E521C7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368588, "uuid": "07b8fb89-346a-451d-9ffb-36c542b0ff7e", "value": "12288:WOIxFNVbH6UgAFzHiIrIsSOLSghoCUWio+G/3MLGBRl9bNFwTrG78eR0s:gx7cmEIrIsHSg/RT3MLuRF6rU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694368588, "uuid": "529cf31f-204e-454d-b5be-e93b8f6a5c99", "value": 624004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694368588, "uuid": "7e89c0e2-34e6-4bba-be92-bd87dae2300f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694368588, "uuid": "87867bc5-320f-4c13-9ac0-fa7435b28e61", "value": "New Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07a2788-5028-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694384618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384618, "uuid": "d9f633a6-1a05-4be4-b71b-3ffbd41fd4bc", "comment": "Malware payload (Mirai)", "value": "2915f8497b2fdd247fbcfdd1161c9aee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384618, "uuid": "99ba14c2-1dd6-4a60-bbba-27565f56c785", "comment": "Malware payload (Mirai)", "value": "eed440727d1b2b33891322d2f2f31669b10c5edc69545872081efb0672e03952", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384618, "uuid": "a44fccb8-f9eb-4442-9425-e277df69c16b", "comment": "Malware payload (Mirai)", "value": "c985b0496ddd1ed6f1f532d118063832630bb7b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384618, "uuid": "6d690239-29c5-4789-8276-883bab726d35", "comment": "Malware payload (Mirai)", "value": "28bab8e35c798e14eb80fe7b11c9f8b20cf17997d6c18941818b4467fe27b225ee81aacaeb2f38188368fa51cd2ad9a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384618, "uuid": "ea6b15d4-871c-4a04-87f5-800804872809", "value": "T1A2C2D074055ACFF993A0D63FC06CCA84EBF79825927A72FD41B0E12C786601B6D79983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384618, "uuid": "85829a16-b270-41a4-bd31-11a672c9b589", "value": "768:aJ4yxVZId+Uje2D479EwyKvpmxEqYRNs3UozE:Abx/R0e2k7awpqzzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694384618, "uuid": "545721da-3934-4a47-8954-e37e49553850", "value": 26192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694384618, "uuid": "49620d93-5bec-4a13-8497-d02f4b25ddbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384618, "uuid": "1d517bf0-93f9-4384-9f1a-f87e7c9fbce6", "value": "2915f8497b2fdd247fbcfdd1161c9aee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87325fcd-4f82-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Phonk)", "timestamp": 1694313252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313252, "uuid": "b0241007-3774-4f50-a096-6cf0c43c3dec", "comment": "Malware payload (Phonk)", "value": "a0a3f0b765888fba4221e78af32c4811", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313252, "uuid": "43c69b85-d232-4f05-8125-7f0bb9f4b9b2", "comment": "Malware payload (Phonk)", "value": "eedfd015089bc78818088b6f2466da62bb50da8dd4a940990a2c19a30cba9b2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313252, "uuid": "2664a419-2459-4379-9c9d-3f8e884f5def", "comment": "Malware payload (Phonk)", "value": "d1e7b0a67c54c98bbf1e968161b4c590302f0810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313252, "uuid": "f60441f2-4454-4ade-9aeb-b4eb4efbd65a", "comment": "Malware payload (Phonk)", "value": "10e968be0582e77bfdc97b68d67abfebc6d642934b8856b5f187109c70a4c7a95703da143a776744fd50a71540c46bc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313252, "uuid": "229360a9-7802-4934-84ff-22d2e8d5a78c", "value": "T123D529143B850D16DCBE22F29735454C5B20D8731F05D6DA26D263CE9F2EEC3AA7D28A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313252, "uuid": "0f967e75-b8f3-4741-84bf-cd036ac6a284", "value": "49152:/0GQNgzAOwT3QEMEkdSaqRvk3nk3XlDNro7jCyZtglW7+Fl8UP7Ww:/K3Daihuelj/7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694313252, "uuid": "2cf4b113-c881-480b-b8d8-0eadc4075d54", "value": 2933760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694313252, "uuid": "8d1aef91-4b19-4a1b-9538-0414eb6739fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313252, "uuid": "8e80e428-080a-455e-afea-cec15e70c3e3", "value": "SecuriteInfo.com.Variant.Tedy.374420.23408.9978", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f016aeb3-4fbd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1694338769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694338769, "uuid": "1a74ed84-1f7b-464e-be9f-385f8d30b9e5", "comment": "Malware payload (Vidar)", "value": "aa6463b7f841c5cca5eac827ec15f4c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694338769, "uuid": "edd6a366-af16-40be-a9d2-2812f279bbcc", "comment": "Malware payload (Vidar)", "value": "f0415f9799b713ed34d05e046d6700decd420709beda999b41b891d26d3f212f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694338769, "uuid": "8976f408-0bb3-4c50-b313-f5a072e4f9ff", "comment": "Malware payload (Vidar)", "value": "7f5a8237d1fe775b5120c32c61c623f4146c771b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694338769, "uuid": "c32cc17a-356b-4bbf-a685-1db47ad5c3b2", "comment": "Malware payload (Vidar)", "value": "a718bb5f39174bfef0a19c357674ebc45f6e525ba70ced70ac0824318b92ade62437307b59dc0e2582a0017340867818", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694338769, "uuid": "5be105d3-f657-4f8f-b1b1-b87b23d267b0", "value": "T17A84CF237DE0BC73D65607304F2DABEC7B6EB8615E60834B23141E5A1E706B1C62B766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694338769, "uuid": "253c5954-c3e6-4b52-a74c-1da46b2bac37", "value": "3681be0c4196dc1f0159e8326f6ce58b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694338769, "uuid": "14313884-1848-44c8-bed3-85f6814caf4b", "value": "6144:s3NLFS94WDVhl9ZQiTqxrJUEfhCDdaMvOq6Q2OF9wa/fo:s9BS94WDLrZQPxrJUICBOqgOF9w2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694338769, "uuid": "c8197ba9-3924-4a8d-aa6c-bcb9124af721", "value": 371200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694338769, "uuid": "2d5ca01b-035b-49f3-b54a-10da6f6a2675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694338769, "uuid": "993e0aab-41bb-422b-8053-bc2308017bc5", "value": "aa6463b7f841c5cca5eac827ec15f4c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09121fd-5015-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Empyrean)", "timestamp": 1694376485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376485, "uuid": "f298744c-50e5-4cb0-9d99-12e3da8a4da1", "comment": "Malware payload (Empyrean)", "value": "1f0af02e19a551873198d9e0599c9e55", "object_relation": "md5", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376485, "uuid": "cc84e7c0-13dd-4dc9-b5d9-5d6b18f62928", "comment": "Malware payload (Empyrean)", "value": "f2b2c438fa653a956f4b92a39caf23bdca3371278ae463f572172c94b3ef64c4", "object_relation": "sha256", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376485, "uuid": "d99f3eca-98b2-48d9-ac13-ba71292ea095", "comment": "Malware payload (Empyrean)", "value": "76a505b03876c4712de4083eaeec6099ec6b73bd", "object_relation": "sha1", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694376485, "uuid": "c3e0b590-0bf5-41da-a515-c3398af36ff9", "comment": "Malware payload (Empyrean)", "value": "74c39d03c8fe0daea92ba5e958f4ffc88278884a9dc6b81ba3e848780d811b223831e1b0b542218879275cdc7f5cbdc3", "object_relation": "sha3-384", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376485, "uuid": "a5da8160-71a4-4383-a5a9-649d98ad9264", "value": "T1481733E463580996D8E6A43E5C1FD8261467FD422364EC8F43F096388F63B562D3BFA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376485, "uuid": "011fa7b4-5939-4a02-807c-fb487c0978d5", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376485, "uuid": "5f73c614-1aa8-4176-b722-4ea947450af5", "value": "393216:yqPnLFXlrjQpDOETgsvfGJgjtIvEeP2AfnLu:3PLFXNjQoEImtBET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694376485, "uuid": "8eefc8d9-4f41-4354-898f-0f0df81279d9", "value": 18546805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694376485, "uuid": "16392109-da5f-45d9-b6f8-54af27938579", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694376485, "uuid": "2ceffbc7-6038-4d25-bce1-fcd234892cbf", "value": "AutoFarm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82c8d39-5028-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694384711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384711, "uuid": "76bd8053-536f-4aee-a8cd-b82e77c4a157", "comment": "Malware payload (RedLineStealer)", "value": "473b20454e5d696d377335377189027f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384711, "uuid": "cf34b034-2671-4994-a019-cd2a6b4c14ed", "comment": "Malware payload (RedLineStealer)", "value": "f2eec5ba2e7c48a086cac282dee807985a59d77c3a4fc4801466b0bae09bc45b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384711, "uuid": "1640a83f-bc03-4311-b739-daf946cde739", "comment": "Malware payload (RedLineStealer)", "value": "8e959953d5a9c683608ae1d8bea83e230f6ea60a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384711, "uuid": "f1eec22f-1f43-404d-b160-f523930efbf1", "comment": "Malware payload (RedLineStealer)", "value": "6235646b7a0ec4385aa09bc21395975cc6896c976525bfe53900956093c56455247c9dfd9148f69f2d3a545ca4ac2b18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384711, "uuid": "f34488c4-83ae-4b4d-8b2f-9010439befec", "value": "T18E34AE11B4E1C433D87215360AF0EBB55A3EB9700B6159EFA3940F7E4F702C1AB75A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384711, "uuid": "9325099c-470b-4648-894f-c15a03886aac", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384711, "uuid": "64a8fabd-ac36-4111-9985-f12576615630", "value": "6144:SDVU7z6DCGbAR/VeDC1tAO1cCh0NwC9urBiIg:Sy7zaC+UjI3NwcurBiIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694384711, "uuid": "eb626b0f-8a53-4c07-ad28-3ee7b3f57a81", "value": 253304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694384711, "uuid": "47704642-6b79-445c-960b-9a1de867b0c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384711, "uuid": "e0b50989-bf97-4079-980a-f7e5fc49dcf1", "value": "473b20454e5d696d377335377189027f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885831c6-4f82-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694313254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313254, "uuid": "9a9bdbf5-7bf4-4d02-81d9-ba7bccfa7f05", "comment": "Malware payload", "value": "1ba7db783e31bb8c6dc66b5a411a6ec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313254, "uuid": "bcde094f-9688-4835-a478-b2a2a2d58b86", "comment": "Malware payload", "value": "f357e878cec01ecf2c0f2132c1b02865bb7b972fc9f6f639a7e1ae496c01c69c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313254, "uuid": "eed60a0f-a9c5-46bb-83dc-c925649e160d", "comment": "Malware payload", "value": "43e272e33b8844c843c98eae6b57df061f563287", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694313254, "uuid": "3e640ef3-50fb-4972-be76-5c78dd794b70", "comment": "Malware payload", "value": "9c757b5d35264f76358f9b7f3b10477b4236a75bf627071d78cfa79271217c347353cd4232f1a180b57b519f4d5cd425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313254, "uuid": "659dbdf0-77f9-497e-948f-85a4b0f7b249", "value": "T176C52313BBD081B2D7622A320F749B27897DF4201F55CACF6391CD6ED9316C2A536B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313254, "uuid": "6e257713-331d-41f5-89fd-4a1956a4cfd1", "value": "30d1665d4c796f53fba13defcdef7cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313254, "uuid": "6ae0f393-e48c-4770-93ce-59541adb1c9d", "value": "49152:xWhlkLBfJXAEX8g0MgwMpYjfqvYtw91EqMqG3j2s6TNeovMa+DP:xWhl0BfKE501lYjq9EqMqG3jnovYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694313254, "uuid": "498415db-c3c2-4be1-9ff7-96a9ff0e9d3e", "value": 2587018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694313254, "uuid": "fffc50cf-9275-4b54-a84e-6cb7448fbce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694313254, "uuid": "e0c9c615-0717-4a6d-9831-d59264d71cfa", "value": "SecuriteInfo.com.Win32.InjectorX-gen.20684.9178", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d1f4c9-5000-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694367306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694367306, "uuid": "135a6dd1-e220-475e-84cd-f328d1cf56b6", "comment": "Malware payload (AgentTesla)", "value": "66d04f88a61786d633b0aa9a73ff96b6", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694367306, "uuid": "71dbe990-ed69-499d-bd2e-d9800561c58b", "comment": "Malware payload (AgentTesla)", "value": "f3fa17f077968e21b576272f266032b124a2fa1733384efcb65fc0f0f127af4d", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694367306, "uuid": "a20baca8-c1ad-4776-9835-e368ca1897e3", "comment": "Malware payload (AgentTesla)", "value": "7af451d0cffe56342239e542b08cfec517e2f9d3", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694367306, "uuid": "e6d9d1bf-a08a-45ad-8be5-8efe0cafbd10", "comment": "Malware payload (AgentTesla)", "value": "62da63b66ce2cd1c172bc321b83d064290c0bdd40dc99de344e0a1008908b2319cf97c0d24f0703a807b4e7f202ea9ae", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694367306, "uuid": "00aeb304-6fb1-4922-ae4d-b22527ff6977", "value": "T1DCF4338CD8CB4B32DC6350BEBF114715E5D1A4B537868C0B9256E5C0A6398D68BB9E33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694367306, "uuid": "0394a540-4e00-4a72-96b8-783674bd675c", "value": "12288:Z28ZAwmeaqn+0QhfzMFHjP6hQoohvcXaRVrskqC/iUItLbBeZjNt6zwU2xmX5lD6:Ag+9wh76hQXvYIVTxbIlQCX5lD5GrDp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694367306, "uuid": "2659c886-70ce-4a67-a839-92557c8dcaee", "value": 785280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694367306, "uuid": "514d2931-31ae-4e7f-8819-5d85b8f33ce2", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694367306, "uuid": "f158c121-1e1c-4342-b1d2-76a6880a3962", "value": "Invoice for Payment.Pdf.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206e6053-4fe2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694354312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694354312, "uuid": "832f7eaf-ac8c-4ebd-9b07-24faf6f649ed", "comment": "Malware payload (AgentTesla)", "value": "9acf4fca9980f676b15d47f31d929abd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694354312, "uuid": "9c91f033-76a9-4a51-a2d0-f45245be3093", "comment": "Malware payload (AgentTesla)", "value": "f9b0432e1c9b1e9a73e3388b9ba194e886915e8ed7488caadbac2e12f73ac50d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694354312, "uuid": "0612d841-c97b-46ee-ac77-39c85b8e1391", "comment": "Malware payload (AgentTesla)", "value": "f2b13a8bb2256f217557c6d74e2cb2b2219480da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694354312, "uuid": "b76ab964-4d78-4cab-9d51-66b8c7b20b6f", "comment": "Malware payload (AgentTesla)", "value": "e5c32192fc64907ff85a454a7d647c5b9fbb0ea565630c07ac94eb6e23f798e03ccbbda50300f9ddf1311e99fa8b5c4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694354312, "uuid": "302eba07-abcb-4ee9-9f89-fd80eb094f05", "value": "T133E423D5EC1B9AA32DD204166E3FDF86D2607272F50643267B2F318865AD780D374D1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694354312, "uuid": "2e7484d3-6eb9-4623-b96c-5ebdd408dd7a", "value": "12288:73wMaAvBgxU8cqV4xks7k+wuQImWAERBgDYeq4LOb3k0ZHrnaR0:Lwn88cqmg+wuQImWAEROnqKUJram", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694354312, "uuid": "0ffbe5cb-c9c8-484d-a342-026eea0e0f7f", "value": 660018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694354312, "uuid": "0f5b48df-7206-451a-83b9-b584c9a3f688", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694354312, "uuid": "7f8fd9d8-43b5-43f5-8ef8-4c3ccff27775", "value": "Invoice for part shipped.PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a89ebc7f-5028-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694384605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384605, "uuid": "17951673-a872-47d4-ad83-58035d875e20", "comment": "Malware payload (Mirai)", "value": "b724b7370a8465857ebf2f0d18a50e39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384605, "uuid": "018726f4-7755-4414-b852-93e3cda13cb8", "comment": "Malware payload (Mirai)", "value": "f9b29fae33f0e0bb87e6740f8eda933871aae7a34bd45661d4a59d2fe60bd9fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384605, "uuid": "e94a2061-39f9-4696-aa33-89d830e13dca", "comment": "Malware payload (Mirai)", "value": "bb4f1470e1c7f425d78c97cfe2489603068a93ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694384605, "uuid": "bf87a74e-4abd-48e8-9406-84100b281b17", "comment": "Malware payload (Mirai)", "value": "90e0f7caae2cc44dd8772fb0a696da217c2fc62844b61879c2ec6416f4d0fc24f3e1012f19012ccd36b37ab79948bf49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384605, "uuid": "2e8a2626-35fb-4d30-8e7b-17a52f5bcd3a", "value": "T13DC2D00A25688C4CD81A23F91D968D923C9F7D31E07A62D953CF8487B0E9B0DE824CF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384605, "uuid": "f37ba0eb-5a5b-402b-983a-20375b2530da", "value": "384:MPESa3NJ6YKcRnNRFR9OApEIF7wDAZ4/ClkyU0nuHLei/YQ4JGcZlwNI7SWwmSyy:VNJV5paAZ8C5nursZocZlwCGWw6rNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694384605, "uuid": "e0e595b3-9c88-4c14-bdc5-6ce5916362e6", "value": 26712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694384605, "uuid": "64a96371-17b4-42f9-ad93-60d52adf7a87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694384605, "uuid": "ea3e0901-bfbc-4f4f-a19f-635c96a3a231", "value": "b724b7370a8465857ebf2f0d18a50e39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d217fe-4f90-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694319055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319055, "uuid": "4559e5b9-767e-4456-97dc-94f6816cfae3", "comment": "Malware payload (Mirai)", "value": "a8e1ecac887d10139f560bb2aa0f01fe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319055, "uuid": "c8259685-00ff-42c8-b3e4-154617cbc904", "comment": "Malware payload (Mirai)", "value": "fa0f33cef86ead0b17b605c37d2ee5dc57f2d755705725d567ae15373b8d0289", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319055, "uuid": "8803011a-2e1b-4bff-877e-3a8e2af3b3af", "comment": "Malware payload (Mirai)", "value": "1f8a242f2d319f6a0610f7e55be7a1ae7c6a8757", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694319055, "uuid": "acbaaa82-cce5-4b8d-904d-73f0893b40c9", "comment": "Malware payload (Mirai)", "value": "b34c220e7692a929e643be601a887638ea8ddbe257aa827254019648f6a0bb8692fa7d4eaf6a46d51cece347e279805f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319055, "uuid": "d76f58b2-1f13-40b5-ba46-d358a68dfb06", "value": "T1FBB30945FC509B17C6C212BBFB4E428D7B2A1768D3EE72039D256F61378B85B0E3A146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319055, "uuid": "aeb67282-2571-4be5-9a9d-c43456e1acdf", "value": "1536:phNOKndTYan1/AxPG4VamYT8rZpaMBE6qNfFZhlcrwywLFOK/HDGLzuQWGOJby:ph98w1/345Y4rZpaWqNdax8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694319055, "uuid": "65f10b02-654e-4e67-a9e9-2303186131a5", "value": 117504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694319055, "uuid": "987ba63a-2871-4d3e-8f88-fcf4cd43dcd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694319055, "uuid": "fe59a030-ef8b-4d17-9ab6-893ef9d9ae77", "value": "cundi.arm5-20230910-0410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c449c3-5000-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694367556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694367556, "uuid": "3cc45256-a6d4-4576-8567-6ec1849393c9", "comment": "Malware payload (Formbook)", "value": "ae5ff1f88b4b8c47a2fe3dc962a71ebe", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694367556, "uuid": "ad8a559e-5a63-4857-b571-69f04a14692e", "comment": "Malware payload (Formbook)", "value": "fb31665e50168998ef42b5e265dc411786fa8a2ecf1980af92da997b3c573622", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694367556, "uuid": "e24f3b34-263c-440a-899a-71dd7c196b03", "comment": "Malware payload (Formbook)", "value": "0f3057452061a3e30863042ba09260774b77ffa6", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694367556, "uuid": "79e52b61-8ea0-4475-aebc-22a1546ff290", "comment": "Malware payload (Formbook)", "value": "03c61ea99d8d17f90f3241bbeb23ae5c0a1091c0727d617b6a0b44acb6a132112ae520adbcad1a27ab666a919100be50", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694367556, "uuid": "a8e4e86c-22ee-4157-b287-52e17418acbe", "value": "T1A7D423004381519AA5B9EBA0C356640ED97C8FCB1CBB1B4C107BF6FBB1469DE526C63E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694367556, "uuid": "b9bd621c-3a9a-472e-adb8-b35e5d7cbf72", "value": "12288:EbVXzTsAU7aJLs+2wtUS+3XKTbsQzgwe/u6:EbVXzgh7aJLs+2wmSGXYsOXe/u6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694367556, "uuid": "e23e8b38-76b4-4401-8d37-f42ca81a9871", "value": 607643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694367556, "uuid": "269f72bd-082a-4791-bcc1-02f121ba70f2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694367556, "uuid": "7748a956-de3c-4a4b-bbf1-6d96cc2f605e", "value": "PI-CA23025.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815b197c-4fbe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1694339012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339012, "uuid": "c26843f7-2a2c-4eeb-9537-dccad850fc07", "comment": "Malware payload (AveMariaRAT)", "value": "bca408ca8e4a4d10c877744bfb58b43f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339012, "uuid": "54c01ef3-3851-44eb-b0c5-fe32f08e6ebe", "comment": "Malware payload (AveMariaRAT)", "value": "fbb1f62b75df3af3305a3bca694e4050dbd86718390db2f737a5db2d8cca96ee", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339012, "uuid": "b46ad5c6-333d-486c-b6c7-4265bebd5919", "comment": "Malware payload (AveMariaRAT)", "value": "2808f5f34c9b5c62c65e47015d82ed7dfea73a62", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694339012, "uuid": "cd45009e-3b1d-488a-b839-5fbf22f0507d", "comment": "Malware payload (AveMariaRAT)", "value": "c9f6fa302da0acf4b9fa1ef0e9fe697866ddfe682898d21669baa0110d6fd556688253a77233c661064d36a30b5cb246", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339012, "uuid": "3cec5b7a-bf05-4908-83a0-2ed521b21a48", "value": "T160653331CC06A34FFB3E74B2520A7F106A8DC761153895CB2AA1B905AD4E1BC7946F9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339012, "uuid": "728482cd-450f-4684-80dd-ccdc8f3680a5", "value": "768cce1a3135ef56ac91aeb097edfe55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339012, "uuid": "418e6f40-8e36-412c-916b-73b0581ff2b1", "value": "24576:i/U/qOJD8wC779sjdllpjLEtJgIf1E+UR9t1S+qWXqyS56Pta2RjMb3lUS/cr:i/pewwmsffXd+Unt1KWXsGJVMb3lbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694339012, "uuid": "d69c7f25-8cb2-433a-a719-3ef57b0d66dd", "value": 1418976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694339012, "uuid": "cdbb82f6-ec31-496d-8036-dda91dbfed8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694339012, "uuid": "965c163b-a659-479a-bfa4-0b28a267ede8", "value": "bca408ca8e4a4d10c877744bfb58b43f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }