{ "Event": { "published": true, "date": "2023-04-24", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-04-24", "timestamp": 1682380981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "50bcefd6-3d25-4e96-8212-5181c27cbdf4", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa67084-e2b9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682352239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352239, "uuid": "1748b81e-5f1a-4ac3-b606-23fd6b9da11d", "comment": "Malware payload (Mirai)", "value": "67f65e02f9fdffd2e0e38fe1c53076e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352239, "uuid": "358d1ca2-5f00-4647-8788-8e45d774dff6", "comment": "Malware payload (Mirai)", "value": "00413aca07bf97f21c894fe05208a8604508feb48a6b9b049d2a5524d437e1d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352239, "uuid": "3130a0a1-95ef-4adf-afee-1b802ab438c8", "comment": "Malware payload (Mirai)", "value": "515db577339106ad287a2c1c5272e1ca0a8ba26d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352239, "uuid": "37805593-cdd6-4cab-8f2f-a4c2582a68f3", "comment": "Malware payload (Mirai)", "value": "eee5f8015ef2331cfabd044890b6cbfe763cab494ebb9db58e852b3c90a03c435cad0eac28c5b83ff121aae09b789abe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352239, "uuid": "cbc7aab3-c336-486a-9780-3a0f9720c84d", "value": "T1A7A32A02D5414A57C1D22BBFBA9B425C37235E6897DF3312AA24BFB42FC279D0E79121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352239, "uuid": "b2880e60-3e07-4996-a01b-0358aeb28928", "value": "3072:g/28W9eYAa0XT2pZqoeFi4XNOlHEMGmsQ0NqKV:/91AaKT2CK4XNOlNGmsQ0kKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682352239, "uuid": "8c1d74b5-05e6-44a9-a6ba-09cfdb120c0b", "value": 99796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682352239, "uuid": "392d9a85-ebbf-4cb2-9028-6ef63cfab782", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352239, "uuid": "f95fe500-5b27-4ebb-9151-42271bba5b7e", "value": "67f65e02f9fdffd2e0e38fe1c53076e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e1b1a6-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303210, "uuid": "d4c96672-2133-4e52-a9f1-15313aef622a", "comment": "Malware payload", "value": "d13c0308d52b69bb43d73fa347075945", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303210, "uuid": "c5633680-ea98-4b9d-ba6e-eab5a8baf2cd", "comment": "Malware payload", "value": "00f29d2e2f6d866d87ced3f5444f61ce9ee0afc481e846c63795d758ed46099f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303210, "uuid": "137a278e-b514-4b59-8fc3-a2f7713f0ec1", "comment": "Malware payload", "value": "013ca2eb3da5b81176419df3bb3bbc0151357889", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303210, "uuid": "c06fba7f-2ae6-4316-adb6-a4501e49dbe7", "comment": "Malware payload", "value": "3303c937ec92d5db2cd1902923f7391fbf189b52f7a884dbc4e3ce56933f0b2e1f43373634c81609f71f61f28daa9603", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303210, "uuid": "2d1e6b83-2ce7-45ff-ac75-36244576a660", "value": "T192E4AF22F6C68032C1B322719EBEF36AD63DB9661327D2D727C81D315E905416B2A773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303210, "uuid": "70e5d225-f7b3-440f-943a-dcaa286f1959", "value": "c7f5988723c93ff7e3658e3098c0f8b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303210, "uuid": "89b6b908-1d90-432c-85d4-fdae005bab37", "value": "12288:mWUm29IKQpp9kJpXABilNlZ2MqoONQ4fjYQ4nY4a5MOlDp4wvT:m429Il/uXABO2MnONTrSHa5ZrV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303210, "uuid": "9a5dd9d4-b695-4e2e-a946-129be7304561", "value": 720937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303210, "uuid": "87b36a6c-938d-4fdf-9cab-a1c73da568e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303210, "uuid": "73d93359-6af4-4b60-b8ac-b40e9e728d3a", "value": "SecuriteInfo.com.Backdoor.Androm.329.6958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6589d89c-e2b9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1682352141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352141, "uuid": "63484af3-8d1a-488e-8d43-c73331ccf02c", "comment": "Malware payload (zgRAT)", "value": "be3af123cd0cd9a23a598680cd184b19", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352141, "uuid": "9d816765-a8b5-4718-91fd-d4d8c80c4d8e", "comment": "Malware payload (zgRAT)", "value": "0127ebf8628f963a453520b0149fc11fc5d0a56536ce2a41c9dfdd3c597a0746", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352141, "uuid": "b15fa42e-4684-477d-bd39-b4526cdcedb0", "comment": "Malware payload (zgRAT)", "value": "db22afd0f45a7173fbfebe2297eb4db422695d56", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352141, "uuid": "640cb186-ecee-4847-97e8-bc0059696f2e", "comment": "Malware payload (zgRAT)", "value": "85c1550c5bf848c61750efd7068e512aa89eef8c2139603f52ad4c3dcd06d1fd139176100987b8e12cbd4db57a855330", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352141, "uuid": "875ef49c-fc4a-4265-aab0-b41519d3d748", "value": "T159B5F1373BD2FE95FBAA1F74E4D120050DA0BC6BA67CD25C6CC456DF14A2B109E50AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352141, "uuid": "f3eb6e4f-3755-4a2a-b95b-905d3a5b0d0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352141, "uuid": "5be21a49-1702-4f97-a651-14b02208d693", "value": "24576:pNT5rn591lIwP5cOZ4eFGPaAHFRZzHrd5id50pxl20viulp4MSIPMUUGtV2ptJe6:H4eFXqD5/sKVa4ui3xQ0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682352141, "uuid": "d7d22467-522f-49e0-bb81-db86b79970ba", "value": 2369024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682352141, "uuid": "6f52538e-cd18-4593-8944-3331c9c9c267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352141, "uuid": "5908b55c-4034-4365-a6cb-ae78de3d1bf2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cca763-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682346830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346830, "uuid": "ac03e8b4-bfa1-427f-9d1a-29805ac8e6d7", "comment": "Malware payload (Gafgyt)", "value": "110fb8d7329a37c166fdbe55263ef51a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346830, "uuid": "890564d1-d1ff-4bea-8bb6-73ce086f50d3", "comment": "Malware payload (Gafgyt)", "value": "024fbdb77067dab08d5eef7ee47249a0067a0a02a9c638a1cf36869b3759e419", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346830, "uuid": "7752bff1-fd12-4142-aca4-314648d8a3a7", "comment": "Malware payload (Gafgyt)", "value": "a63ca22401d5648c859ed52e42d47ede515a4bf2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346830, "uuid": "a2115c48-e020-4c46-bcd2-f2d669c9cbf8", "comment": "Malware payload (Gafgyt)", "value": "69394ffed8d0aa100e7233292af7876161100199851876e07846a95aaffb765f66c50a755a201ee5d58c80160be0e607", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346830, "uuid": "a68e6392-5bc0-4d5a-bc18-94296960c89d", "value": "T194830941FD418B17C2C327BAF79F435D37356A6497DB33016A386EB42BC67982E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346830, "uuid": "5a0cd91c-407f-44fd-9d8a-bf803f7be851", "value": "1536:2TxGIBAIxQJ8x5OEVBvFB3n1l8OYSUmZhBQ4Kb3RXFFj:WBa8hBb3X8OY5mZhBQ4KjRXFFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346830, "uuid": "488e9bcf-d7bf-4d39-8924-de1f92074d6e", "value": 85249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346830, "uuid": "382f873e-547c-473f-ace4-a428682a7a5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346830, "uuid": "c43c4b8d-6818-49c1-b527-31ba860349cd", "value": "110fb8d7329a37c166fdbe55263ef51a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390bd90c-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682346913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346913, "uuid": "4e2ab622-5a70-4cff-8f68-8a1e058f5d6e", "comment": "Malware payload (Formbook)", "value": "c0c776e3ee6a6b9786df9d62e674d819", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346913, "uuid": "5ac2632c-67d2-41f3-9b78-7bbeab71f76c", "comment": "Malware payload (Formbook)", "value": "02ea9a838872751f53f53611015ee23062c2cbc9b71a962caf500e54a145e87e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346913, "uuid": "5477ab04-2dde-4fee-a20a-c67973d33d75", "comment": "Malware payload (Formbook)", "value": "bfc4f156037c8de503df061666643321dab77dd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346913, "uuid": "f859d5a5-5a1f-4592-9765-53c80fd3d275", "comment": "Malware payload (Formbook)", "value": "38cd1581d060517b5027713cbbc5392e8ce2350b4dd33f917f7042e91f04c9325a47a37d2946ee3c2e04b4e6c350305f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346913, "uuid": "083437aa-5810-4eee-be33-79d04e1ff2ac", "value": "T137C40290526FBAF9DCCD53BB0658249A037170836126AA6C47E85CCECD42F4BEF0659F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346913, "uuid": "98518118-ef1c-49cd-8fb3-24e01f71a189", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346913, "uuid": "c378075d-ef6f-4064-9d86-3ae860d99158", "value": "12288:C4ma5mM6ay5ukBY1vzaI7ZVNtDb4ulzEdm4sE:C4mchyAkBY1vzDtDb579", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346913, "uuid": "2c6803f4-fe8f-4f2d-bb99-f1944809ae4f", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346913, "uuid": "fb1c607c-6667-4788-9d20-c784ddb802a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346913, "uuid": "d4a65848-b0af-4c21-93fc-33f27a4859fe", "value": "c0c776e3ee6a6b9786df9d62e674d819.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07118e97-e2b0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682348117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348117, "uuid": "1f119ac6-2aa5-4acd-9282-bf01507cd36e", "comment": "Malware payload (RedLineStealer)", "value": "b99c76540d3b204c11825ace85c14a3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348117, "uuid": "b84d6005-2029-4dd6-95f3-e6784271b83d", "comment": "Malware payload (RedLineStealer)", "value": "03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348117, "uuid": "12c613ee-2ca3-461d-8633-bfdbd888be73", "comment": "Malware payload (RedLineStealer)", "value": "a128f20a955deb1fb13ec634d13cb8580afd8a3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348117, "uuid": "2b1596b1-fcf7-4129-acb7-57a319770dc6", "comment": "Malware payload (RedLineStealer)", "value": "6fbd637847b8f272266e2d571950c5fcd752daeff79b93a9b6e00aed3587ae6f4bda83dea086f8fbb4c608d152c80516", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348117, "uuid": "7b8c3a84-94e7-4672-8c09-970d71786b1f", "value": "T15B943A8AE3DACCD4F57F12B8513044916F65DCAA90AFA54C146CF96A7833392304F9BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348117, "uuid": "944ee653-735c-4dd1-9368-3d5303b301f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348117, "uuid": "ca4ee409-3583-4f0f-a6d7-9d6f797e6c6c", "value": "6144:XHRkJHRQjf4tupsZWU+EYUD98oBhhbIiKpWJN:SpRQiuiHpD95bbQpWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682348117, "uuid": "b2e61bfb-4458-46b5-93cc-94ba2e81a378", "value": 423424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682348117, "uuid": "e06c56ff-2179-4e6d-b8ae-3b5de6c0c329", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348117, "uuid": "dab1c1bc-8600-4d41-a112-82257ebe67f9", "value": "b99c76540d3b204c11825ace85c14a3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598df8df-e271-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682321198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321198, "uuid": "f3443c58-63be-4bc2-a9da-b207079fb7d7", "comment": "Malware payload (Mirai)", "value": "e2ace18e1e7b71844bf2f40c51b7746c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321198, "uuid": "70548762-8374-4fae-a142-45ad0420bc1d", "comment": "Malware payload (Mirai)", "value": "03dad1a82ed485803ddeb181acfc4cf1c0f16e29e50c4afb540032f245f289b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321198, "uuid": "dfc27c25-ad44-46b3-aec0-26add540fe10", "comment": "Malware payload (Mirai)", "value": "17b4cd62dfd2d6f7a391a81dea7d934153a5cd27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321198, "uuid": "ebe1e987-0f24-4569-aca4-237a89e3100b", "comment": "Malware payload (Mirai)", "value": "692d2305c08338c69b938979d9244bffc97cc9d4380ab2c628fd117cedf47304ad376ef7a3962253eb116300b241454f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321198, "uuid": "92419605-ae56-4860-a4f7-fe5c344ac470", "value": "T117235CC0A943DAF8ED1106712573EB728B7BF17B203DEED7C799A5329842601E20729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321198, "uuid": "e12ba25d-e689-4ed2-9e46-f1648538bcec", "value": "768:P88MBBFLM3vqOP22w8jKRGjTxJGSzAxLY/UqJpYrbmiGO+YfH4a:E8aBFLMfqOP7w8MGZJrAxLAJpY3miGOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682321198, "uuid": "719c3144-d96b-4c92-b68d-0dfce3e6fdf1", "value": 45660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682321198, "uuid": "e85639eb-1422-4137-8975-34708272520d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321198, "uuid": "9dfb82ea-0887-474d-aa77-8aa5eef7c3e8", "value": "e2ace18e1e7b71844bf2f40c51b7746c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0d039c-e237-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1682296452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296452, "uuid": "6025770a-8902-45b4-90e2-f689cbc4f9d8", "comment": "Malware payload (njrat)", "value": "d6b26973059fe1e452cd9ed47a0bb27a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296452, "uuid": "afecdac0-9e34-4f20-aeca-9e3276ce6807", "comment": "Malware payload (njrat)", "value": "049362a1eec3af3e554c23e6c825187b8105bb85f8de0c2836020a3cb923accc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296452, "uuid": "10633615-1614-4f34-8a8a-6599ddf6daf3", "comment": "Malware payload (njrat)", "value": "aec324424edfb1c2869252db3ec435f580087769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296452, "uuid": "e6ee7e19-0226-486c-a5d1-9b4cb3de3726", "comment": "Malware payload (njrat)", "value": "f083ebca917c1dc2ee8fd0c161a4d27a39e8f7a98814e1c8f8d9b27f4ef7523886a540d58cc6681859f0d26d9d913107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296452, "uuid": "dfce038b-e6b3-4320-9687-a29986a3ef3f", "value": "T1FF033A4D7FE18178C5FD067B09B2D413077AE04B6E23D90E8EE564AA37636C18B54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296452, "uuid": "2292f8c0-27eb-4245-8298-439fdd643f72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296452, "uuid": "4930bb18-5221-441f-b36d-e58a373c9804", "value": "768:zm23pLGv8P6a58iWXrM+rMRa8Nuzf3Gt:C23pLGkya58XI+gRJNIf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682296452, "uuid": "97b194b2-655b-4418-be0e-24e750a254ed", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682296452, "uuid": "a797d74f-05f9-468f-ae78-9f3a17bd6d83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296452, "uuid": "d0c8854b-bd0e-413e-a5d9-76ad4545a1a2", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d354efb2-e284-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682329562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329562, "uuid": "2c520f52-a21d-4af1-aaa3-586c90460a4b", "comment": "Malware payload (Mirai)", "value": "c3422a75c891da8f3083dd99f23556b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329562, "uuid": "d89365a7-3cfb-48fe-93a1-ee9b1b3b29a7", "comment": "Malware payload (Mirai)", "value": "04a699dc4f4e92344ca99b63aefc9c527987a76a2fc2b3a1051bd1a272c48d85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329562, "uuid": "fd16ddcd-1618-4997-bf53-7fab487a5178", "comment": "Malware payload (Mirai)", "value": "6c84968bd76e9484eff6b59313494f2c7ec04ce6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329562, "uuid": "a166d041-ef3a-4fc0-ab1b-0f54a1dfbef7", "comment": "Malware payload (Mirai)", "value": "14745b934622720c668a48d038049d18e859123f5105c865eeb012d4217d95a6fcf18f077697d690606044bdb2d936b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329562, "uuid": "3c0843b7-b0e2-4879-beeb-c362b57e7389", "value": "T197A33A82E787ACBFFC6957B88A5B4F7423C445AA24B5D583D36D7E060B641C0DC18ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329562, "uuid": "a9d1f404-3f88-4a2a-b694-5ceb584f5e35", "value": "1536:cgihF/+gZ8H430WIcBddFg41PqsLGIi6Go1gum05T/Y3Tv3b47XA8KNuxM9mjFfJ:al30QlzGIi6o4tKm2XgAip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682329562, "uuid": "5f3c94fb-270d-44a5-a759-f0475d247440", "value": 103368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682329562, "uuid": "4d0d2a7a-3eb9-401f-8ea0-87df917686fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329562, "uuid": "4baa875a-67ca-4338-b246-0bc5f09f3f64", "value": "c3422a75c891da8f3083dd99f23556b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a52348c-e2ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682346217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346217, "uuid": "d3571ebf-91b5-4f4f-ba8b-8ca70ccf7d0f", "comment": "Malware payload (Gafgyt)", "value": "d0b4632dcee55cb5d8e75575168da406", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346217, "uuid": "7da5e73f-dbcc-4fe9-8bc0-9742b963ddd2", "comment": "Malware payload (Gafgyt)", "value": "04a8e4c4908bfc6fdbb26f8e9f2dbfa9b323ecd85560badf87cadda6dd724557", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346217, "uuid": "81d23e9c-0d70-4d16-a79e-1c0a374e8764", "comment": "Malware payload (Gafgyt)", "value": "639917f03a0e40facf256234598bd2a0415ad842", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346217, "uuid": "0b0d8698-ae3b-4dc3-8da7-c8746ee44954", "comment": "Malware payload (Gafgyt)", "value": "70351dc04af9aa6537d5ad6aedd6b57e4df6739dcfcfd03bc0031b1e2a8f913c93cf53e6104cac04c064c9bf02e24e86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346217, "uuid": "ad1137bd-7f52-4a91-a47f-f0982c980d9d", "value": "T103933A277B230E23C0CA557112E30331B7B5D74938FA4797BAD16EAC2F16A8439167E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346217, "uuid": "4b7422fa-8ccc-4f42-a148-e9b9ffa1a0a3", "value": "1536:jW6Jk7jWNEqi+thy5ct1XNcdj333mX0Gq4/cOf3Tj:CwNzi+7C+Xqdj33mX0Gq4EOf3Tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346217, "uuid": "3dcd58d6-95a1-4c88-aa85-20a7a380b13f", "value": 90411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346217, "uuid": "2f70cc60-d593-4f26-997f-e0d75e7dab9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346217, "uuid": "1a9e3def-6570-4fbf-8965-6f75fcc7e90e", "value": "d0b4632dcee55cb5d8e75575168da406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3386ec-e235-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1682295353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295353, "uuid": "409f4919-b27e-4c83-9571-774b17143146", "comment": "Malware payload (CoinMiner)", "value": "0b217858ed2c8e35cdab3853603241cb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295353, "uuid": "12ac0b66-871f-4797-a490-36669b538901", "comment": "Malware payload (CoinMiner)", "value": "04c462f6942e8741b051a890afe0b558c3b3c28ef9283012e0e3c781a031a0b9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295353, "uuid": "eecf9e1b-5202-4165-8a68-fc4b4b3be8be", "comment": "Malware payload (CoinMiner)", "value": "d1576c729f62890f32a008ce55eeea0ad60a8c58", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295353, "uuid": "bacbc9d1-e92b-489a-92aa-812b4be9a261", "comment": "Malware payload (CoinMiner)", "value": "b2f6e568b06268854ff95abfa0e56717b0fd783de1afb3441d634e695c17c63d1a274a3e2193170096d912843faadf5d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295353, "uuid": "bca36c4d-5db9-4dd5-959f-744c6b453461", "value": "T1DEA5236773A9692CD63BC432D94F7173A5F0B34830F436259B61DAB13D36A90528FB88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295353, "uuid": "ff2f7da4-6707-49db-bc9f-12e3cd4a7ad5", "value": "c24ea937b2b0d62e829e8a8faeff5a8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295353, "uuid": "7a78925a-4d46-4b6c-9ea1-53212551f4c8", "value": "49152:CzZfZ227H35Cu1RdLx5sHniY4rK9uRRjOkmo8Ji8ay79Yd:C605C+TciYZA5Koui1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682295353, "uuid": "498a2f5d-d8e6-4943-a4a9-e1a9b5b9acd1", "value": 2225432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682295353, "uuid": "d5cb4f12-1468-4380-a0a0-70b0f6eda04d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295353, "uuid": "01296093-11a3-4e4f-a173-5a3fd999e303", "value": "GoogleUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d117cc01-e26b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682318821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318821, "uuid": "47b930c1-2549-4376-bead-118f23d65e61", "comment": "Malware payload (AgentTesla)", "value": "8b760595c24ff8aceb610577411a8b81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318821, "uuid": "fae0520e-60db-445f-a99e-51ac0bcf8031", "comment": "Malware payload (AgentTesla)", "value": "052c8baec64bdb69962457500cb577de207c92903896237b75d46de84779f3ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318821, "uuid": "491cff66-fe95-49bb-bc84-c6d10e3f8940", "comment": "Malware payload (AgentTesla)", "value": "772f87606564a2f349e5efec8e44407cb88b560a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318821, "uuid": "a93a1325-c4dc-4266-a3b2-6739c8fc496f", "comment": "Malware payload (AgentTesla)", "value": "ee41ec11a9e8dd1772d6745ae69f65338299d163ca706c6502ff73a4b6529d52ec5f349a1740e1cfb813f449a726d9be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318821, "uuid": "ed7b1aa1-502e-418a-a931-5bf70b7d8993", "value": "T15C5423630587C8D4834AB67C75BAA53C4F8A6F414492E5B76F32C36C4F81C4E0B9BB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318821, "uuid": "9bf8490e-f82c-4b53-86ac-59ceb94cdaae", "value": "6144:BYunZvJMcUEqfcd/dEu3wylA4IddSDh3/qHTeriBvjoIHGPar+y:BxZxza2U4SSV/qHTeripjnGyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682318821, "uuid": "3f68ffc2-8081-46e0-ab90-0c2488c2914c", "value": 303061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682318821, "uuid": "b7a14ac5-99fd-4806-a43f-fb78d9ad8f2d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318821, "uuid": "514e1228-5cf1-4d0e-bcd7-5e7d7671fda2", "value": "Consignment Notification-\ufffd 6183111.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc5a9d7-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682346897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346897, "uuid": "71a40fe5-7263-478f-a0f8-89c7d3b8597d", "comment": "Malware payload (Formbook)", "value": "a8c009da2ffb5b732fb962f049f2af83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346897, "uuid": "f2485847-120f-4105-9edf-5dfd710d6aaa", "comment": "Malware payload (Formbook)", "value": "067bea125f176d75cabed99b0bc6bd3a3957baf3a361d6d3848911446e48d1b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346897, "uuid": "4c119ebe-6e99-40cf-9714-329357746d52", "comment": "Malware payload (Formbook)", "value": "fdb26444392a10fe29d7c514cf6b5217f8eede37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346897, "uuid": "96b57e3a-0c9a-403a-9ba5-4dde30cbb662", "comment": "Malware payload (Formbook)", "value": "895248f1293dd7ad2cd99b7e7e6688315e7ed61be6d60fe428a3654bb59f611f48e181b5d913c02b20393437495dddc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346897, "uuid": "f197e1c1-8527-46ae-ae4c-0d962a253d52", "value": "T180E4BF1B212AD5B6D55E62B3E0EA17FB0F5C2ECAED79A0831BA87CD431727B91F44401", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346897, "uuid": "12146d74-fff4-4ce3-b406-f9de3ee8ba4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346897, "uuid": "fcda82b3-99d6-4307-afd8-002d3ea60fd6", "value": "12288:OkDJK26q/xkX38Wgk8uk2eVEFuOZu2znqF:OqE8g8ukS9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346897, "uuid": "153e3b37-f7ec-46b4-a907-f0c24b64eef7", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346897, "uuid": "a01e9ba4-9f36-4e17-b747-40945d6e8b5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346897, "uuid": "782855e1-e00a-46ca-92c7-f16bc5bde0bb", "value": "a8c009da2ffb5b732fb962f049f2af83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e38448-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303255, "uuid": "8c7cea97-f680-4e2f-999b-56885d7d2a18", "comment": "Malware payload", "value": "bfe2815f1bf66f61255c7b41f40dd6b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303255, "uuid": "a4efef5e-9e8f-469a-8f9c-fa6d191f8185", "comment": "Malware payload", "value": "06a437cedef57158413e73e58629fdf6baf52a8fe1d81c170e005168da049824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303255, "uuid": "3a57050e-1d54-44e1-8190-a83d94f83c2e", "comment": "Malware payload", "value": "037776c97aab470c7618b6fd3042b7f8f74c57c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303255, "uuid": "a986d8a0-27ec-455a-b3a9-6a32056eb2a2", "comment": "Malware payload", "value": "7b4a4f78864003d9a198dcedc95978a9a9a43e56d3959d888dad0b7ac81343447006bb1d72e02f9a48ffa40fc534883f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303255, "uuid": "e2b1ad1a-12a5-442a-a934-aaca9802212b", "value": "T1A0155B5DD39D3C3ED1475632582BE5E2AC3BAA6093D599868EB4CCCCAF3E1C36130196", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303255, "uuid": "426ad4ed-7895-436e-ac19-e85bf83d5dc2", "value": "12288:QrL2b+CUpknn4u/yZmEA4tApMKyJiFEB+SRv7AbHtgin888888888888W888888M:Z+CAknnP/y8EA8qM9B+SRvMb2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303255, "uuid": "861ce669-d060-40dc-85c5-c9ecb6112f3e", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303255, "uuid": "89abf04a-facb-4668-b94c-edb82ed81972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303255, "uuid": "6393f031-21d8-4e0b-bc56-7bf19b27d144", "value": "SecuriteInfo.com.W32.Banload.RGA.tr.21564.623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98689efd-e2ae-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682347502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682347502, "uuid": "a06cc653-10b7-46fa-ab4d-d7e59d2f31f2", "comment": "Malware payload (AsyncRAT)", "value": "07c89ce8870fdf580910ec50409ec1dd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682347502, "uuid": "f0fe67ec-adb8-43a4-81f1-29a7baecda43", "comment": "Malware payload (AsyncRAT)", "value": "06ecfa4856379827c0a73103db1bca96cf0883b68448d2b63e631ace4f952ee8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682347502, "uuid": "a2205403-cf36-4aa7-ae0a-c86bf99f20f1", "comment": "Malware payload (AsyncRAT)", "value": "66e236f0a3566450073e0865f3c39158d199be82", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682347502, "uuid": "e074b33a-c07b-4ee6-bdb5-e46e5d1f7977", "comment": "Malware payload (AsyncRAT)", "value": "01b90fc68d4b2d5e17a00ee2d923d11df564bec8af26c68e820fb0f9c5cd4a56f68a07fe32b43b9e4c5442e2235f8f93", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682347502, "uuid": "845f1d00-6bca-47fe-98a0-2035e578a004", "value": "T196253A4BBCA040B5D0A9D23189B65192BB31B8991B3227D73F50B2F82FB27D95F35364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682347502, "uuid": "3968609d-f3e7-4af7-9387-52787092221f", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682347502, "uuid": "bc51fe75-4a1f-4434-b327-6f96361d4e01", "value": "12288:d4mT/RcXtvyJdBQhXVQpYDv4alOZqby13caYgd2Ds2UZk:d4C/6XtvWBmQpYTFgcaYgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682347502, "uuid": "5b07bcef-e1da-4136-8e56-0211ce9d61de", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682347502, "uuid": "210c0275-c4c6-4fa9-b4c5-2b234f9f7d3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682347502, "uuid": "d40190e9-eed6-4ff6-94c5-93f67d5b76c8", "value": "Ta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4482f38-e2ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682346797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346797, "uuid": "c1cf2082-6529-4767-b943-69f731305ab8", "comment": "Malware payload (Gafgyt)", "value": "36f1c20ea11b82ec9cef5029d1c86d11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346797, "uuid": "efb64ab7-7076-459c-a5a4-9aa492dd3877", "comment": "Malware payload (Gafgyt)", "value": "0701574648bb686c6ece6b70e0ed40e2c5d71370d9d220948cc92bbcb01743ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346797, "uuid": "57a919e8-a25f-401e-8657-c083b079b5dd", "comment": "Malware payload (Gafgyt)", "value": "c48c27e2b64db5cf6c773c44ce381d8e9f2d7c0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346797, "uuid": "f41b1a21-252b-46ca-b031-f12fb3efa784", "comment": "Malware payload (Gafgyt)", "value": "c788e1f91711dc2887e2a29fb2fc962b6c7fbdbe4bb1a69df3cae20d148d826189e110bb4c1a7065969541b869df38b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346797, "uuid": "4e2122b5-19bd-475a-a9db-9737039b1dba", "value": "T198830797B901EEB7F40ED67604D34B247230FB624E931A32731779A6AE362D43826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346797, "uuid": "6061ea86-8348-4313-a1c8-fb104d3e117d", "value": "1536:298IN0XlZxWx5f584AQssL4YMVBxnToyNrj1/Rg9O/Sz49P4VsvB/+mzS02q2/cb:mVMAxBZwVBxnToyNrjhRg984Vhmu02qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346797, "uuid": "394a2eef-cbd6-48cc-b559-6409c7df3c03", "value": 86515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346797, "uuid": "71b98c47-55b1-4a22-903b-a7c2efd5ffbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346797, "uuid": "d4161017-111e-462e-90bb-91d4947e3675", "value": "36f1c20ea11b82ec9cef5029d1c86d11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df20792-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330144, "uuid": "48f357d2-55e8-477e-acec-03c66f158b25", "comment": "Malware payload", "value": "803edc789f458ba1e39ad7d7f288e27f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330144, "uuid": "2832e328-8e5c-4cd6-bd70-70fe451a355f", "comment": "Malware payload", "value": "095b9e90e1c9d7d95f362fe381512da60bb31727c068c6dfabe055ab387aed82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330144, "uuid": "f4a5c9c5-8a02-46e3-9b7f-ef69e8c95097", "comment": "Malware payload", "value": "c46dfb00929fa8b11b529ce719b3f50e93010e4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330144, "uuid": "ac4c181b-5ac5-4154-aab2-c762ce49bae9", "comment": "Malware payload", "value": "00854da8b58693ded14dccdf236d0bb4b92a30b8d7d9b31a43f4f00d69153520a19c1c46f2a8b2edf8317b77fea56b9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330144, "uuid": "7a3aad5e-fb4d-4a43-90b0-da8116b59ef5", "value": "T10C66D0AFD175C639C206A571F1AE8BB1D03B66F02EF38539AB90C594CB5168B0F3E524", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330144, "uuid": "055cb646-ce06-4639-ac08-cda5f8405716", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330144, "uuid": "98926eea-d247-4a4b-ae38-bdd270d7f0ac", "value": "98304:foep1D1QMD38KnV/h8rYVVv+7vaRDMjPFS2ayjQez:foA1DOA38KnV/yrmVv+7vWDsPfajY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330144, "uuid": "b5f85579-ed8d-4ae2-ba61-e818c0c6e0e9", "value": 6642808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330144, "uuid": "9319ed34-4890-44c5-a766-d9e316a70a3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330144, "uuid": "b0197555-89ee-4a57-a1a7-d62c10132ea6", "value": "095b9e90e1c9d7d95f362fe381512da60bb31727c068c6dfabe055ab387aed82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30fd3f6-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682323119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323119, "uuid": "f1f2ab05-5f4a-4f4e-9780-f35f89b5ceae", "comment": "Malware payload (AgentTesla)", "value": "006fe58d4f3869d5ffa449b17bdc0d2a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323119, "uuid": "2dc7a6bb-ba21-48b0-a4fd-d41c863137bf", "comment": "Malware payload (AgentTesla)", "value": "0a55fc2ec6aa700235dc9e8bcf9b64e3baa7fe56c07ef186f0d972fe088391ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323119, "uuid": "b961085b-57f9-4599-b659-500f19cef113", "comment": "Malware payload (AgentTesla)", "value": "605b55b130e121f1852523b8fdb8bae1a76ce37b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323119, "uuid": "21e8e549-ad11-4bc2-a591-09b23a9db9e3", "comment": "Malware payload (AgentTesla)", "value": "2e3d427984d4a4186c000cf137ffc8594aaf1917b0853869fb5e9af217db60387d48d10fedc88f842c0673093a82d77c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323119, "uuid": "11369159-486a-4ac2-bf30-488e9b1f9f66", "value": "T170F3296993858A11C32D4078C4E401C91ABB9146660BE76F1EE1D8FA3F7A7D33E2FC65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323119, "uuid": "fc6dd025-dbc9-471e-a07f-7dcdb2f5b672", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323119, "uuid": "9e175602-51da-4fb8-b33c-bb5e44fd5f86", "value": "3072:R/2jAcLcXTRFgLf3D5Dea+A5C0QP//NM4eaFthinWeGAysvo:R/2jA8ccLdR9ZlasGXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323119, "uuid": "d9e64e1b-ce70-4ba6-8a90-9807e94ded31", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323119, "uuid": "6cb3f347-0a41-4c15-97dd-398b2ee14d4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323119, "uuid": "3e078e88-e548-46cb-9751-7ca3d9e25893", "value": "0a55fc2ec6aa700235dc9e8bcf9b64e3baa7fe56c07ef186f0d972fe088391ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2644f176-e28b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682332278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332278, "uuid": "c10871d2-6f65-4991-8583-e23449d2b318", "comment": "Malware payload (Mirai)", "value": "47d896140148a2ea04d2d2ef4863a0cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332278, "uuid": "2ecf64fd-0335-4f7d-b50a-5757cb600dec", "comment": "Malware payload (Mirai)", "value": "0ab1bc09eb8aa35cf6f8f2b33a85b087f34d932b108245bfab0d5b418dd1436f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332278, "uuid": "d524f5c2-c697-4590-b0fd-8bf007a664a8", "comment": "Malware payload (Mirai)", "value": "fa929005eb22beb7d7f9ca8681369373303fa959", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332278, "uuid": "74aeb478-8546-4945-85c8-d8861236cdbd", "comment": "Malware payload (Mirai)", "value": "4c29b3f250d193b7db03bed7bcab9dceb7e328e7d348c88890818a61f663746f4d9358289fa26f32ae12abab368feb18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332278, "uuid": "a2702f4b-d227-4eb0-914f-6070802d3f3f", "value": "T1AF03F751BC829A77C2E1137ABA6E4A8D336163E8D2CF7217DD214B207AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332278, "uuid": "c46de6f1-80d4-4a73-b71f-e409b62172fe", "value": "768:YglxkCbXsG5f0OhnlUl0O9FRA1wAob9/7WVuv+boy77zkXoTq/NkwW:YyZb8G5fDlUlXjwmqkv+PkxvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682332278, "uuid": "98d7f9c6-f4ae-4ae6-988d-c6a2a24f5c95", "value": 40744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682332278, "uuid": "a6b3ccff-4e3e-4736-8ddf-7c01938e8c5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332278, "uuid": "1dc917fc-0958-4bff-b819-9fa47cd47774", "value": "47d896140148a2ea04d2d2ef4863a0cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0959ea-e235-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682295569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295569, "uuid": "45dbe063-d0a1-49aa-b147-dbe976f96f46", "comment": "Malware payload (Smoke Loader)", "value": "bf79c092698a91cde282b76f966fe05c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295569, "uuid": "3dc88d7b-bcb4-40d1-be5d-1a88ee69476b", "comment": "Malware payload (Smoke Loader)", "value": "0b3f2a8d03591bdd551047b003628bf118335cedcb05ae627ed44a2d21502fb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295569, "uuid": "65f29b37-9d4f-4c63-9eeb-4ba3684af9fb", "comment": "Malware payload (Smoke Loader)", "value": "ca3c6cae0683e9526b8f7c6d9bc4e25304fa0011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295569, "uuid": "5bb4e853-c591-4d84-a53d-3070b1040533", "comment": "Malware payload (Smoke Loader)", "value": "bb863a6efdccf3d3754ceea685cc2b7f5ff84a5bc34c4c3b447a83eda4f84618c8a734eb69baa45edcf5392e95f21ad1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295569, "uuid": "44c01f54-d5b6-4ef3-9678-6c0339bc53b4", "value": "T1FB34DF21BAA0D4B2C45B8D704851E6B4F73EFC605B55C68B33683F6F2E707C09A7A661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295569, "uuid": "51f5dc40-0a84-41d2-984e-9b4c460f90aa", "value": "cbb199b85bd7e99e36eb212e7f14e32a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295569, "uuid": "42fa5a86-4ebe-4bb5-b601-bdca3a615de7", "value": "3072:TtDT1jz8oAkmiuziBiAYSJLd9k9XfY1+6bEXZXzZlcV54L2BEU1RE:ZH17wi0igGDk9vY1++EXvrFwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682295569, "uuid": "0791c80a-649f-4ea3-ad0e-7c933d990179", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682295569, "uuid": "94f433cd-3cff-4ad0-9923-81f2b6871a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295569, "uuid": "d3767a91-3d33-4639-abbc-f035d57e9d8f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314038db-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330149, "uuid": "1b99008a-9ef2-48d5-b9c2-2fad5b7cede3", "comment": "Malware payload", "value": "d6537d0d6d2520a0169f543c27d78711", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330149, "uuid": "6af781f4-653f-4be9-9c99-1fb3b1bec7e9", "comment": "Malware payload", "value": "0b478f9ed769603bba01ad7a2d6936a28424e4be05c8833869976aa77a98fed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330149, "uuid": "cd821d41-c7c1-4bc8-b9c5-7b0a9b941207", "comment": "Malware payload", "value": "36045f4d631d12ae2e7416188a1bd39dcc7038bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330149, "uuid": "ec38c63b-06cc-428f-accb-1fea2a3300a2", "comment": "Malware payload", "value": "63ef85ddf57a8bb2ef172bd5a2cb8e98075d9b9c609e8e1abc491fe86dbef5b404e23567152a8bc1cb6331887ddc7c12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330149, "uuid": "e625fd56-7e3d-4785-b25f-9034a836d34a", "value": "T1F436CF5F609097BEC20A9232C1FE5B34D53371A24467C72E5AC1E2F16A95D608F7EBB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330149, "uuid": "03808a08-e037-4e9a-b2cb-02ea4f671f89", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330149, "uuid": "b76db8e3-7948-4d8a-8e4b-a69da32212fd", "value": "49152:wQ/hNQGEaNUdcZ3LZDcpb3rwNHPb+P0dTKUsu2kRMMkS0DhDItfUZqv90wqq5Fce:X/lemSZhmAqF0wqoco7G8y7yH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330149, "uuid": "d35ae184-747a-44ce-8c70-19f261753966", "value": 5096824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330149, "uuid": "6ca2e6f3-c062-4358-b7ea-157664652607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330149, "uuid": "0508420d-3eaa-4e4d-8ad1-4b9c702824bf", "value": "0b478f9ed769603bba01ad7a2d6936a28424e4be05c8833869976aa77a98fed3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144cce95-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682346851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346851, "uuid": "52840ed7-30d0-43db-9c82-b54a777b797a", "comment": "Malware payload (Gafgyt)", "value": "bd615a17b57f27cfcaefb42b33c6143c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346851, "uuid": "0c12b44f-7b91-49ab-a93c-943fbc031674", "comment": "Malware payload (Gafgyt)", "value": "0b58e631424d485fa9fcaf30550b1d58d5dfd46ae8ca4fad0dde977aa16117a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346851, "uuid": "5269845b-8b31-46bd-bd3b-8c5b7ada3ee6", "comment": "Malware payload (Gafgyt)", "value": "51320312141ffc65c5eff8339c29df58152c7133", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346851, "uuid": "0eb6ce0c-7122-47dc-822f-222604a44d10", "comment": "Malware payload (Gafgyt)", "value": "acee3a2b53f7ed2c829eb4abbc13d7db80927e2ed98319268f6040e3418f7e84782e0bb131a43d9a7bfb3df1a5422b56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346851, "uuid": "3c5e76cd-248b-41bf-b72c-ce59baf49704", "value": "T17E633B42AA42CAB3C8930AB502EB9A260631FD2A0F179F55F31DBDF49F135C87617365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346851, "uuid": "e710ba37-a189-489d-ae01-8b7753919c61", "value": "1536:UD8bYEmDIdV5LTepgWncXyxolDmF+l2OZ/fufYEZ:DbYEmDI1LeNc4YmEl2OZXufYEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346851, "uuid": "25439029-5df1-457b-9826-19ae568a2286", "value": 68892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346851, "uuid": "cb424e11-a913-4825-933c-40e9a641cc75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346851, "uuid": "98f4ad11-7fc1-42e5-bf6c-f89a16f09aca", "value": "bd615a17b57f27cfcaefb42b33c6143c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a374cf-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303207, "uuid": "6defe566-f313-4132-a0f4-f0b47e4d3e70", "comment": "Malware payload", "value": "f0495c5c01c8acff447561b53bc0abb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303207, "uuid": "588fa0ba-2766-48ff-8436-b1ea3a4cf511", "comment": "Malware payload", "value": "0b6a46cd5589eaaade67b52607520599a831f7e8fdd74623857bb7a1b6219b69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303207, "uuid": "abd23e7f-910e-477c-8b5c-65cfe008b568", "comment": "Malware payload", "value": "f50855b01bb64959357afe1f6cb77a567e118fe3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303207, "uuid": "ff0e1e38-31d0-493e-95ab-fb96fac04f8c", "comment": "Malware payload", "value": "8865ff555b4132d1a3b5f5673c93591040e63be29b3808e3c773353e951e6a154c91c605e5bbe836231bbba9d7594fb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303207, "uuid": "144479d8-d0a2-419c-adca-2edb82c5b571", "value": "T190C5CF1272618837C1A306745D66E3754A38BF542E34895B7BF83C5EBFB93823C252A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303207, "uuid": "7b982e08-6e52-49fa-864c-de1d5280567a", "value": "2357b52b206ce7f15b1b21585da338d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303207, "uuid": "f7ad546d-d7ab-473e-a65c-fba9b91995ba", "value": "24576:YCXZxF4GJnGkMzHZQ6ZtZInRmHAL+oSm8H2M+Aba1ntCz2e2ONzT3+vz1UP/z7oT:hZx5a0VCPzH2VAcn3uX+vKP/z7oZGWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303207, "uuid": "fbee8157-a520-44e2-af4a-ad65389c0a9b", "value": 2495319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303207, "uuid": "a7822163-56a5-4b88-b02b-4579bbe14913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303207, "uuid": "15ba37d3-6cde-4c9c-bf56-f30e9cf85228", "value": "SecuriteInfo.com.Trojan-GameThief.Win32.OnLineGames.8533.6339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2de81d1-e266-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682316596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316596, "uuid": "509af891-3f29-4606-9f1a-28983abd83fc", "comment": "Malware payload (Amadey)", "value": "7649798253fa2706227bfa956b471683", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316596, "uuid": "5d5c4d94-0070-49b5-b899-9cdc523314ea", "comment": "Malware payload (Amadey)", "value": "0b7f5e4dba7124ea2044b3407d3222740eeab117a5bdf755ac2c9ba46cc0a48c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316596, "uuid": "bb718221-4f12-48af-b68e-c8267c869ba9", "comment": "Malware payload (Amadey)", "value": "d9495080f7716168ad459237a50eeb8e528bc602", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316596, "uuid": "22e09771-2d9c-4441-a15d-933068404b65", "comment": "Malware payload (Amadey)", "value": "47a10292b3ed8a0d0ce4e002584680bbe5a1c5c2dd41cd6b783a94436c759bbbee99d95b9cde115708de70df80821a53", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316596, "uuid": "fd1c4b7c-3631-4eda-b6e8-5576f84d4bc5", "value": "T13C152366BBF44032C8B45BF098F613830B7A7CA16BB843EB2361DE9D5C72598E135365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316596, "uuid": "b8582fd8-faf9-4257-9b85-1daacb755feb", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316596, "uuid": "f9137698-cfcf-4b14-a984-c655f5060753", "value": "24576:2yj1+gxF/zahTyw4ooY5uuwwx/pGEdPrY3hSBO:FzkTyqauT/YERrYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682316596, "uuid": "0e92e1db-88ae-4742-aed3-79c08fa16cef", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682316596, "uuid": "c0ebbc4f-1afc-467c-ab18-159e18375364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316596, "uuid": "bdfb3dee-dc6d-4125-b1f8-e86ab96850a2", "value": "7649798253fa2706227bfa956b471683.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3cb2801-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682323121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323121, "uuid": "961a46c4-85fb-4453-8885-876e659d907c", "comment": "Malware payload (Formbook)", "value": "429d2c92cebe4cb7bf689dd592b6ef74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323121, "uuid": "05e24b13-0bdb-42ed-878d-7493c1ba885e", "comment": "Malware payload (Formbook)", "value": "0c9c08dd1b167e08229d61213fec4505da6604edd7e27f3249ac9ab7fd3663e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323121, "uuid": "13d2fe47-7b98-4646-aab1-a4530dcc9680", "comment": "Malware payload (Formbook)", "value": "f414d89a5dc13b45ea15da0999e5b43787eee565", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323121, "uuid": "a521862b-c0cc-4f15-98d5-f903790cfd38", "comment": "Malware payload (Formbook)", "value": "d0a09b240e7e7137656b930dadf0ee446d8c34040ca02cb0eb6134c0de64cfbb01ca6932c5584253232ade3e84939a40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323121, "uuid": "243f54d1-eb2c-45d1-8f4f-d5cbfc626c76", "value": "T14804AE32DA42C431F2B252B5B2BD1B7B883D0E353295A4E9A3F115E06EA19D5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323121, "uuid": "c0e0eb18-b2ac-4cfe-81a9-a3ef08715415", "value": "3072:4GcUkxSHP3Er83AYT8NGSYW67OycppITU+ucNRPvCwlUKw:wysyAq6x6KycHUucNRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323121, "uuid": "2fb20e26-1753-462e-b9f4-faca5863f708", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323121, "uuid": "2fb6d75c-873f-46a9-a7ba-c6ffad3ffddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323121, "uuid": "eecafb10-99c3-459c-9588-4c2663b401ce", "value": "0c9c08dd1b167e08229d61213fec4505da6604edd7e27f3249ac9ab7fd3663e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d9147f-e2c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682358366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682358366, "uuid": "cf30ce0d-2abc-4d2b-9745-7c5539279823", "comment": "Malware payload (AsyncRAT)", "value": "9c4830b0679b721498309cae4252dcaa", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682358366, "uuid": "a317d2b9-07cd-4113-a4d3-1a7b448ea92d", "comment": "Malware payload (AsyncRAT)", "value": "0d8b79be30a75cec456ee96c16e62b46f72accf99e3bfa5fa51ecfb6434348a7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682358366, "uuid": "7959aec2-0d1e-4206-9064-727bd56e4ec2", "comment": "Malware payload (AsyncRAT)", "value": "7bdec84527c9e023b75119c05ba6e356216ff752", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682358366, "uuid": "992e38a2-bb75-4e2f-8815-28bfa711e118", "comment": "Malware payload (AsyncRAT)", "value": "17e0d5f6a3883225d7c49722aeb906ad6b98ac7c1799436b2d72993ea9f028ee8a3d8213ba3f469984f0134803e4ebd8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682358366, "uuid": "31137568-f61e-489d-9da5-5535d783c032", "value": "T1E4534B043FF9C125F2BD8BB46AF6658046B9E5677907D60E1CC401DA0622BC69A43BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682358366, "uuid": "36c24d5d-d358-4839-9e94-2ed386112b72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682358366, "uuid": "16073e77-5d09-4f16-bc2d-0d6ac3a046f3", "value": "1536:Yjnkgpb1azYm1NO+iNTcIn5v+DEbfHZnxKfqDZD3bRx:YjkgppazY6czFn5mwbfPDZD31x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682358366, "uuid": "a71af251-fb09-4c97-97f4-f6331eb46367", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682358366, "uuid": "fd98a45b-6393-44bb-bdc5-7b1e2ae836b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682358366, "uuid": "00b9f3d2-98bf-486a-8833-d98b4525f403", "value": "66609.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c66dd77-e233-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682294681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294681, "uuid": "c886cdf3-39a6-41d9-820f-7ac075dfe163", "comment": "Malware payload (RedLineStealer)", "value": "f4d7b11b0ec08ccde605cc48e5ea47d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294681, "uuid": "5e3f4284-19d6-4002-96fd-22e83d934cb9", "comment": "Malware payload (RedLineStealer)", "value": "0e45e21d3dfe4d9ae96040530c11c82495ade46d7409cecf7a1374e47a23dd30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294681, "uuid": "1c3d8b15-baf9-45cc-bde5-4b7b78b9fd6d", "comment": "Malware payload (RedLineStealer)", "value": "ebb3a1f2348f18fe1d11fcb7ac062629fbda87a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294681, "uuid": "73751d71-8459-41dd-9afb-d22ebf254e09", "comment": "Malware payload (RedLineStealer)", "value": "91efe3c9770a2c93176e519ce28e835160c7e6ea461dae91e33aded5868f8fc7f863161152da4bd8c655dac525ae975a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294681, "uuid": "e3429e0b-65a8-4561-b54c-0eb4e479c91b", "value": "T179F3D468364B657EC97F887D9C600CD0667CAC921246AB479C8FF1E8793BB819F150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294681, "uuid": "982e76b1-f8cd-4761-ac58-ea24d2da8974", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294681, "uuid": "3ba415c1-d740-4449-a27b-fd86775cc3c3", "value": "3072:CKRi8OhD8SWZHh8ZLFqVsDl27U7Q8e8hI:9i5hD8SIqNF47U7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682294681, "uuid": "3ebd7b44-4711-4e89-a214-078ffafb78d5", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682294681, "uuid": "6b4ad13e-1a20-4f78-9512-bb84c5b21d02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294681, "uuid": "8b0bed45-6cc7-4dd5-bc68-402ad89af5b4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb0c5c7-e2a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1682343406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343406, "uuid": "9477e002-3056-4922-b858-ea82607ac88a", "comment": "Malware payload (Quakbot)", "value": "8056b3bafd82ce7e6156f1b3f314db52", "object_relation": "md5", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343406, "uuid": "7c389752-cdb4-455e-9a7e-6ebafd2e4ae4", "comment": "Malware payload (Quakbot)", "value": "0f5c4c0240eea04d4b1f688eee6256eb9b089c1fc03938c6d06345b7532b0669", "object_relation": "sha256", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343406, "uuid": "bbae2399-e112-4b94-8a86-001755ca06b4", "comment": "Malware payload (Quakbot)", "value": "f9d8c441676c2360ea849f4312cd3d7da0686011", "object_relation": "sha1", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343406, "uuid": "45b4a621-ca56-40d5-86cb-85cd6a5c43ae", "comment": "Malware payload (Quakbot)", "value": "f2d3a6844c0cfc189a1cba8e9af85c74902cb74e554c610e4013cd535220138a63fc126560c3b7ff0096d48e637d8137", "object_relation": "sha3-384", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343406, "uuid": "91634971-1780-433c-ad5e-60bb843d4fe0", "value": "T14FD57C21B287C136D56D0172A92CEEAF5138BF730B3150E7BBE83A6E58B48C15635F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343406, "uuid": "9b161971-84bc-4234-b7d8-74a498ca6cf6", "value": "49152:sFGOOTLCTFQq5iNZ4hS5WPvwaqB/nREYVoB5JSHawNx:1rTLmTpc/nREYKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682343406, "uuid": "124d9c4e-bb6c-45f3-be0b-4c37a4d9343d", "value": 2864640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682343406, "uuid": "4fe2c3c4-bda1-4ec8-a72c-06fed559a433", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343406, "uuid": "a551d10b-2eae-4166-9d10-4f906f9ea9dc", "value": "2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496d6459-e2cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682360255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682360255, "uuid": "994445e2-1a84-44db-ace8-22c24d95fb32", "comment": "Malware payload", "value": "077977e4f303e6bd85e495d1161aa037", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682360255, "uuid": "0a7e438a-7a7a-4ada-96d1-cae999ce9adf", "comment": "Malware payload", "value": "10882cb1fc5cfdf37b2bb6ea6ea9189f39ae8f0889eac96866cb72e3ea4e4b3c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682360255, "uuid": "90671a7b-8653-4276-b28b-c317c4ff3c29", "comment": "Malware payload", "value": "5dcebf0ed722733446426b0146e64259dce54097", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682360255, "uuid": "6c9b1fc4-3007-4ea3-bd27-c2847a4d6817", "comment": "Malware payload", "value": "53f8dc6b2d13ddbbf6b9fe6efc4a6e8ea746e55d46c9d4aec0231725424c464ea928d2b1b457cb2c673dab4867aa9304", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682360255, "uuid": "d7d83216-2bc4-4d4b-a287-f96d87af2f72", "value": "T17334ADBC64E785D4F54F988035FCBFA1017237E3AAC91E64132866448BE9EE92F4458F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682360255, "uuid": "349c1356-a7f9-45ed-85eb-fdb5fa2085c7", "value": "3072:Vk0t0iInKWQIy/pfnO5jEeu4BR315a3Aph:Vk0t0ZnKWQI8pvO5Aeu4H315a3Aph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682360255, "uuid": "5d61cf98-da74-4396-97ec-41d30ef74760", "value": 231940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682360255, "uuid": "f56117a1-677f-495d-9b3e-ae91ce1d6aad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682360255, "uuid": "72d53101-63c6-4304-a00d-9e36a6047100", "value": "t.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dbc4036-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303246, "uuid": "6e4f8627-90c4-4823-ad24-080e90c75b7b", "comment": "Malware payload", "value": "5e4509476e6b0f6b847d17f65efcd8a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303246, "uuid": "7392934b-f092-49be-a1de-1f41267a8cee", "comment": "Malware payload", "value": "1098429ced8671a8385c070135fceae7693a2e234baadcc415201ecd36ff64d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303246, "uuid": "0501401d-bfa5-46ad-95b0-b78ec5d4e13e", "comment": "Malware payload", "value": "12a07ea14fae0a2c5b04a0d793904be74a9d0555", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303246, "uuid": "260497e8-3cd7-46a5-892d-c5612e62960c", "comment": "Malware payload", "value": "079d39b2c67b02b8c2d7bcddad208ce9d06b009fc02e30d8fed4d00cef6bf255c829c4acda8264b45c50f7547902ebd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303246, "uuid": "782453ca-8828-4c88-a7de-c67ffc9e9795", "value": "T1B3C48F32B2E18437D163263C9D5B92BCAC3AFE116D2878462BE53D4C5F39781742B297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303246, "uuid": "fbaffbb0-acfb-417c-b6b4-3ce88223350f", "value": "c44dd2a7f45b7a98f929733287f8eaef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303246, "uuid": "58043563-44c1-4545-adc9-44c136b3bcc7", "value": "12288:J2/vKWQ4kK5ihh7a0VcgSUPBBIvWQ2uHXibtga:4HO4k+iHLWUZyvWQ/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303246, "uuid": "b860c421-c5f8-424e-afdf-b905c2ef8840", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303246, "uuid": "a86c2d51-4c6c-42eb-b30a-bc792a73c935", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303246, "uuid": "8bbbc5a2-f650-495c-a98a-b62aad85b077", "value": "SecuriteInfo.com.W32.Christmas_Countdown.A.9629.8139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6163c9-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682346870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346870, "uuid": "a4d963ff-5b53-4530-9ed6-c112bec74f93", "comment": "Malware payload (Gafgyt)", "value": "aa552154d312259c721a4b89f2cafb36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346870, "uuid": "c87ebb06-94a7-44b6-947a-6e18c237767d", "comment": "Malware payload (Gafgyt)", "value": "1110c6b69c595b7243141c559499631f013812e57331c127a802994750f19d47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346870, "uuid": "197c4b46-77cd-4363-8256-ecd50ce8a412", "comment": "Malware payload (Gafgyt)", "value": "7c080262633a19ba1b55a017b31043b2007ed63a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346870, "uuid": "224dede2-ff71-4cc7-97fd-3dce3e91a045", "comment": "Malware payload (Gafgyt)", "value": "5b97641b62d6122d7822fbf69e3bdae9bc93ba745e2b76de081cbaa3636852ed730ea20b9c32334af32b34dbf958641f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346870, "uuid": "d94ac5ec-3d18-40d1-a90a-f2555e31aa40", "value": "T16F63290399669FB7C0866EB525F70A304753FD251F4B1B89722DAAF8070B9CDB80E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346870, "uuid": "449ecb06-5373-4669-b5e1-71859d715e26", "value": "1536:N1BOxUVm4Wqj6WMzKrtg/p96CZf3l/XnVMuC4mk02q5vc6fBnj:NnOxIm4Wqa2rS6a9/XnGuC4mk02q506h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346870, "uuid": "e062a7f2-dd20-4942-acd0-ad3502c01810", "value": 72105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346870, "uuid": "a9c0be44-e314-4dfe-a88b-93a0d19d8c26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346870, "uuid": "88355327-314c-4f5e-9ce2-ca34f0c5dcb1", "value": "aa552154d312259c721a4b89f2cafb36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3495bd5f-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330155, "uuid": "ce787167-d59d-48ad-a273-58d19359fa33", "comment": "Malware payload", "value": "55b738007b6f1c6852a07119a07c2d8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330155, "uuid": "1a922d3b-9f76-4696-8c17-670aaa3df874", "comment": "Malware payload", "value": "11cc3e4b8413a1b8c0c0d7193c2f26670d4765f96e797140c809d4a0655f9cb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330155, "uuid": "5d092e76-2810-4e26-baca-8bc077527a18", "comment": "Malware payload", "value": "fde15aa535a7a4eb49069afa7a3cfa9b14a94926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330155, "uuid": "8fd07673-9d38-447b-ba45-6c309096c726", "comment": "Malware payload", "value": "c6098716be9cc51d085a6baad7a1abd91a51a58d748829d16be0f3c4a561ef8049fe40ef887dad518eaa21b0cd73ec77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330155, "uuid": "26a6216c-e7ec-446e-ba75-bd98a94b634c", "value": "T19736CF6F609187BDC206D232C1BE9B34D93371E14863C63E96C1E5B16A95D248F7EBB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330155, "uuid": "d90232e4-f6c5-452a-ad9f-2dab633db5ec", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330155, "uuid": "64820b0d-c798-4c59-861e-ee51dd4188ef", "value": "49152:VpghL0GxlIP8oa2op+pChboi2CjASvvhyZVW3JvDTiY4ekJb7keVPPm3RYnfjJ0v:PWunEMe3SuLeskqaTVm5alfYPy7FGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330155, "uuid": "483d472f-07c7-4704-8e3e-a316c4773636", "value": 5096312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330155, "uuid": "60e2fbbe-4bd8-4bf8-a6d0-85dd4617ae8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330155, "uuid": "e97904a8-ffcd-4e68-9093-cc46067e74de", "value": "11cc3e4b8413a1b8c0c0d7193c2f26670d4765f96e797140c809d4a0655f9cb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a0c3b9-e29d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682340038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340038, "uuid": "da610677-6c92-4e2e-9d25-c0b3b7cfad61", "comment": "Malware payload (AgentTesla)", "value": "ca77832e38dbd9f468b9bd0cc86b18b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340038, "uuid": "8dccd2ec-8120-48e4-80de-554a013a3648", "comment": "Malware payload (AgentTesla)", "value": "11e3b4b82da916ae408b983e80da232c27e51fcb8eb64cd3df767eb69281d001", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340038, "uuid": "31ffcc8b-9824-475e-a4fa-8282a4f1f47c", "comment": "Malware payload (AgentTesla)", "value": "c64a31493d97d2b359366575ba9d112f21d79661", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340038, "uuid": "7c51cc74-1a9b-4270-86d7-496482331dfd", "comment": "Malware payload (AgentTesla)", "value": "3082c35badd74b898a6ee9bb07d6a51fb7bbef9a7935552cd412a10733915b29ac3a985a28878bb771146ce33dfda8f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682340038, "uuid": "a8eb95d5-67f1-47df-83b4-e56d0cdae390", "value": "T1D2C47A2DA9EE89F7C139F5B5CEBA8821F197C96372529D3955D702440603EC32AC42BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682340038, "uuid": "fa109c98-f631-48a0-9262-cc185e935934", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682340038, "uuid": "ced1eda5-a455-444a-a35a-bec79413eee2", "value": "6144:hCuDpn2GhN/njwyxlems5IeWNVqUd2KS2U0d7XHoxpACSTD0pFKq4CdYGQ5Q8:rpn2iN/njqmU43qOU0lINpAU81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682340038, "uuid": "7e4df3dd-d492-47f4-afc1-31b625de165e", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682340038, "uuid": "827c9b96-1af7-42ec-ab00-ce052f5ef4f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682340038, "uuid": "18973257-d637-41e6-a926-e4e84a25eaaf", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e635ed8c-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682323151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323151, "uuid": "2debf8a7-63bc-4f7c-a8bb-5faed54b0cb5", "comment": "Malware payload (Formbook)", "value": "c5bfc79069cf743f50c82449ff7b597c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323151, "uuid": "12725159-7d6b-4cdc-9ac6-b324474b84d3", "comment": "Malware payload (Formbook)", "value": "120694aadf1eb3c014ff05aea81661da85e34080d23ee2570b98d88b504b1819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323151, "uuid": "6d6ffbdd-a813-47e5-b89f-47d1b16cdaf1", "comment": "Malware payload (Formbook)", "value": "b7ce8cce3995ff60ca0be6ff2fad05f30cca57a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323151, "uuid": "10fae24f-db9a-4fcf-8261-22d98b9530a5", "comment": "Malware payload (Formbook)", "value": "118d74e95c80d30bdc1ab0513acacd77802eb03ee2f1ad51fbaab3ab13a9fcf5d96b50dd75eb14cfba669f510bd43ab3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323151, "uuid": "388e9d4c-6e3a-4137-b0a3-84573a93b494", "value": "T1B0E4E0747113AFA3D7BECAF0124826454BE63AB77A7DF1AC9F1E30D516B638005A8193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323151, "uuid": "a4e29a1c-624f-4bc7-ae6c-904f3d2337ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323151, "uuid": "44d5c608-721a-42a1-b37d-c07071d36908", "value": "12288:+Ff2iN+LwRQe3EVNyFoSfoy6zaYbtUkHTDeDXCvLMpLSt:I18Lw6jVNyFofy0btUkHPeDSja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323151, "uuid": "6eb7bbc5-3b6c-421f-81c2-be7718d727d0", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323151, "uuid": "8df6457d-b8ae-4a4b-993c-8d4361313f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323151, "uuid": "819f43ef-b500-4512-a771-801371baef6a", "value": "BANK DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605290d0-e2b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682348697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348697, "uuid": "2d98b8b0-1975-4d39-9442-3ce127ed8776", "comment": "Malware payload (Mirai)", "value": "ec6a5f416d5d29229dcb449872df17e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348697, "uuid": "cdca816f-77ac-4cfe-9477-90c46ca0a52d", "comment": "Malware payload (Mirai)", "value": "1312d3d5ebaa6f263add60c44002f8d3ddfa7712d11f6c0f18428f1daff7daf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348697, "uuid": "92622af4-2d6e-43e7-ac1e-a346e571a384", "comment": "Malware payload (Mirai)", "value": "04af5955418c60cdf8dbeceaa45e6dacd6bed252", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348697, "uuid": "1efb1453-fa93-428a-9dfe-888fc140782e", "comment": "Malware payload (Mirai)", "value": "f331608d6325280e961dc33e105ef4d0a1e755b9d6f78c998f60efd2233605aa2b792956ae7f5349423c1a8da910684e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348697, "uuid": "3a1ed7cd-a996-4001-9736-64ca2e1a581b", "value": "T109730993B901DFBBF00AD77684D74A247630FA6649531662B3173DA2AE372C43427F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348697, "uuid": "656544e2-c4f7-46ce-9c3a-9321e2fadc71", "value": "1536:m73zoLSac58C18YljU07LmM3F+iwzcjm9CYtIEl5gdABnwav4R+m7OnDQRG:40Lg8CbhWMV+vzHrNB7v4R+mKnDQRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682348697, "uuid": "67167083-b7d3-4939-ac60-9198b3d05718", "value": 76827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682348697, "uuid": "4b93b772-5779-4c5a-bc68-9b69955fd04d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348697, "uuid": "8c9314f0-7c46-41b2-a83b-e3e630427a66", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa26fc9-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333395, "uuid": "957afa90-c59c-4a72-8fc3-1e1466a7515f", "comment": "Malware payload (Mirai)", "value": "61a60a83ed7e09ff5cd433f1514abe8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333395, "uuid": "1fe8e509-c01a-4d04-872e-81cd3916dde0", "comment": "Malware payload (Mirai)", "value": "13598e9ddcfb05277c050d5ffe6449188c0c5d0402031b59446fe8d484e3711c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333395, "uuid": "b87551ac-34dd-4b82-ad08-5160f4d3e538", "comment": "Malware payload (Mirai)", "value": "3ae704bda5415f42b6a0c99ec9c7d34000679abb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333395, "uuid": "e3d8e7e0-dcc1-438a-9b28-bb4aa4439c7b", "comment": "Malware payload (Mirai)", "value": "678dfb7d734b39bb601150649efde4bfba29a9d6a0311121c6cc23a1286af1f390b7c00120e5c5ea6de20e6dfc0002aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333395, "uuid": "eed6383c-9b80-42cd-a55d-a8e9f66eebc5", "value": "T1EBC32A46EA408B13C5D61777FAAF414A3322DB54E3DB330689285BF43F87A5E0E57A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333395, "uuid": "4ad32a2a-b3fe-413c-9203-87dbf9cbb278", "value": "3072:/qMu4C+u2FLhLRE90bYK5h9T96NOt+5/YtM/9gM/:iMu4C+umRfbYK5hb6Y+5/AM/9gM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333395, "uuid": "87491d54-6b52-485b-8087-c9c21f9be20d", "value": 128047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333395, "uuid": "e80c6583-3680-4909-8995-14f6f6011507", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333395, "uuid": "ebdd8f3b-b612-4fb1-b76b-5816bb3d06ce", "value": "61a60a83ed7e09ff5cd433f1514abe8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b16414-e233-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682294748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294748, "uuid": "771027b8-9d26-4c02-a911-bc26da8b92bb", "comment": "Malware payload (Amadey)", "value": "24d35af384859b9132200d58aa54827f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294748, "uuid": "c34109df-ff60-467f-8982-3fb7c9c7fab6", "comment": "Malware payload (Amadey)", "value": "13bc1e0dd1b6e99fbf82ec88b71015c972082bff07313d0eb674530cdb6bd392", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294748, "uuid": "2cb85962-c108-4159-8868-d3af9c275baa", "comment": "Malware payload (Amadey)", "value": "c743a24bcefb6261a1f2479365cf811292b59b89", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294748, "uuid": "b628994b-ea5e-456e-9ac5-1d359eaa1946", "comment": "Malware payload (Amadey)", "value": "393c271696298653eaa7493ac91e0b403b9291066bc309cc31b95aa428c8c2bb85ace0efd524733c76a652b97dec7c55", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294748, "uuid": "155e5964-3ccf-4fed-911e-246b28538add", "value": "T1DD152313AAEC4526DCF017F05CFB2A432B35BCA15B78C3E72745498A58B16C4A4763BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294748, "uuid": "d0405a36-25e6-4105-8a42-901cbf2eabb9", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294748, "uuid": "f28917f0-ff76-47b0-b3c8-b25c647a1abf", "value": "12288:Ay90D/5O+dvtUVZF+S9LOL9EdiCD1k2zEifoc52DAxKk8cITxD80JZZw19r8fAwb:Ayi5O6CVZvOa/gifIDAEltb1YaSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682294748, "uuid": "5b07a819-104b-4ed2-975c-4a293deeda2e", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682294748, "uuid": "3050d49e-daf6-45d5-bb7e-7a946b5a6892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294748, "uuid": "6e6d7189-e427-4e24-a5c2-4acc124b773a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d94de2-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682323122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323122, "uuid": "3d0fe51b-2d90-475d-b601-7ca842efe0c3", "comment": "Malware payload", "value": "fb0ed2c6a7601295c950dd0dd33f3d91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323122, "uuid": "0a678e73-93dd-4db6-a3a2-794c5cc50f5d", "comment": "Malware payload", "value": "14ef4046049be6f8e9fc82a27408a3c8f11f3d74bb7ddba37dc8d0c8a8a990a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323122, "uuid": "b6a57b37-5b7e-416e-b735-51253844a969", "comment": "Malware payload", "value": "b3b43f1bb4add3c14687c51ad8f5a0b311910842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323122, "uuid": "c72684de-8c2f-4c39-8637-1f50bd7e9272", "comment": "Malware payload", "value": "8e855b1de23a69214b113085258e8f3771217c2f7f9dcf6c2191a8f78ca8d9270b8c9191f153001b1694e2b063a4acda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323122, "uuid": "41fb50e8-883e-45bc-b4d4-c49e8fd08505", "value": "T15813B3112AE88134E4F237B4697F21248A7EFD641B39C2CF624816DE9E21BC29C75777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323122, "uuid": "923a10f0-c2d5-4f6c-9728-b0aaecd09975", "value": "768:kGWOCkhKlKFwnUK8y5/qA92fycCQlBjGG7qsc76V6yjx+hriWltv8URY:E8K58MSMyycCQBjGCqF76jjLKtLRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323122, "uuid": "9f3c1d5a-0204-4081-a8aa-376b07cfb89a", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323122, "uuid": "be74b2bd-03ab-4da3-af78-0279eb26cbf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323122, "uuid": "3aa7906a-bdec-4a23-8227-ab8aedacba65", "value": "14ef4046049be6f8e9fc82a27408a3c8f11f3d74bb7ddba37dc8d0c8a8a990a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d582c088-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682323123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323123, "uuid": "9d97f46e-8bb0-43f6-b36f-6c34a96720a0", "comment": "Malware payload", "value": "0c365f6e04e27ada41e35b372151b15f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323123, "uuid": "b7f58927-efa2-446c-89a9-673ed902f590", "comment": "Malware payload", "value": "153236a3bd87d66062c64e239cf8792146d3797ac83855be7707720c1a876216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323123, "uuid": "e954802e-ea88-492e-8044-f413b6b295ee", "comment": "Malware payload", "value": "b96d238167e8c918df2359a4d0ad26770db69472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323123, "uuid": "4449349e-97bf-43f5-80bc-f1270af0f19f", "comment": "Malware payload", "value": "f4303ebed8e2734a28f3901632c403f52d2146f7c80cd33be78a53d3637973a9afc6bced258d02669a29a09b052d61c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323123, "uuid": "b09f312b-119b-4e00-a0e8-a14eacb04dee", "value": "T160C24A1196A83035CCD501FB2ABF3F21522CB2658F74B4D77B0C5EEA5AA8AC64C71793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323123, "uuid": "ea6e5536-7e80-41d9-9042-fa19da9b9074", "value": "384:XjD2djlPKIQvyB9za9dpcax9HVmTjBejloHkuK8Rm0GWmb3W2QWvs+K/:zD2TiIn/upxYjBK4E88NWS1sd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323123, "uuid": "90429f3e-43c9-477e-85ab-065288c3a429", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323123, "uuid": "0d193cf0-efaf-4d64-b70b-439fb2efa29a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323123, "uuid": "b4f49eff-93b8-4839-a98f-437afc15110a", "value": "153236a3bd87d66062c64e239cf8792146d3797ac83855be7707720c1a876216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69029c93-e297-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682337544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337544, "uuid": "7a2957b8-1cf4-40f5-b616-71469ddc935a", "comment": "Malware payload (AgentTesla)", "value": "a839cf301a93826ca68afa65e866adb8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337544, "uuid": "773370c3-ee60-4f5d-b217-8c0cae51760d", "comment": "Malware payload (AgentTesla)", "value": "154749c1fa1164ee9163e79e27cf2bf2c09cdb5dca05752edc8db11393106ae9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337544, "uuid": "7dada71a-0d74-4f9d-a306-da49a2fab7bd", "comment": "Malware payload (AgentTesla)", "value": "d2eca143390f02c5f2be38f439f41eedc06b1c01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337544, "uuid": "8b532e48-f3cc-4fdd-ad23-24887a48f516", "comment": "Malware payload (AgentTesla)", "value": "94e94b5904b5496e33320b2ee791aee942ec4224d33d4e0c3e007350446c99788953951e08931b5fbcd4bacec5d16e98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337544, "uuid": "dd9b251d-46b7-4baa-9248-a9ef0bb7c0fd", "value": "T16034E01A7AC75511CC582B71E0C3152413F2EBCB2673D74A368E16990F933E62E8EB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337544, "uuid": "d2af7d49-1de7-41e2-896c-38117dca0a49", "value": "6144:mGZ+HHIAwbGPMWcxjR/i623hW9IOyHTIn4:BQo5Q4lR/UhpfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682337544, "uuid": "bf8ebe91-0abc-4ae8-808f-4a693e03a861", "value": 244296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682337544, "uuid": "18646512-1444-4a58-9123-62737639ee55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337544, "uuid": "d4d1a02c-f60e-4219-be3a-04641eb07468", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334ef0c2-e28b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682332300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332300, "uuid": "9e3beae8-cf5a-48fd-855a-9cd87942639b", "comment": "Malware payload (Mirai)", "value": "40c207e20f345392c421e637666e80f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332300, "uuid": "37ca417d-9d04-494f-a785-94c42832b909", "comment": "Malware payload (Mirai)", "value": "157aab57b262c55fdbbf294315c2d828517662eda0f2d2d95d60ffbfe90dbd36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332300, "uuid": "788f8405-d309-4a5e-8cb6-e33c30883ebb", "comment": "Malware payload (Mirai)", "value": "7d12be8510e6442b761885aeb5625ddff914e1b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332300, "uuid": "81b73e57-b8eb-4761-8eb9-843ffec1c6b8", "comment": "Malware payload (Mirai)", "value": "2ca3c315ad82b3fa9c3be18db6fbed30533ec94f44d24329adf3e59812e86006f6cb7bd6f05cc4b619e52787f18f59f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332300, "uuid": "72313957-56b2-4e87-9fce-9db70d64e068", "value": "T157332942B22C094BF9E65AB0353F0FE093BFF98024E4B585695EEA458136F731586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332300, "uuid": "873be5ed-9399-47b3-8b7c-4a786a613920", "value": "768:/ofoxnHAt1ez3nAgCN7RkIV3fgB1DRNRR7Eg3tbv6VFssuWXwdyIq:WgHAt1ez3nAXZUB933tbC/3Xwlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682332300, "uuid": "8aa7a795-b976-4148-9339-1edde901b028", "value": 51332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682332300, "uuid": "8d0f8a71-75f8-4d78-b07e-a8b9899e99cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332300, "uuid": "fe6f5f86-5aae-42d2-b6b5-a781858c07d0", "value": "40c207e20f345392c421e637666e80f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ed8494-e2a0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1682341517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341517, "uuid": "4eab1b61-630a-4a35-96ba-74ddecc9d970", "comment": "Malware payload (RemcosRAT)", "value": "26b0309e3507c9cb548b28c8156bacd6", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341517, "uuid": "d6269177-0193-4bf5-905b-2c212baa8321", "comment": "Malware payload (RemcosRAT)", "value": "1583ceb09aeccc21110963a3aae5f60a956a1b7bf486f46ad77c4dde104be3be", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341517, "uuid": "60d696b7-7ba7-4b83-80b0-b396faf9e17e", "comment": "Malware payload (RemcosRAT)", "value": "b0fda3ab6b5136ffe974e64c9360f91b8be81a8a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341517, "uuid": "3bcc65b8-c169-4fdf-925a-45649a60ad02", "comment": "Malware payload (RemcosRAT)", "value": "4741284fd0d17c55b6cc6f3ae1af7de23260a75a4650cb1a1fea40d0ac991377e2ce076db03bcf6fc4ff73734cae8fbb", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341517, "uuid": "09506922-594d-4e03-8c52-ca0241c98022", "value": "T15C55692032EB20C570F21A2BAEA7F0554B373AD428348F98A4CC562D5BEFD54C5A93F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341517, "uuid": "91e4bf9e-d470-4a2f-a9aa-859cf295d6d8", "value": "192:cwOty/cVY27L6j17roooooA8oooooUooooowooooowoooool7ooooo2ooooo2oou:cwOty/cVY27L6j17ZWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682341517, "uuid": "4319a427-c5a7-4b89-b7e1-0750295c411e", "value": 1289550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682341517, "uuid": "90c95255-edb6-49f4-bbbb-e6bd5551e188", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341517, "uuid": "95f7ae95-b1ff-4c37-ad7c-1afb209b1d86", "value": "Facture-202304211546.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86575121-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682303234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303234, "uuid": "27fae4fa-bad1-49c5-a28e-a509ff15574a", "comment": "Malware payload (Smoke Loader)", "value": "2ffb39a1c8675535869e8b0710a25d93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303234, "uuid": "0c5c22a6-53a0-436a-a3fa-c139874ae913", "comment": "Malware payload (Smoke Loader)", "value": "1687d3dd46334a1a09c734d517dbb2304e998cb9ce9b3cd6cd6ac579616d63ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303234, "uuid": "1c8369fc-f765-48c3-b14c-8cae9bef804d", "comment": "Malware payload (Smoke Loader)", "value": "e331dd2aa6730560c4627e3bfe72b353f3f1610e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303234, "uuid": "0a364c84-68c2-4cfe-9616-194ea2041175", "comment": "Malware payload (Smoke Loader)", "value": "04b8c1bcce72691de083e0557c2979699c212685c066ac6490d8cd2d00d6e23d14e7514a3be224187893cbe17bfd2bff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303234, "uuid": "c725fe24-1503-44d2-9cc0-8f5b066bf221", "value": "T104229FD00422DFF6C5D105F86AC7C67CA45FBA500F166422EF6040187BFEA8674A878B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303234, "uuid": "920d552d-3849-4f2d-81ff-fea02497586d", "value": "8e3ad3b62f818c81a3c6df64f3f0a728", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303234, "uuid": "f05f07b3-b64c-4f49-b953-e6b988fd7eb4", "value": "192:nPXHn4WLawODSHu8tq1pyYLobO2rQp3oMIXAF:fRLKSO8tq1YZrQ1ovXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303234, "uuid": "6dd02059-cddc-4d52-822a-de0b78a11832", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303234, "uuid": "55965745-56b6-4680-8200-d7dfbefde884", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303234, "uuid": "66e1ea5b-9653-42ed-ba69-e3ba2b756565", "value": "SecuriteInfo.com.Variant.Razy.840268.12757.29244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5c7512-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303242, "uuid": "5ce540da-4935-4ce6-b94b-92f2b699dccc", "comment": "Malware payload", "value": "07d3466ea2dc518d0262842ae59a9f53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303242, "uuid": "2fb17f76-98db-4426-be9e-45f2d48a80e6", "comment": "Malware payload", "value": "16cc27c3616bba351c5a8124fe5266f3cfc79731c8139cb250e20ddca5f42cc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303242, "uuid": "e5892927-c352-47ef-a5d8-faf2d1a6a786", "comment": "Malware payload", "value": "9cc17b2c6f5a968660bb2320a52af53f9b9278be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303242, "uuid": "f29adaf4-25c6-42dc-82d2-c3270826a0c2", "comment": "Malware payload", "value": "1ac604fc0910bdf8b3eec8089eef61ad0f2bfdc26483aac5ea5d99f7314dec994fd3996b2573c61928beebafb0d5ba2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303242, "uuid": "096a02fb-7123-457e-9880-0e4c87ff0f9b", "value": "T147B2D0C47612EF21F61104732D5C9AAC8A6BB7590BAF3470CCE5FD8DC35A56A188F386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303242, "uuid": "8715553b-6f88-4d0e-a015-51d27078adc2", "value": "384:flzEBkDOvTCZuQEkymy/Gf+3pK9pGr39KKD6sq+GJ4kjNBrHKuxTnxl/KEuBmskP:pwkyTc9pHiGJ7bLxlpuYPWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303242, "uuid": "12f2743b-6b7f-405d-b75c-05e9a6abd6a8", "value": 24984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303242, "uuid": "c3fa9ff4-b435-4c99-83d1-278f3fea41c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303242, "uuid": "ac02e45e-7d2c-4bdb-bb37-51b0eff92478", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.50294160.519.27758", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450370e4-e26b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682318586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318586, "uuid": "8299e299-eabe-4a5e-8426-e88c025049b2", "comment": "Malware payload (AgentTesla)", "value": "3bbcf22f8cdda7ffe88e218e93640225", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318586, "uuid": "582dd7ae-6170-44a0-8ec9-2569323c2263", "comment": "Malware payload (AgentTesla)", "value": "177bd7025804e5d3e84f7c864cd0049493297382a476d769c8979d4f3b56fc28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318586, "uuid": "9de89e73-1e11-45db-b474-a24b13b06178", "comment": "Malware payload (AgentTesla)", "value": "5faa9c42495a16dc9f431b2ea133b3db3b278b8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318586, "uuid": "486442ee-b969-4914-8039-d5b6a0c00d9b", "comment": "Malware payload (AgentTesla)", "value": "77b9df6c229253ba019a8c2c21bea244f14987b2309fa0ce40ee2d640c61d69b2b0f2e9492dc23f8b617f691311c29b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318586, "uuid": "795e1495-1ef1-4231-a50d-34441a4e798a", "value": "T19E64222262E1C0D7D1674B743E7A563D8FE67E1214F0D65F2B208B5C7E92582DA1F322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318586, "uuid": "ff57958a-b13e-4efd-8485-24cd5b57c174", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318586, "uuid": "c0f81774-f56a-4cee-8b81-f27099ac536f", "value": "6144:vYa6cwmkIYQMcUEqfcdZdEu3wylA4IfdSth3/qHTWriB/joI1GParhR:vYCSIYQzaOU4GSz/qHTWri1jVGy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682318586, "uuid": "c378888c-45d9-4b43-bcf3-0e6babf571d8", "value": 316919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682318586, "uuid": "8b43cd37-cc0a-4472-a6d4-87ff004f301b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318586, "uuid": "a5dbcbc7-8a04-4135-b3e8-cd4599ebd86a", "value": "swift copy 62710958.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d17d5b-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682346904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346904, "uuid": "1f221246-5a68-4bd7-b01f-0c99ed93f4ca", "comment": "Malware payload (Formbook)", "value": "ca5d33e8a379da31c0dda6b9e22c20ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346904, "uuid": "36613d93-b3e6-4424-af8a-a7decf5907c0", "comment": "Malware payload (Formbook)", "value": "17ffde8137ccb72df1cf904e6e550a14e03c6e7029a507731a0a721697249851", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346904, "uuid": "391f8b26-8519-441f-be9c-25482954f4ca", "comment": "Malware payload (Formbook)", "value": "8501cc96684dafbcbf44abe4af3b4465bb5473d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346904, "uuid": "fce48d73-e46e-4843-bd3c-17bb914f345c", "comment": "Malware payload (Formbook)", "value": "64ba18e8f7b52d93a235bd4e7b64d963a366ebff2cb73822d85bd36dcd43d4425f42a168aeafe1e277467f1516f1abbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346904, "uuid": "58dc486e-272d-47e5-bd2a-a67cffc7cffb", "value": "T153D4D0CDE24E0275DF9AA9B14FC5BB9725D6E2D329306DF83A3C44A4E14E72DAF40241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346904, "uuid": "a7b70fe2-fbf8-4f0a-96d0-b0a978cfc24f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346904, "uuid": "e57aa794-f8bf-4fab-8ee9-32f8959dd11a", "value": "12288:HMqFq1lshI14m+PfCANS543LUnHQQZY278xICTtag9oB4:H7+fSmSCcE43gnHQkYjoRB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346904, "uuid": "2886b461-29f1-4cc8-b1e2-b1548a28112a", "value": 635392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346904, "uuid": "1f96ffd4-3027-49b9-aeed-8541eaae1bd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346904, "uuid": "30c48048-8a94-4b0a-ac5c-95b7920927ca", "value": "INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636af111-e233-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682294585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294585, "uuid": "6d932039-df1a-419c-80ee-b78c0ea3552f", "comment": "Malware payload (RedLineStealer)", "value": "1ac40e0d36dc7065321c4d70e7eab611", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294585, "uuid": "2a18b324-eb67-4db9-ac5f-0cc091990807", "comment": "Malware payload (RedLineStealer)", "value": "1878c5846243e1c022e9573f86b201075f754485ca088cafe82c68e5cb0d0a83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294585, "uuid": "a43c0fda-8b2a-40d2-ab5b-94b8085b43d0", "comment": "Malware payload (RedLineStealer)", "value": "eaddc404b94d1e70eaf406a2926737bc954e8f18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294585, "uuid": "abf0b2a8-6fec-4381-b63a-086b77fc302a", "comment": "Malware payload (RedLineStealer)", "value": "4a5501d7c3b1c7f05497a0292b614bbc4e73aaaeb3b49025344092e719228dfbde161cd780452ae293f3a4206023fa8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294585, "uuid": "d73efdfd-b82b-4710-be05-7933c5787f98", "value": "T1BA25231BA7ED5035DCFA1BB004FA1293063BBDD14F36127B238564095CB3ADAB53276A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294585, "uuid": "1c696984-2a06-4eb5-a20e-c592a9b9f72d", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294585, "uuid": "8c20235b-af44-4820-9958-1f87862e7b9f", "value": "24576:uyXoPQviI+0RlWjw2M6as84MzCZAwIe1XkLCIeB:9Xz+0RQjw1sawIeUCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682294585, "uuid": "7ec4572f-bdd1-4050-b3de-955a5b94d445", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682294585, "uuid": "16c6f9f9-f51d-4c0f-b2fc-6b782ec5dd4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294585, "uuid": "685286fa-5277-4245-a0db-8abbf4034062", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "468776ec-e297-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682337486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337486, "uuid": "6e379b5e-f7b0-4a83-a466-27ea583c74c7", "comment": "Malware payload (Loki)", "value": "4c69d4a8ae14220162fa604e31c57502", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337486, "uuid": "cb59ac83-b4de-45d0-8bd1-530c27ff8b8c", "comment": "Malware payload (Loki)", "value": "1a1c050c37012aa4ddf6bb23a95c1fc638184982c5a5fae957ed93d9fc87dc00", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337486, "uuid": "b09e2b7a-6d04-4194-98af-23ed2ad0a3ab", "comment": "Malware payload (Loki)", "value": "119878faa3125bd1827e0add579958258c5ca1da", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337486, "uuid": "fb590830-6d9a-498f-b1bb-b4f4b0fe8d7a", "comment": "Malware payload (Loki)", "value": "bd8decbf6edab89b5eb0a300a58610824ca32dfd0733a02e5a98208e4cd0ce7e572e1c2b4feadc88fe43ea25b8569b4d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337486, "uuid": "64957ea6-3405-4c89-9a48-6fd766060050", "value": "T1D5041376C47510D57CECA2F44B6EDBA6458C7C22EEA033247E4212BFA54C4877BAED11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337486, "uuid": "c837eccc-cd6e-4275-b0f8-6deb3a86a353", "value": "3072:TpOz8IaLBWFuLPkd0loKXTp5do4N8eQJcnEhkLpGC5Q5cGZ351bY7F:TpU8PLMFSPo0lo4pl8eQKnEhnpr1fbqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682337486, "uuid": "64832549-8afa-46fb-b2a9-a89e1f75cdae", "value": 178359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682337486, "uuid": "258a6b6a-5977-48a3-a721-e3d49527d23a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337486, "uuid": "87af1de0-31dc-450c-a377-470245db0ae2", "value": "65-22_Payment Settlement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c43bad-e28b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682332361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332361, "uuid": "239965ee-6ec4-49c6-80e1-19685770b970", "comment": "Malware payload (Vidar)", "value": "4618d5590bc6de044eb021314eeba431", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332361, "uuid": "161704f9-8eb3-4538-a96c-3e41f7773489", "comment": "Malware payload (Vidar)", "value": "1b50395ebaae62aa4ad19a514a0cda4b8f74aa915dfe0c0df49a3aee08c605b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332361, "uuid": "4a2ebd4c-d53f-4251-9e5e-c83228dd4def", "comment": "Malware payload (Vidar)", "value": "e70075fff3bc7b20e2dcc410a3151f3c6fa83edd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332361, "uuid": "9d669c76-a8d5-4bbb-a2fa-16c24026c007", "comment": "Malware payload (Vidar)", "value": "aa962b505ebddb2e7befff3f15aa901a012730800420e5d1a8edf83e2c9adc1c510fae53cf4a8ad524190a9e7848d18b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332361, "uuid": "547571d5-f2bf-442b-8a9f-fc2d1d722e2a", "value": "T1E2A49F1262D06C33E5635B758E1EC6F426AEF1618F15B7DB2759EA3F0A742E1C132309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332361, "uuid": "c0725fec-d2cb-4b88-b032-f63eca080a37", "value": "6a8dd0359e3425dd330b8f8519bc89c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332361, "uuid": "1a3b514b-e840-4779-87c7-e80ebd58f166", "value": "12288:Lyv073CbDZFKC5vMWyXv+G9Fb2WR5gwN5xQnge:Ly23Cbh5vMWwv+G90+2wN5+ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682332361, "uuid": "e9d18ad1-e70d-4fbc-bc45-1ca1b01fbf15", "value": 470016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682332361, "uuid": "527d824a-01a1-42be-a91b-400f90428f84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332361, "uuid": "a86223a7-16aa-433b-929c-919df3b1e468", "value": "4618d5590bc6de044eb021314eeba431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f760d7-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330161, "uuid": "33496314-ed9a-4d7f-adf7-18ec25606e1a", "comment": "Malware payload", "value": "d22d0def65e036e3c94100be6f232d3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330161, "uuid": "99caf93c-dc4a-4aac-8f92-1e37a5ca5b1d", "comment": "Malware payload", "value": "1beb12971e69fb4040d60a6bd3667cb24c48a3db0fbf814d629874ee40312405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330161, "uuid": "7915bd2c-2466-4fcf-aacc-c060c58e637b", "comment": "Malware payload", "value": "f483bcfd5a7a450349699c18d90af3e73c413b5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330161, "uuid": "16f29cac-214e-42e0-9875-2ea434d5efa1", "comment": "Malware payload", "value": "0f1140f99a65fc58f4e212194ec100c0e8a6c5e26b4e44746679160c3b108c2e2510164b0d4c120ae805207f5dd4a54d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330161, "uuid": "b868e7d2-e1a8-4e6f-9638-a1800c24d83d", "value": "T18936CF3F2124827DC52E81FD86AE9F31A133F1353EA3C668099CE9712B5A4178DBD359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330161, "uuid": "06aebdc6-e979-4e52-adc1-95e0d2361604", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330161, "uuid": "3fbf23f5-c9df-4928-8248-c07741e91214", "value": "98304:kzLfYb5SSh9o2rsjeJlISH54LSGC8+GtOQg2XfpS:kzLS53o2DlISH556+GDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330161, "uuid": "ee2ef497-c727-4525-a8c9-3b54154e7ffd", "value": 5207608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330161, "uuid": "43636958-9f1d-43fd-9739-cc42f3385e62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330161, "uuid": "6f05ec56-5d70-400e-9c75-9e3a59b1bae8", "value": "1beb12971e69fb4040d60a6bd3667cb24c48a3db0fbf814d629874ee40312405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab45e63-e280-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682327857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682327857, "uuid": "fe86c5ce-91e8-4e63-8821-3fa89123d604", "comment": "Malware payload (AgentTesla)", "value": "3d7a0dc96d4716930dc98cd805594bb5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682327857, "uuid": "3700021d-65d4-4d72-b21d-24ce3af9f57e", "comment": "Malware payload (AgentTesla)", "value": "1bfb950deb3e17f180908c445173783b996cd3ef9c3b61b59b8ac67d96bde30d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682327857, "uuid": "3a06a4fb-f3be-4f22-b958-a3947344c1d5", "comment": "Malware payload (AgentTesla)", "value": "d4f221ac9016a7c693e5e75a2bb24d8826b81b09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682327857, "uuid": "f99fe8da-bb7a-4386-a514-ed58fd5293d3", "comment": "Malware payload (AgentTesla)", "value": "1ef487cb813388e971eb945fbe402055da9d8b1981e741aad4cf59761c06d49d756d09a3c8b377c747c0e81b4ad4db52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682327857, "uuid": "1a1dbde8-373d-4d91-ba48-614c007f3fb5", "value": "T106D4D0D46765EBA2C2653FBD126A31283FB014DBE519D939FD8850D93E32FC81A4039B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682327857, "uuid": "77267f09-f71b-4596-a74f-b890bb60a067", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682327857, "uuid": "67aace72-bfa8-4cec-a800-0411b785781d", "value": "12288:YbdIIfTDe+tgGj3B6inGA05927ywUNkvi4FVzOwdXNI:wmIm+tqinFC2uwMBYzOwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682327857, "uuid": "8b3f0c75-6c9f-4a6c-94a4-8fb073f8f2e5", "value": 635392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682327857, "uuid": "74af34d0-3863-4363-8f38-963e65a0ef1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682327857, "uuid": "211fed7c-25a6-424d-9688-73e6ebd4b05a", "value": "PURCHASE ORDER (PO# 2611).DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49601eca-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682346940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346940, "uuid": "79c208a9-c3ce-4ef8-94f7-e785523be99e", "comment": "Malware payload", "value": "962f162cf72e772aa84643aad1496fed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346940, "uuid": "2d6ba046-249a-4efa-b2a3-08ba48f3f8ba", "comment": "Malware payload", "value": "1c2bdc5f7ba3b18746498e907baf066ff6ce3b535b2e4f559a1cf95e1dc3c6af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346940, "uuid": "1bf02d6b-ddbf-413a-9275-bf7057e0ba5d", "comment": "Malware payload", "value": "c3aebe733c86ba942468a2a841f1ebeb9ee478bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346940, "uuid": "2fc7b095-e754-4c2a-8225-f31e653bca4a", "comment": "Malware payload", "value": "8b23d50eebbf55e350cf2ef53dd63af672cdddc3f817fc8ef858e673cb462665dc76e4eb0a51932bf7be2f4d3eb5a252", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346940, "uuid": "1e06c04d-0fd8-4880-ba92-b9eda96c64eb", "value": "T1E5A5D700D701521ADCBB35E94BAD313DB10CEAE0131464D785C8AAFEDBEA6F13E3559A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346940, "uuid": "d889e863-377c-4442-965e-cbc957169b2c", "value": "24576:HBcO19SWdwWRhpHqPPWuPnhMlY+i31w+LGr7G13xSUHq8l/GIv4VJC:HLz6va++B6xN26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346940, "uuid": "53c30c9d-c952-4c20-adf9-1ab1c7014466", "value": 2195579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346940, "uuid": "78e64f87-8627-491e-a9fe-d12499195376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346940, "uuid": "008778aa-e0c8-48ab-ac48-d1ba6437eac8", "value": "962f162cf72e772aa84643aad1496fed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdd669f-e26e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682320049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320049, "uuid": "d819406a-1f04-4401-9080-25ebee728645", "comment": "Malware payload (AgentTesla)", "value": "a65ddf79ae78c05a949bbb6e985337da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320049, "uuid": "63659a8a-77d8-4fbc-9cb2-c469856e4d40", "comment": "Malware payload (AgentTesla)", "value": "1cc443437aa25ac9797d9c3953774742940e54e2ac0b9645d5bf27b9ecade322", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320049, "uuid": "0805f429-0356-4120-bb41-0aa0b4dfc078", "comment": "Malware payload (AgentTesla)", "value": "82cc17a867f98fb34735fdb5f7754eea6231b203", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320049, "uuid": "0a59ef45-eb2f-439b-b56b-6936481ffddc", "comment": "Malware payload (AgentTesla)", "value": "54283358f82e4ba11b530ca7bae122d8d2abc478d4e40804de835435c322ca04c51cf7ee117b47ab93190b1288f3fbd7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320049, "uuid": "407d2eb4-05e7-4265-9520-7ff26c2c24f6", "value": "T10AA34B41679ADB22C7AE1B7BD5E2495003B1D963F583F74A39D832E908437A29F0139B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320049, "uuid": "aacddb4a-3045-44c9-b00c-e4e0409f74f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320049, "uuid": "9b00052d-5bd1-4e86-b2b4-5f97d692f0cc", "value": "3072:mLYbFRKLJqyrJoqz//Feg387eEaS6EVvLNVcgzh5mScr:mpeg382S6K2g95mS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682320049, "uuid": "9e8aab43-c3cc-4914-80b5-57e2107bd1a0", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682320049, "uuid": "8d96728d-5e5e-4154-b8b2-403e9ed7aa1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320049, "uuid": "4143902c-34bd-4e96-8a00-c1c6683bfabd", "value": "Consignment Notification-\u00a0 6183111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f77c7d-e2e8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682372436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682372436, "uuid": "a2d68e30-c2fb-4806-8690-5ba6da708c6a", "comment": "Malware payload (Mirai)", "value": "b0d15e291873d784c8f43b269dbb0e1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682372436, "uuid": "25153a76-eaa8-4a3c-9086-b1d6c8aab24a", "comment": "Malware payload (Mirai)", "value": "1e481186201e0ad4f37f036976ecbb924d615dae5e8815b259cf5284791e3350", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682372436, "uuid": "ce1e139a-d24b-40b9-b3ca-e673c91f1c83", "comment": "Malware payload (Mirai)", "value": "ec76299e2c0dffcc07f64913e1128238b8860edc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682372436, "uuid": "00326250-8342-43fe-b61f-e1c576aa28d1", "comment": "Malware payload (Mirai)", "value": "0b83657be790447050fc956e05c7c9b92dae7fbf4ff4f179552d7b8ed3d6286e8db742814856a69188b31b649178b83d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682372436, "uuid": "ab589ca3-11e1-4f0d-8731-ee017327f7fc", "value": "T177234CC49543DDF9EC1506752037FB328BF2E53A225AE987D39DE922EC51A01E6072EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682372436, "uuid": "689bb42a-7c5f-4133-ab10-05ab7a64d9a7", "value": "1536:kU3dCbi3SPGejOrBpSBN9y+BJqv6Z4MF:kUtA8SPGiG/oc+OvIZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682372436, "uuid": "85a58258-740c-4321-8e1a-3dfeea3cfe5d", "value": 49884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682372436, "uuid": "9cd3e334-bdc4-4333-8f54-f8ecd1a91cf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682372436, "uuid": "218042cc-d733-47d9-a6ba-8faf3eefce82", "value": "b0d15e291873d784c8f43b269dbb0e1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2def54b0-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682346894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346894, "uuid": "df95fafc-fe73-4805-b510-46aeb3d28081", "comment": "Malware payload (AgentTesla)", "value": "732c0ed8a06c2c8959d75520a4e374e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346894, "uuid": "f12774a0-6902-45b4-8a0a-d51e6476568e", "comment": "Malware payload (AgentTesla)", "value": "1eb3cc840b6cba8b0893ff4e75fee247f93dfc6d3afe173834439041f8feaaec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346894, "uuid": "a798a856-8d13-4f48-b66d-c21d1c7fc5a8", "comment": "Malware payload (AgentTesla)", "value": "aad102c1597c4075d4a87176b52421f1d083dce5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346894, "uuid": "cb83215a-dcb2-404a-abce-303221d3a19d", "comment": "Malware payload (AgentTesla)", "value": "ec38dd74b6c44d5910cc0d432b06a64165248f5fd5c71f1710b6b22e226cec8a8e4328a07c55ca1ce9f458be0663a919", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346894, "uuid": "40a938f4-1730-4bc3-9c27-3e007e9d84e9", "value": "T147E4BE1B222AD5B6D15E66B3E1E917FB0F2C2ECAFD75A0431B687DC831727B91B04412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346894, "uuid": "8affd042-447f-44bc-b0bb-986f325abb81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346894, "uuid": "3117b092-138b-49ee-bf53-8f2c92c234e9", "value": "12288:adb+ws+G6LwTJk4nAlppCHPAumynTjbE1Wo:adqws+G6LwTJjGCHPC+I1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346894, "uuid": "89b63c70-8100-4236-95f3-41b210a5c3ba", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346894, "uuid": "4a74e16a-5ef1-46a5-a93e-1c8b356fd6a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346894, "uuid": "44679c90-292a-49d4-8ced-8ae1e62eac87", "value": "732c0ed8a06c2c8959d75520a4e374e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4708d1-e29d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1682340150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340150, "uuid": "e7a25691-f655-45d0-b21a-e56541505c67", "comment": "Malware payload (Quakbot)", "value": "ce0d0ef75f3d7da7ba434a2017905132", "object_relation": "md5", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340150, "uuid": "0ae536b4-b23b-47eb-af65-8e273c7e4317", "comment": "Malware payload (Quakbot)", "value": "1f655f30306e3d16e6e8a922f66e1504fea13f8cec61cb6675daa28027307d84", "object_relation": "sha256", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340150, "uuid": "039ace50-8a24-416a-a806-2c99881273b7", "comment": "Malware payload (Quakbot)", "value": "36ad63b51e567e9234684bbc31c582614fdd5422", "object_relation": "sha1", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340150, "uuid": "d49abd6c-2ebb-4fe8-af71-6feba42913bc", "comment": "Malware payload (Quakbot)", "value": "5cdde032ae80602bf894bfb65d358c63cc6ea8e4dd8e24762f4cd02f5661c610498fdfc07ea310a78e33f585cecdcad2", "object_relation": "sha3-384", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682340150, "uuid": "434d2c51-f50d-44a5-a1fb-8fdc9de77ed0", "value": "T10D549C323B9EC0FECE774735869DE6A807F6B36C4DB4561733A8061E6B60A439724C25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682340150, "uuid": "bedc11ed-d86a-48e0-b851-0442be77c5c9", "value": "3f4fc0c267a8853d2a78e06cced37d98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682340150, "uuid": "9a3bdbc9-d049-4b15-90cd-f903648afff9", "value": "3072:y0oWwSUTRjn/6XZHApSHMhOpOMdINWzI6rSZeamGQzqhQnyCTSa8hYEbqXdfNGhO:WljnbpQuMewlrSZqGja8UG+j0qPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682340150, "uuid": "d6c6b58b-e537-401c-b4a6-3ff2047663fd", "value": 283256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682340150, "uuid": "f8df6798-e264-40c3-a27b-a70e779c7941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682340150, "uuid": "c6134bfb-2700-4e8b-98e8-2eec7800deec", "value": "a5EvW41tXILgqjcrd.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f537294b-e27c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682326183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682326183, "uuid": "78819da7-88d5-4760-88ac-f3432cf012e8", "comment": "Malware payload (Mirai)", "value": "8c439dcf4d776b33f5a6b94e673e82e7", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682326183, "uuid": "9058af99-771d-451e-8633-292e446f53eb", "comment": "Malware payload (Mirai)", "value": "1fa2643adfbc9bd0b1d0959ed30fd4a223d3479d6401e3f2750a1b826dc60497", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682326183, "uuid": "77b6044d-23d2-4777-ad17-ece709e5a22d", "comment": "Malware payload (Mirai)", "value": "9537e3304ba2f5eec82aa4db78e5dd04152e57b1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682326183, "uuid": "ea67c6e9-5699-4035-868b-dae9e5e96b2a", "comment": "Malware payload (Mirai)", "value": "c96a824845c17bf1a7fee7c0e238dffad1764d970a8d9dd962f4a5bb153fa95b5558b6b58b58b5291bfa83eeed75c448", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682326183, "uuid": "df43e293-8079-42c9-9925-28fa20417f3c", "value": "T1A173180378C689FCC488C13447AFB676D962B43E1A39B5AB37C4FF121C49E604E6E995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682326183, "uuid": "62a145f3-2075-41d2-92ea-031adad2bc0f", "value": "1536:4S/AHvivMss1Oxyef6VZ2Pd5vp1BD1McZ9D2oN305xb132:4v+sUxyVVZOvp1BD1Mcn2oN305hY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682326183, "uuid": "bfff005d-3983-4de2-aeda-125502a66f61", "value": 74272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682326183, "uuid": "92401807-fc84-4883-887c-bb25b3612b49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682326183, "uuid": "995fe7f4-576a-4490-9d36-f18340a9485c", "value": "8c439dcf4d776b33f5a6b94e673e82e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6168740f-e28b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682332378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332378, "uuid": "132b83ea-ab20-403d-91c7-50e43a14b40c", "comment": "Malware payload", "value": "4cbe3baf25933bc9d0cb632422e70903", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332378, "uuid": "84f17134-1d8e-4fa8-bdb2-80ada1787526", "comment": "Malware payload", "value": "1fbc2796e18c8c5ea32840f3eb64057379eb8198666b46160097491004de83e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332378, "uuid": "2e963003-13a5-4b43-a402-22b8239bd7e9", "comment": "Malware payload", "value": "0bc5e3582f2de0eacbc5d3c2f10c4f43eda83e81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332378, "uuid": "f9e857c4-5c60-4e09-8182-292f54768a75", "comment": "Malware payload", "value": "3f4ba176df9a3810425b27ff16c19dfd9a158fc4aba7e2628eee5e4bac528e8b9614bc9b688c146eae8f119862927515", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332378, "uuid": "a96ea30f-49ef-46a8-90b3-127d11680975", "value": "T1A184C020F550C02DF48282FAF6F6CBFEB9196A74131424D772D462DA17392D2AA316CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332378, "uuid": "6fa00c95-d124-489f-87a9-671b916fa921", "value": "032ac126bef9dc99c70a99a6b91b16f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332378, "uuid": "6b49f133-ab17-4b7c-bb0a-3013b3b7b436", "value": "3072:RvK/yLrQbWaR5Qax8c/YtImroxSnOPMfZSa3aVz9TWF5UZ:ROyLEbWaR5CcPioxSOUH3abWF5UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682332378, "uuid": "7dd9f1c4-77bd-4eaa-af16-52ac907ce41b", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682332378, "uuid": "3e070507-1db0-45a4-b292-7409229fb0e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332378, "uuid": "2f359ca0-5dcf-4d74-82ff-8d1a9c757b64", "value": "4cbe3baf25933bc9d0cb632422e70903", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8880c95b-e2b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682349623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682349623, "uuid": "a91c1aaa-caa3-4e0d-bf01-9e62af9bc7a7", "comment": "Malware payload", "value": "c6e356b307f0f0d1a8c80f588224d69d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682349623, "uuid": "9abf4b96-0c6f-4527-b566-2705d9b8786f", "comment": "Malware payload", "value": "1fd3e6c6962de0d40f882ed6b011656348ca3ee07d2c5b80acf497881d70ab66", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682349623, "uuid": "0cc5e6a8-2ac0-4ad8-aa34-36201225a504", "comment": "Malware payload", "value": "25c4dd125969026d708aa5068b922036e98174f9", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682349623, "uuid": "5e5680fa-7174-480b-8d47-df2b38c6e481", "comment": "Malware payload", "value": "a13569f773ec9e2dfd595daf78ca85a68b5c25c78db871b8290840a7cc5c7543b2646bb24f7c3a3974989b5332ab1027", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682349623, "uuid": "cc8a827b-691e-4bd9-896b-761c7dc1d1f8", "value": "T12A5633199FB95F3A8B6CD338A0AF5E2D0A725F414458F8F7C350B183665FF550A2A82C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682349623, "uuid": "aaf97b71-6301-4a02-91bf-ff47e7ada2cf", "value": "49152:CCZrlY0BPoCmvH+ShPi4rUlIWbvZU0rCZrlY0BPoCmvH+ShPi4rUlIWbvZU06:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682349623, "uuid": "84628c6e-2142-4ed6-84c3-2bc6d28f4637", "value": 5943540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682349623, "uuid": "d5dcf434-00ab-48ca-99ed-63226d08d411", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682349623, "uuid": "7249b228-705c-4b3d-97d5-a987ab1d736e", "value": "out.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceab9d24-e284-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682329554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329554, "uuid": "9f9abdee-fde3-415c-879a-f83981cf1565", "comment": "Malware payload (Mirai)", "value": "b48e4e933ebe3ed70a098be852fd8b1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329554, "uuid": "b2c99f22-2973-4c4e-8635-303d7be8adc3", "comment": "Malware payload (Mirai)", "value": "1fdda009ebd664472e3ba5ba301d444fe0f85c22e1f4beff4e2cd0c08b1a2d20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329554, "uuid": "055f6b7b-6097-4f67-b01b-599e5203fc69", "comment": "Malware payload (Mirai)", "value": "99eed29022551043ca2a8ff0a89890c48f3d400d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329554, "uuid": "cd1e744d-0fd7-4591-bcda-c3f971e197a1", "comment": "Malware payload (Mirai)", "value": "573dfdfac04793e79b040fc5b75a0f938e45afc2ff6b85f32f447745b6adf33866662430e75039d74d9cf8d697bf7222", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329554, "uuid": "d89040f4-b5f3-4054-8a47-1d9a1d3ecd9d", "value": "T10D93950D2E218FBDFB9D863547B78E25974833963AE1D585E19CED021E7024E701FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329554, "uuid": "d1f39102-3890-4145-85ed-829a0cfb6810", "value": "1536:iJ8r9g57KHoy7IzyEk9PBrlYbJ/qrqAQc2VbcqHhSGB2cX73JqFh85BtS33pKe:AYy67YoBrCV/ZAw72a73JEDpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682329554, "uuid": "fbf58d85-30c1-4acc-a8b9-6a7045501cb1", "value": 97228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682329554, "uuid": "df7b6a78-11d5-4014-96e8-8ca4f8ee6731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329554, "uuid": "a3e31a1b-4781-4fa7-9d87-ab2688072180", "value": "b48e4e933ebe3ed70a098be852fd8b1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e195c3c-e2eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682373604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682373604, "uuid": "51895c97-8c37-4572-8789-438bdad3a4d4", "comment": "Malware payload", "value": "a77cf18ea8737164d665e80d2bfd8ac8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PS-Invoke-WebRequest", "colour": "#606635", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682373604, "uuid": "c07d5c19-2c17-4b6e-9a87-84648afcbc65", "comment": "Malware payload", "value": "20221768bc42b928e141325cd58663d0c038c1670a0b535179370cd370877a63", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PS-Invoke-WebRequest", "colour": "#606635", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682373604, "uuid": "17618e44-f2c0-4de2-9f49-db0cc7cbb52a", "comment": "Malware payload", "value": "6b3046511dd7fe0e2899fb6df0ad72add81bd269", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PS-Invoke-WebRequest", "colour": "#606635", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682373604, "uuid": "f1dbc313-2642-4762-ab13-1d17a773917d", "comment": "Malware payload", "value": "4548782a24ba9ad0255e69b5f6fbf841da2d2a600575c1c22579eb13160e327eda14e6c9017d56df539e45c89e8ce456", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PS-Invoke-WebRequest", "colour": "#606635", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682373604, "uuid": "92249cbb-f583-42d4-b3cd-df27dea002aa", "value": "T1F7C51222E80635A1E84EC5B50CB01CA523F47E3A4ABF57C437B9699FD137E6D6F90620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682373604, "uuid": "00be0729-303d-414e-80fe-736751c74073", "value": "12288:O3yxdEl2aB9GfUh2m3Nx+3eza/Kaj8qjhTPhvTjavydYOHaCoQm:O3yxul2aB9RhBb+9jJh1javsf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682373604, "uuid": "98ec9c5e-da05-41e3-b95d-f5e75bfff4a1", "value": 2534050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682373604, "uuid": "fd5cd822-1225-4d10-8a4b-de683ce17818", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682373604, "uuid": "bdae2764-ac66-4b45-8efe-2580d70db356", "value": "uQNc8c_window.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418ce808-e272-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682321587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321587, "uuid": "26e798af-3b5e-4640-9ffc-1cb6f8348ed9", "comment": "Malware payload", "value": "c508aeec3e60aa7706223df200552822", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321587, "uuid": "9247f8c7-0be7-4c21-95b3-6f89d5ef3d31", "comment": "Malware payload", "value": "21566875398657b3349ce066a638c4b98f31ffd62fc4778316344b3d09ae1cc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321587, "uuid": "1959d805-325d-4fd5-b780-635f0f61984e", "comment": "Malware payload", "value": "51bc5896f45e97160f546b1775f82e0a1a0fdf95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321587, "uuid": "53c81d5c-53f8-4f1b-8b8d-f447ab063862", "comment": "Malware payload", "value": "114aed96ea07716fc10cbcf9a4138af0829bf01409c9be457c214fc36e330120aa4a93e91788c1883c4e5191ec6f405c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321587, "uuid": "a17ec6cb-a15f-4537-a79a-50c64e5384e1", "value": "T16CA5AF32F9B29079D52313705D89A32E67A9BFF10736015721D87F292EF34826E39972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321587, "uuid": "5b055e46-b590-42ab-8361-7fa06f2bb2e9", "value": "8745df7883a801a0067a7a9eb683d9ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321587, "uuid": "106ba132-ce9b-4a01-ba6e-84a6bad50a91", "value": "49152:NVqbjZKLyw3B8HLuiAf4XpO5i3l0hH1bRWydCv2HoFN6WtljaEy9NuSwIbFLO5:Wbjsyw3BKLujJ5iV0hH1bRWydCOHoFNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682321587, "uuid": "f9712392-2ffd-4030-a7f4-80da75e2bc48", "value": 2146101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682321587, "uuid": "6b890f6c-4ad5-4a8f-a5cd-116af20676eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321587, "uuid": "e079a82d-0f1d-4d46-a65f-9beaf1104a9b", "value": "c508aeec3e60aa7706223df200552822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d489eb84-e2a4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682343308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343308, "uuid": "dcba9966-a78a-4f62-9039-4b8c1ea9882d", "comment": "Malware payload (SnakeKeylogger)", "value": "c484332886c809a3452f19103ce0cfc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343308, "uuid": "bd6dd416-0b3b-49b8-969e-6d7b1bfea238", "comment": "Malware payload (SnakeKeylogger)", "value": "21777e7d8c275e5e9fc22a08172bfd5b9872340f46523df83bf2dd7a4b611dd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343308, "uuid": "51027c7b-69d4-4c82-8a12-f9c06b7934ec", "comment": "Malware payload (SnakeKeylogger)", "value": "42e0ea78388c594e6abab63c37464f71ed234f58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343308, "uuid": "879dfdc5-1553-455b-8331-bdfd8cced29f", "comment": "Malware payload (SnakeKeylogger)", "value": "183f72f601c279404a3e49eeb26e0e1bc1d33f29a4199c8b1f033951339bf820ccba579a83ffb67ad0431adb6e171dbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343308, "uuid": "d251ae2b-963f-4d6b-8582-4a3207e8210d", "value": "T1B0D4BE2B222AD5B6D55E52B3D0E517FB0F6C2ECAED7590431BACBCD832723B91B48411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343308, "uuid": "ba6cfd47-b76f-4896-8502-c83d5edac31a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343308, "uuid": "bbe764b5-d67e-425e-9a4e-e833431b316c", "value": "12288:NOdlpV5YHhorPTfFZyN8TyjbduPk8RwctUO8D9ko:NKAKfysdk46Bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682343308, "uuid": "53db82f4-cc30-4edf-9df6-f97c1c6d73ca", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682343308, "uuid": "c0010be7-eb8d-4587-b5cb-27deb5c17941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343308, "uuid": "ad2ab1c8-a7be-42c9-9f8d-29f7d94887f5", "value": "Shipping Documents.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d886d4b-e26d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (StormKitty)", "timestamp": 1682319433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319433, "uuid": "7f158e1c-00e7-4169-8198-ed9ae731de2e", "comment": "Malware payload (StormKitty)", "value": "f4a13d7f220fd8db56fafbdb62828a50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319433, "uuid": "6ea2cb36-2981-4a40-84bf-3a7590091609", "comment": "Malware payload (StormKitty)", "value": "2178c25cf14793aa8845ca8ee9f76d3271c91bc5eb763e97919415f9fb7d5e1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319433, "uuid": "1bcdc9d0-3861-4a3d-9a94-ccd0e3d5d07d", "comment": "Malware payload (StormKitty)", "value": "ed98f720d6481db8d45aba7a3889d9974902d437", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319433, "uuid": "c3ab5b09-fa0f-416e-9d8c-70afa46f19f0", "comment": "Malware payload (StormKitty)", "value": "c809e44b759e0e004b996e4db6b8bc442fa3d8ac4e90d5c93b2bce8e298d99b200ccfa2fc59242edaf7b71144cb44657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319433, "uuid": "8ecc4146-19c3-4437-9e8d-12d7ea81c9b4", "value": "T19724D04A7AC65612C9845D35D1E7062513F2E38B23B3C68A394847B60F533DA6F8EB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319433, "uuid": "d8e1a3e7-d009-43f3-8c45-653d853f4439", "value": "3072:i748SBjtujuYWofGa2OTeyGuPMZmzsq9Y2YhuhWDNJQZ5hJ8RDMh/CQgutfxvXX4:i7MOuYCduEZ8sq9Y2RWfWMRI9Ocn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682319433, "uuid": "700be860-6d61-48e7-9f53-6e02551ea95e", "value": 216136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682319433, "uuid": "08216880-7c6b-4aa9-a29a-fd6dbe6b16a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319433, "uuid": "f4e1af94-b38d-4475-b044-04b659993da4", "value": "S0LICITUD DE PRESUPUESTO-24-04-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8697631-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333490, "uuid": "cb1117ec-5ab7-42e4-9166-f0695e83880d", "comment": "Malware payload (Mirai)", "value": "9d733fc7e1b7c34be48e7f0116d1e06e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333490, "uuid": "7670ac15-4016-498d-9c3d-2b30231179d4", "comment": "Malware payload (Mirai)", "value": "22b447b5f2680454092fac85742c2d4f305c16051ece4f2fedb8116d350b5094", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333490, "uuid": "ac505093-273d-4c01-99e6-bd25d2c986bf", "comment": "Malware payload (Mirai)", "value": "f9eb824e3f29fb4a2a1539c3ff670966e8123cda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333490, "uuid": "3286aa81-6e3f-4bb0-9b32-7d187283cf91", "comment": "Malware payload (Mirai)", "value": "a746a62f651fa363db46bf04483166747ead814b749dd0fc5d9f17157601c3c2ecc0902ad9535a1b1e0749590b2255c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333490, "uuid": "b0894331-17e4-4f0d-9e54-2e81c8497ee3", "value": "T1443329DAB402AD7CF89FEA7E80160E0AF62123551053072B67BFFDD37E321549952E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333490, "uuid": "b8ed48b5-2fee-4219-a335-105939d04b07", "value": "768:7MeDVKgc06P1KmWQc7/JgFHdIp8LujWeXzpUGRJTPOMdL88pI6k:QYK30GMmbBF28Sjp1UGRJbOMdw8Fk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333490, "uuid": "0899e536-a541-471e-9121-1b17c6b03a46", "value": 52800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333490, "uuid": "be1f1739-4088-4c77-b209-6bd2c0c8ed13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333490, "uuid": "1b674128-51e4-4fde-abab-73da766ff033", "value": "9d733fc7e1b7c34be48e7f0116d1e06e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a766585a-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333354, "uuid": "e5009fe0-f9f7-4ab0-a095-d7447cabab89", "comment": "Malware payload (Mirai)", "value": "432d621471313b4d9387bc98bcc17fe2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333354, "uuid": "dac74be4-2e15-4678-9e09-059c2b1f6f00", "comment": "Malware payload (Mirai)", "value": "2481a51f732d409bf430506728dda38d6ec90c3677d035468169b5597b18e072", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333354, "uuid": "50b7ecdb-cd81-4150-ac76-9cf7ab2aeebb", "comment": "Malware payload (Mirai)", "value": "dfdc4ea93a01fd4ff8dc71c607f4870a8614335c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333354, "uuid": "080b034b-fddb-4a30-8469-fb0e6f3ac4d3", "comment": "Malware payload (Mirai)", "value": "de4096affd9f741d64a3de647ca28830b576b1a843eb17c42c3907d8c12e96e97778a55a1e056218d0f6edb1322cf0ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333354, "uuid": "2e2dbe69-18ed-4f52-9f21-f75df0347c1a", "value": "T16A539FB5C5A8BD99CF698278B61488389723900565E33DFAD741C7A6D00BEECF00DBB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333354, "uuid": "0d6e4438-108d-4059-8c6d-1c42c9745327", "value": "1536:B/bivQhunGauwt4Iduhosj/1RYeycfs3QtLok1cY3CJAa:BjiBGFOdO/1Rhf+Kn1cY3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333354, "uuid": "34fb6cdc-f205-40cd-88ed-dee170bd5599", "value": 64348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333354, "uuid": "d36ae5eb-0b9d-4f9b-9d5e-fceb5e2dff62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333354, "uuid": "76e8167b-4f88-490c-9dc9-9b6f9ad0ef70", "value": "432d621471313b4d9387bc98bcc17fe2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8ac0a4-e29b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Guildma)", "timestamp": 1682339166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339166, "uuid": "84822a34-5c85-4a1c-aa0f-198271aa85d9", "comment": "Malware payload (Guildma)", "value": "287ec402385c5fbcf61232adf67d515c", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339166, "uuid": "9eba0805-dc28-424e-aafb-f0103475ddc9", "comment": "Malware payload (Guildma)", "value": "2493e8082812c05f2f8208aaed9f5d63d4ca1d945d52bd3b78606596e7322b92", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339166, "uuid": "150c1585-eb6b-468a-a02e-86ff721f9695", "comment": "Malware payload (Guildma)", "value": "5b83016ed77d5e3e20b6210c95b8d7c59b58028d", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339166, "uuid": "e088343a-6d1f-40f9-9654-6c38adff6fbf", "comment": "Malware payload (Guildma)", "value": "b5b22737f494938fd884f65848930a59af2755a12cb338cd46c7120ae0b7aeaeba814f245026035e528c545a9d234805", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339166, "uuid": "4c24d95e-6975-4545-8163-d6e977903458", "value": "T16C1142FCC97605B2C42A42B29B2AC24BE0F613184757A79E9F4057F3861F067B3B1C92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339166, "uuid": "b432e163-15b3-4a7c-936a-296d50a62a8e", "value": "24:9fKi46e5y7nCv6iD16uZPzWLKU+chXakhdbOxtV31tK:9CiZz7nW6ikYbCKU+hkHaxtVPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682339166, "uuid": "987728ca-71f3-4b41-ae1e-158e45ff5e19", "value": 1092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682339166, "uuid": "6ebdf9fe-bc75-48cd-aba7-a40c451c5ae3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339166, "uuid": "c22da768-b65d-4e53-8172-1c21d73556f0", "value": "Abrir_NFe347571059.541712.87357..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edbf896-e2ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682346654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346654, "uuid": "8489c21c-3ec8-4956-9772-d3fc160a412f", "comment": "Malware payload (Formbook)", "value": "b8069569532bc5e30ddb8e8db4717299", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346654, "uuid": "014499a8-a241-468c-a2c9-5086252effe7", "comment": "Malware payload (Formbook)", "value": "24a324e5cb0f72ebd0f90a811b6c0b32f33211d3a882c254abc277c79b3a8998", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346654, "uuid": "e46d779b-732f-4a83-aa7a-fecbc3939bea", "comment": "Malware payload (Formbook)", "value": "8dbc47530806132b0ef44dfadc1c19851915ebf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346654, "uuid": "6d3af549-d9e8-4b33-ace7-8a2189bea50e", "comment": "Malware payload (Formbook)", "value": "f2ef2476af3e26ebe41f47e16374137a206ce3d1ccce9bdd340dabea104de647b091aab2443790016cc94ec7b8eb3256", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346654, "uuid": "6423b666-79f2-4a00-a911-36779e0471e7", "value": "T17B54121136F6C07FE07006722E76472ABBE59D2E1E700A1BA760D9187A77E85970F335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346654, "uuid": "c8b70804-949f-45d7-b130-9217a1fa19df", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346654, "uuid": "99f99bf5-6b75-4b3f-9211-3ce464432ad6", "value": "3072:3fY/TU9fE9PEtuXbYxvfWtWNbqJSPw5IWPQqd+G+YJlgg+Ko26EXDSHzV83zkb3N:vYa6xA2EsV5IaNXUgq23tkrkIXG5mDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346654, "uuid": "6cc10ac8-c321-41fe-9d16-e002a2088380", "value": 286054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346654, "uuid": "68bf9610-5c12-4718-8e2b-fc337a3eb84a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346654, "uuid": "80738114-a5bd-45c4-b02c-845ea35f7a7f", "value": "dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2578fd43-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682346880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346880, "uuid": "c3e52e6f-6ef7-4d70-b343-8f6e7cac64ce", "comment": "Malware payload", "value": "a9aa1de12401834e74cf2db1457a2a78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346880, "uuid": "232077d1-9b30-4f0b-873d-e685e15628ee", "comment": "Malware payload", "value": "25782652c4f88ce849d282d473c86a734e8d90747d8ce5c2c58910b418f9264d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346880, "uuid": "59610bee-c248-4ba4-b7e1-0da87e26be15", "comment": "Malware payload", "value": "c9375b77270dfe75a8b3067eaf54dee5c51d1945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346880, "uuid": "497c26e1-29e6-4cb8-b218-d61301c01205", "comment": "Malware payload", "value": "76339933287425ae8ad7211c4e40a5b489227bdf418c40946ff0c6b3eb8429670c77c2f5859a23f5829ea2a6f4e021a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346880, "uuid": "e157efbf-5239-4b1e-a4bd-829c5bf5d1c9", "value": "T1E7D41217F7C58132DCB127F054FA17D30A35BCE16B6686E72758688A48B2BD1A43632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346880, "uuid": "213c3b78-5731-48c6-909a-bf47f1855fb9", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346880, "uuid": "a886fb56-43ff-4012-b60b-3bd3194c97ff", "value": "12288:9y90aDmSCDMq0N0TdbSa2p1HWAxdADRWprK6q6WgepI8l:9yySpjsl/G1HbqDArMFHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346880, "uuid": "8db5ad16-82b9-4086-afe9-3c434fe66c4d", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346880, "uuid": "30bf6fd6-31e1-4002-828a-cf84a78a65cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346880, "uuid": "5196e31b-03d3-49de-ad0d-d414815d8c25", "value": "a9aa1de12401834e74cf2db1457a2a78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16f3432-e235-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1682295683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295683, "uuid": "8a713a98-68b2-42c1-a665-d3947a753246", "comment": "Malware payload (Stop)", "value": "4f788ea7b2181505fa4f58711aaf2790", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295683, "uuid": "3da2adf8-f7b7-4451-b926-f9b95a6455d4", "comment": "Malware payload (Stop)", "value": "25a4d587b11de5d5b255611a5a918aa067c8cf311d87de9cbb8f6f0d3fcde1e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295683, "uuid": "51774bc8-eb67-4e6e-8515-12ea687889bd", "comment": "Malware payload (Stop)", "value": "de8f5d0a84e7276b1fac3a7c3701e6e8dfc5c43b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295683, "uuid": "369baaa5-7b4f-4e6c-abb1-27bc0b21f200", "comment": "Malware payload (Stop)", "value": "e8ebcecf42a881c68b863dcd008a2ace2ccae83d1004aec2bd278d98a72676816a16ba58a8e918fa37648af0151bff87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295683, "uuid": "f48e1af0-6f69-445b-b966-01fdf496f411", "value": "T12EF41232BEA0D073D9AB89309C558BFCB12EFC205A55859B77247F6B2C303C156B6366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295683, "uuid": "3ec91572-ba63-4f26-b4f7-f601ecc65393", "value": "cbb199b85bd7e99e36eb212e7f14e32a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295683, "uuid": "a9e0750e-ba70-4c9a-862d-e89c778c7014", "value": "12288:G5mVbi6GFjw2JipngQzqYSXUYZk6UynpK5tqa3L/TmWWd2MGA0cOnhjOr:am9ijjngptpmPUkpuq8bm3OA0v9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682295683, "uuid": "5f6f0581-e3f1-4bc0-a82e-0320700afdc5", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682295683, "uuid": "d718cdc9-846a-42f7-882f-8597af70f7f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295683, "uuid": "51ae0fef-d16e-4e88-8446-9d0855e80575", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89495804-e26a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682318271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318271, "uuid": "6eab20ff-d02a-472d-9359-b0e34578d497", "comment": "Malware payload (AgentTesla)", "value": "8271909546f98dccbb90477af3b5142a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318271, "uuid": "f7526500-8365-4a38-bab3-2efd3a114c3c", "comment": "Malware payload (AgentTesla)", "value": "25ca89356d4b80a8ec0bb2d4d071fb4250dbb8920d3b9b1a556708ce69c4d73d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318271, "uuid": "bfc83b70-74b5-4f20-b6dc-dd9df4c0d29f", "comment": "Malware payload (AgentTesla)", "value": "5a76d713f6eb38e809ed79f56e63fac8926f1ade", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318271, "uuid": "25f64090-895c-43b8-877e-87f785c8ff86", "comment": "Malware payload (AgentTesla)", "value": "fd77d2e9bb024854eb40e3ba1d3fba23555ecac4809c63ba0615242e7d29dff737eb20b43111444ce30d0885b98e26e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318271, "uuid": "8815791e-a4e9-4596-8877-1d5d4075bb10", "value": "T1C2C48A3CA9ED4AFAC175F2B5DFBA8821F4A7D4637241593965EB02444A02DC336D02BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318271, "uuid": "e82566e3-81e1-422f-ab57-5a9634e857cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318271, "uuid": "9f7e38a0-c9dc-4c86-8455-ce8ebae6bd6e", "value": "12288:oA2iNMnjqzS+HIsMIen5f3fdHbhuS6oorwuJRxy/M:D1OH+osMrnb7hx2J+/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682318271, "uuid": "ecadaff8-a8d6-4570-a137-313bee3cbe20", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682318271, "uuid": "d9fcda6a-e3d2-4a43-9cfd-002a5665a16c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318271, "uuid": "37c4ddc2-8ce2-4ed4-9a92-7829c990df66", "value": "Cheque.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e553868-e270-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682320749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320749, "uuid": "0ddf38f1-6095-41b0-ba8f-47a49fe6e296", "comment": "Malware payload (SnakeKeylogger)", "value": "458574f3a39585357d71c062c92ba3fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320749, "uuid": "e8e6eca6-494b-41c0-b2fa-12cd2b299707", "comment": "Malware payload (SnakeKeylogger)", "value": "25dd001a5f16216d73a254e8ce18fbe6730d4570b5802b4c7ef7650f8fe17061", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320749, "uuid": "7625ff68-da09-4cc0-86d9-ded88aaa2a77", "comment": "Malware payload (SnakeKeylogger)", "value": "2b2f3ca0bdb0d236db65b61c5dcb7afde8381426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320749, "uuid": "52b84db1-e14a-4f8a-af87-385d2a3e48f4", "comment": "Malware payload (SnakeKeylogger)", "value": "db3e0b37dc905a5c66954e278d40a8fc370cac14b78d11d75afa22b7f2c4917bc77a87554177b1aca8cf05b6341b4cb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320749, "uuid": "0c5e17f4-30b8-4022-a83f-3d7a2df3814f", "value": "T11E153C93B150C8F6D85B05F2E8AA66731C9E6E8DDCB4400D169D7FD632B3372219ED0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320749, "uuid": "a67c1246-d638-41f6-a684-5a13cbe7e8af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320749, "uuid": "b269fae1-386d-4255-b97e-2fb1c3fc0045", "value": "6144:dCDcEr5323hX02OkF5efVEUimFrx1fIsUU7NG6IdDyTt7PSXiuj7zTZsXxGQmDKB:dkikZtGii7PHcofwou5WPm7C/iKba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682320749, "uuid": "3014448d-7564-47a1-a689-8a01bcf9808c", "value": 935424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682320749, "uuid": "0a864264-acb0-4fea-8d7a-25a521ae14b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320749, "uuid": "6754b91c-2682-4c88-a504-cd1c014c235a", "value": "04251452615625625.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc76a14-e298-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1682338089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682338089, "uuid": "d9fc9d2d-6eef-49c3-8e69-d489c5655bd9", "comment": "Malware payload (DarkCloud)", "value": "a39fa900e8f2d23ebb073ff6e3fe36b2", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682338089, "uuid": "bd560008-87ee-4f16-bfff-79568b5d7e4f", "comment": "Malware payload (DarkCloud)", "value": "2633a9aca0a8101f39545e1550bfc268e2fb54bf908ece59d52b3655c12f3a3c", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682338089, "uuid": "83f55256-e760-47c1-9477-4ccda8403afd", "comment": "Malware payload (DarkCloud)", "value": "efd3329426800d4398e2e4667e7b0944b9433501", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682338089, "uuid": "8dfc3640-e41e-45e4-9d2e-eb7193a4ba12", "comment": "Malware payload (DarkCloud)", "value": "e7b85e97014c32741f394d4029d532a6db4253929574661aa0c6b281f70f81e3e9ea3640720fe9312e65499a7ae18960", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682338089, "uuid": "ac5fe4fa-8bef-48dd-819c-000a841c4569", "value": "T1BC75E017222AD5B2D19E56B2D1E917FB1F6C2ECAED79A04327AC7CD432727B91F18001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682338089, "uuid": "72ab5ae1-d901-4b4d-aad5-82398277fbdc", "value": "24576:GIwfHLXcqHmsISQPIbMID5K2W+W3Grh9dCHOd:TgHzcBjSiADW3GF9dC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682338089, "uuid": "cd152bef-5bb8-4af2-b8d7-dd93fdc2a720", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682338089, "uuid": "653de7df-698c-4e6c-8cbe-220c26410f20", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682338089, "uuid": "23849aee-7c81-4714-a4a9-acc67b649100", "value": "PO24666740142023.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3269381-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1682323173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323173, "uuid": "cb7ddb81-3de9-4e23-af0c-2f1765ecc79d", "comment": "Malware payload (GuLoader)", "value": "fd5b991fbd70cbdadfbb2db6037cceb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323173, "uuid": "5126fbc2-09d7-4e78-af8b-51585aa2a6f7", "comment": "Malware payload (GuLoader)", "value": "26760a2ef432470c7fd2d570746b7decdcf34414045906871f33d80ff4dfc6ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323173, "uuid": "073fd3f9-b8c5-49a9-98d3-d55f28fb0f8a", "comment": "Malware payload (GuLoader)", "value": "ac18373980822ac5644e6aa9b53348a1662365a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323173, "uuid": "d787bcf1-e695-4f91-a589-5b2be20d96c9", "comment": "Malware payload (GuLoader)", "value": "7c227a35194af2c6bf3c390304d537c6a0b992aaef55c4c828faadd97c30003932466a206ffecf2f156333c27506cc39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323173, "uuid": "cc999c2b-b2eb-4ba3-a198-7b91b607e7bd", "value": "T165B4224127B4C463E2A505B1A8B7A6FBE6A6FD40ED80514F0B199E1E7E3230E810F36D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323173, "uuid": "fe012a25-93be-4eb9-9463-a5b6e8d556f5", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323173, "uuid": "ef9bd930-6470-4ca7-9d03-6c13c02f8944", "value": "12288:gCkmDOVLNQ7LSRH2BkAS23HHsI7liagGI9NCnkMu32dW2bc58:XDOVLNQS0mASGUv9N8BqwnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323173, "uuid": "f60aa052-0e6f-406f-8780-0ed4e7c167a9", "value": 507048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323173, "uuid": "a80c8b29-9404-4f41-ad67-a8f447b8eb03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323173, "uuid": "317a92ad-cda9-4e2c-aea8-6f141ca81f9a", "value": "IAC Order-09-04-2023-534439_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8d2af3-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1682346835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346835, "uuid": "27cd1335-d8e0-4959-9480-087afd55def0", "comment": "Malware payload (DCRat)", "value": "73ce5f094321f2683b7846397b3d5a8c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346835, "uuid": "8233eea5-25ad-4bb5-8bc4-03a8e4712c7c", "comment": "Malware payload (DCRat)", "value": "274e4c594cfadeda5b78076c2791ab57d35b6b9bab954c30a2053d17812e1aa5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346835, "uuid": "d38e3a9c-2979-4013-a1f8-df6db8fd39c4", "comment": "Malware payload (DCRat)", "value": "d17102bc9d37a5ff9506dfbf94d0608378fae2c6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346835, "uuid": "19beae7d-3bd6-4174-8e9c-9c323715a36f", "comment": "Malware payload (DCRat)", "value": "008c3ff816d0886f654d47e38f65d413f1b51123c4a2f206414829ddf5c64cfa3ada1ade5563ff2a6294d49900213271", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346835, "uuid": "00a511a3-f1ae-478a-af3e-363cf3af2058", "value": "T1B595D03733E2FD7BE3AB1A78AC9601544C74FC33627CD18A2DC41A9D6A76700A9156B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346835, "uuid": "e3cacf37-de58-4bca-a52d-33da8c5ca171", "value": "50b4f8793dc0207906cbe2e950664835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346835, "uuid": "ec98c55a-5503-48d6-801f-cb65a10d805d", "value": "24576:oDlxLeM+sLqZS62SiyY4TWKaJTXogjqpn5WMAw3FKvKvPoxBoOux5lUA4X+he6P2:K3Ci334noyvnbzJ8eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346835, "uuid": "c9fb8d4e-9606-4417-b714-289cd4affdc2", "value": 2007040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346835, "uuid": "6c3b7181-41fe-4f93-8163-9dcac321a52b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346835, "uuid": "87451f33-8cbc-4908-8501-e7f74845bf88", "value": "73ce5f094321f2683b7846397b3d5a8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8e9001-e2b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1682349016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682349016, "uuid": "e81dff2a-72d7-41f0-a37e-c0412264afaa", "comment": "Malware payload (njrat)", "value": "0660842300df2a3f15c61e7060e9667b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682349016, "uuid": "18556d4d-018f-428b-bcaa-74651bb4816a", "comment": "Malware payload (njrat)", "value": "27a1aad9a1387b604577d9277d8e99ad9b28d5a0a5e9ab502983e2206bc3c423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682349016, "uuid": "91b7443e-793c-4726-9f3e-d369e80cdb32", "comment": "Malware payload (njrat)", "value": "a0609b7986ce6bde27baddd111ad35c4acf25caf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682349016, "uuid": "4943003d-52af-461e-a7e2-36a779ac6f88", "comment": "Malware payload (njrat)", "value": "a0c6a35ddbf76ce2fa2c17cd0dc7ce27f2d383ec6944f3390d33cf3d5c8a00acb82ee7c6d15b34a6b1f7effa48ceb56f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682349016, "uuid": "f41b13cd-a4b5-4a0f-a4b1-44351c31908b", "value": "T139B24A4F77A94522CCEC47794A31D32042B4E1470123FF6B8CE684EF1E77AC51A58AEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682349016, "uuid": "580bafd0-5a6f-4a5b-8292-4df099715cb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682349016, "uuid": "ea625498-19ee-44fa-a652-c452cbbd5a55", "value": "384:tezqJFqAjXgbk8yx01YJXXUw1c04KD3HcEMtWJN8/53xxlCv/WG/C:tw0onyOYJNtHcftTRhIeeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682349016, "uuid": "35251059-205c-48f1-8f9a-f34f02b15446", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682349016, "uuid": "f6d56646-020a-4ac7-bb1d-b9aad9c2a5ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682349016, "uuid": "9903e3b9-2671-43de-8065-68e9b13e87bf", "value": "0660842300df2a3f15c61e7060e9667b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e729eeb-e2e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682372692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682372692, "uuid": "fc01c8a6-a211-43da-bcde-68b27a066f13", "comment": "Malware payload (AgentTesla)", "value": "5c50f0f4f7a4305464b0a9b14b33b006", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682372692, "uuid": "a24209f5-5d1a-47dc-8960-ca186e8fb4e6", "comment": "Malware payload (AgentTesla)", "value": "2826cf1541f69a6790889af933a24db2f28fd8e04a8c5dd5ec2d7ee2ef93d0fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682372692, "uuid": "9695d083-8335-4a82-a119-806de9318882", "comment": "Malware payload (AgentTesla)", "value": "d7d5ef83af768a6bfe520f397f55a9d138d5f6f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682372692, "uuid": "e706afc3-7434-4cea-abeb-8de63bbe0398", "comment": "Malware payload (AgentTesla)", "value": "db62b77482acda8cb9b61273d1571eb887a9c32acbbe2adb4fd979c5d82ecdbf753db370d14a47ebf3acf50ae365d721", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682372692, "uuid": "fa2a16df-8b8b-46bc-af5b-0c48951f47a6", "value": "T119D448285A981BE6E139B3B4CE395410E3E3D817A371D9B97DEB00C81743E8266D177E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682372692, "uuid": "6f2e8595-58d7-4219-bf05-8341091d5b08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682372692, "uuid": "435b8b55-b4f8-4cfc-95f4-7973d1cf4699", "value": "12288:weW/T7I3AA/98qzGTfQLFRPzci/9iMH+hc7VGmR7WQI:Hi7up8rcLvPPoMHdxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682372692, "uuid": "2a7202ec-bc92-46b9-9a5d-404b12198f84", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682372692, "uuid": "652d994a-f17f-494b-b690-da5d4d738a59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682372692, "uuid": "ee6fa11e-5291-411f-8eb7-8d7146e6c726", "value": "bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555adf97-e271-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682321190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321190, "uuid": "dfac6187-c0e7-4d56-b6c7-dfeb5e4eb4cd", "comment": "Malware payload (Mirai)", "value": "0cb8db4709f40ee4bf62fbeee5bd8a2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321190, "uuid": "6a04afd4-0d51-4948-9aca-3e1d3e569b24", "comment": "Malware payload (Mirai)", "value": "2831fbe60454ca384bc850661aabf71ee143c4d18536c8269a1ce9eda902b152", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321190, "uuid": "25c007f3-6a32-406d-aadb-2d1da09562df", "comment": "Malware payload (Mirai)", "value": "db336676037e01f3e7cbba005ac895a01715cb3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321190, "uuid": "30ef0881-cdc1-4425-a63a-a3b72f5e6192", "comment": "Malware payload (Mirai)", "value": "f81779b93f46624a972658237e26486f59159402603d71561cff49f96f86e1ff049be847d57d2487b9c9ab9cdf1f2180", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321190, "uuid": "5270c932-a879-404a-82f1-5fc3e800689b", "value": "T117333BD6B801AD7DF98FEABE80260A0DF62133545093072767B7FDD39C321989E26D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321190, "uuid": "550877c3-96dc-4659-b70d-a2aed2f3ac49", "value": "768:g7Ue9P581ooC/m1XqsuImAYdeZxSTuXWeOLpZ2BJTdLaXD88x:gAsPq1/4mBAvUZxSKXp8Z2BJ5Laz84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682321190, "uuid": "08591b44-74ad-4857-ada0-f3b312efcf0d", "value": 50940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682321190, "uuid": "bf64108d-0f95-49e4-a622-369b563cd6b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321190, "uuid": "98ac544f-9497-46b4-8113-d51d73e6cf28", "value": "0cb8db4709f40ee4bf62fbeee5bd8a2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37041337-e298-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GurcuStealer)", "timestamp": 1682337890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337890, "uuid": "6b575f94-d7e9-41bf-b69d-cd4a01118827", "comment": "Malware payload (GurcuStealer)", "value": "f19126b02be0b331982e041dc9bcad51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337890, "uuid": "dcc35574-d574-43ec-8fbd-cc813d6dba4f", "comment": "Malware payload (GurcuStealer)", "value": "2869db18f346049bcc9e378a77ed809fd9caad2fd2bd4d9f58d6e728c784b3eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337890, "uuid": "6fe4d3f5-f737-4cad-b2fd-115651172ea0", "comment": "Malware payload (GurcuStealer)", "value": "10ab04a6f24ce4540a564041375d8275a691e409", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337890, "uuid": "3bd3ba05-6ae7-4c4e-a65d-a980f8499231", "comment": "Malware payload (GurcuStealer)", "value": "7a6f133636f8ef7bafeb31c80ee396d16b3c722cad9ce1099c6ee6607bc953e442d19039ce9d59425aadafb89aa7a810", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337890, "uuid": "439994df-0daa-4ff0-beab-55cb88509d0e", "value": "T1B824B40EBE6689B4FF0D2134A8662304D731AD939501CA0E3FDEB0D50BF7AC94E25997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337890, "uuid": "2cd39961-bdf9-4bbd-bf8e-544d6359f5c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337890, "uuid": "f9c55606-a0d0-4cb8-9785-f1119b76c149", "value": "3072:fvfoUJQCw+d+Uoj9DVbDWb0Cdfc6mdSCFytxpNS17e+8TNBfxz9l:fvfoOQHelqJbD4HJe7FytVSle+8TxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682337890, "uuid": "9e9e9203-6017-401f-97d3-cf95a4416cbb", "value": 228712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682337890, "uuid": "df432f02-2a03-4358-aa08-59140bbbda78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337890, "uuid": "5bdcffab-fdf7-445a-ad1c-a0da58472baa", "value": "f19126b02be0b331982e041dc9bcad51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75cfb04-e2fa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682380223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380223, "uuid": "6c6f137d-a330-4236-9ed6-ae50133ac4f2", "comment": "Malware payload (RedLineStealer)", "value": "f5495b5aa9248dceb0e120892164686d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380223, "uuid": "c272ca18-5ee6-469e-97fd-67624dec9829", "comment": "Malware payload (RedLineStealer)", "value": "2912fb72d1026e9f9c9e1a1577ea45a8bbdbc9e08c3c33a4e05385041fadf363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380223, "uuid": "45a56cda-beec-4abc-8a58-122bd266400b", "comment": "Malware payload (RedLineStealer)", "value": "272b7ab2a98ff637dc6c9c76238d132a765ab0b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380223, "uuid": "be590fbd-1a50-491c-99f1-bcac3a67b8d5", "comment": "Malware payload (RedLineStealer)", "value": "ee89ea1e20ebafe6f6f7d1c5b8d0765b39e923fd55854fd1e8b52bc4eeca7c3ef6d24814638df4c33ca6b1c534fa82d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380223, "uuid": "903785ef-71a4-41b5-8b0e-6a33539b47b7", "value": "T1A6352311ABD89033CAB5137418FA03431B3AFCE16A26D5FB1761AE8E5CA26DD543173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380223, "uuid": "4d33e0b1-a439-4021-9106-ab9c757537a2", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380223, "uuid": "1f87d886-1dc5-4773-9cdf-e60a80554887", "value": "24576:zyw68Epbr5aplxilqr/c5P4F5RS2zguW7:GwEpIzilqDKq5RSXuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682380223, "uuid": "7145692a-3454-400b-be2d-5be896897cc2", "value": 1127424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682380223, "uuid": "7c2f3ce7-40c2-4e42-912f-22f16d6f980b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380223, "uuid": "d874571f-2fae-4c40-9696-632e65b31d37", "value": "f5495b5aa9248dceb0e120892164686d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7aab08-e2cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682360157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682360157, "uuid": "5181e09e-ecbe-4dfe-85e1-266513d9fa0d", "comment": "Malware payload", "value": "cc789c2b418cf62305d9e1bdb159f4ae", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682360157, "uuid": "86551876-10cd-48cf-b0e4-0ccddb4fab27", "comment": "Malware payload", "value": "295f4242ed4bebbbc2d8f1e602a9bb4c66a987d7c6e6522590327da91fc40279", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682360157, "uuid": "3ee9cf42-d6ea-47a7-8c2f-1db091088078", "comment": "Malware payload", "value": "3ad16d9551ca902e101bfecec4eb9e37a0574e2f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682360157, "uuid": "8f577fc7-bb1c-4e52-bfc5-b3a5a1865797", "comment": "Malware payload", "value": "814e82bdfd9510ba7823837a93a3393a796b57c4d1060df3b997915350fdc2b9a737db195a1d7d202fe9214d2af435d8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682360157, "uuid": "242894bf-cdcc-4367-9a7b-7ceb21c94619", "value": "T1FC4442696096C8DEFE5ADB40B1B8FFA161F1B1B355C81A2013786104CFE9F962F8D09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682360157, "uuid": "4dc1e798-3080-44c0-807e-4fb1c00ee866", "value": "6144:dhMHd8wF9VtLr3EXGpI5cGIE+QIzX6j7PyHl315h3Apw:0Ht9VtLr3EXGpI5cGIhXy7qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682360157, "uuid": "a6937230-ae3f-49a0-a4f4-d0952d645c91", "value": 262679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682360157, "uuid": "51139961-b3ce-4cf4-a058-d3367a319b2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682360157, "uuid": "ea0742ec-ccc6-449d-8e11-43a36906c51e", "value": "t.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbd2095-e256-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682309873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682309873, "uuid": "d28e9bda-e8f2-4efe-93a3-c9c763897bd5", "comment": "Malware payload", "value": "cfed767e8b37d9d681154f787b5601dd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682309873, "uuid": "48f8e469-c2b8-40de-9e29-d1563955083c", "comment": "Malware payload", "value": "296925aeb5220e1036df57002eb0649aa225c57e2fc9ff5e2a811fde6e49afae", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682309873, "uuid": "91f4c352-7bd3-460b-b387-e3bd337b55c7", "comment": "Malware payload", "value": "7e7acf546cd0271955bdef3ddaeb96c70be08784", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682309873, "uuid": "1bc72545-d377-4f33-8961-b7047b3a165a", "comment": "Malware payload", "value": "6b750df91d35e0b74a3c2e868bedd61cee93d21f7880d1cda4ea38d0da3677195afca03852f326a79490b6e374a9e058", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682309873, "uuid": "b856235f-aadc-476e-82d2-dd1912c4304a", "value": "T114B63399EBB8DB33BEB0BC2733317E11A04211B229B5D54F8590E9D0D996C90C779BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682309873, "uuid": "93aeee24-1401-4d04-bf53-b5c0ded4d921", "value": "196608:nSIw12jD8Lqm9BEdUTtc3hNY0RWiWi1ipCqoPnqueu3rAVpcF4FoKDtygEgM7Dor:nSC5FutEhNYnL5pqq7uipA4FhsJdDoPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682309873, "uuid": "bd16d33a-d118-41ec-9cc9-4345b013c3b0", "value": 11219883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682309873, "uuid": "b1bf4526-f8c3-4bff-b5bf-377711aa5515", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682309873, "uuid": "8586f00f-1a11-47d8-b22d-ba02990bb481", "value": "230420-hkgfcaab5z_pw_infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a390fb4c-e236-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1682295981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295981, "uuid": "6be4417a-dbd5-48d4-a3b1-46127c89d2c0", "comment": "Malware payload (Rhadamanthys)", "value": "333fe6b7405da37f8b966a9cc238a4fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295981, "uuid": "59f2ecb9-e63f-4c90-ba6e-623ab71c665e", "comment": "Malware payload (Rhadamanthys)", "value": "2a2474a3185ef2d18ccaeaec20bdd22baa60fa023e45d3db1bff482632369db8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295981, "uuid": "8ed79044-debd-4b18-9962-5a8a72a1ed6a", "comment": "Malware payload (Rhadamanthys)", "value": "2314405556c02645cb555ebfcd2b7b3347b00528", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295981, "uuid": "83260e23-e375-43c0-9ba1-3caaf8afb966", "comment": "Malware payload (Rhadamanthys)", "value": "14d146561df07e4ee67145228b9940712be1930764a1aa637ba083f388e332d7df0d6e36249f4f5472dc05e1ee62c52f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295981, "uuid": "73cbe08d-11ee-4962-9a9b-fc7bcbb76a80", "value": "T10D54F01279E0DC73D8CA44749801D6A8667EFC909697869B33583FAF3D313C25B3A662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295981, "uuid": "0cc475cf-012a-4573-ad59-2b2b3157eda8", "value": "cbb199b85bd7e99e36eb212e7f14e32a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295981, "uuid": "7909c193-49e7-4523-aed3-cb2af508c5a8", "value": "6144:/h6v6OhalqEah87K79Yfb0wuDVQLxFkqaqDIp1:k7dhEKyT0fByzkqa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682295981, "uuid": "7b047cf2-0b78-461b-8b85-3cae56a830f6", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682295981, "uuid": "db3d9eef-4feb-4df7-bb02-21f28b5a3bf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295981, "uuid": "1a6ff882-0208-4190-af46-7be8754741eb", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aaad9ed-e2ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682346056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346056, "uuid": "cfe73631-f9f3-410d-b5ec-246cde9dda7f", "comment": "Malware payload", "value": "daa8376da943234b983aea1a9ffd9823", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346056, "uuid": "04daf628-f10b-414b-ac7d-ce1f37c0d271", "comment": "Malware payload", "value": "2a725b31a9692d43ddd9ee5fd8d1845c87ca0e7c10ab878a2381e3c97fcb7151", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346056, "uuid": "d73f31fe-7248-44ac-b00a-1e55e33eb045", "comment": "Malware payload", "value": "a272cb11f7dd831008a5cadf3f02be615069b9ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346056, "uuid": "cb875745-6767-4eba-ac9f-6a6d507cd09d", "comment": "Malware payload", "value": "417b9ba7ec0655223ddcd8cca3a608cfafa689e43cc941299bcb2c195b4807a78d7ffccf4cd275384f8e5271a32c533a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346056, "uuid": "1787e91e-0fc2-4af3-bf36-20c7267239ac", "value": "T11E76BF0173A84E2AC5BF9739E0B14A146775FD0AAA56D31B34CDBAAD6CB33424D0136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346056, "uuid": "46363510-30ce-4cf1-bd24-e0b351ecc2c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346056, "uuid": "f40a9c0a-85fc-4c8d-b125-6f44342f2719", "value": "98304:bMxZQPl9gDi8AJsUAohiQpJJjvd9tWpmIgMlqVz+rQVe97lwu9cXvBxDh3DYnsky:CQtBJsoUyJLJC5MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346056, "uuid": "cc1c0bd2-4f8e-4443-a607-d81ae245556c", "value": 7634432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346056, "uuid": "508fb397-0ae0-40ad-a7a2-bf69b77fbfb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346056, "uuid": "594652c0-481a-48d4-8471-204c56e63913", "value": "daa8376da943234b983aea1a9ffd9823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180505f6-e2da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682366185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682366185, "uuid": "3303c865-3ee9-462c-bfbe-a7f51d2ba0fd", "comment": "Malware payload (Mirai)", "value": "0098292611c394272951f2847b1da4e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682366185, "uuid": "ba2e68da-065a-48ac-a9d2-22f82a52e376", "comment": "Malware payload (Mirai)", "value": "2aa2ff6157469612ed1912ce637efcc61c912ed5614ea42cdb498b91bc997fc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682366185, "uuid": "e12b172f-6b61-43f8-90af-a076f7820f7a", "comment": "Malware payload (Mirai)", "value": "009d0eb9d2c8cdc661523ad2dcb42ed1b86d5a03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682366185, "uuid": "76942e1c-758f-4839-862f-125520868f79", "comment": "Malware payload (Mirai)", "value": "7079d94db529465cb90b53f289a740fc07ea8bd98b03693ee3fbec39a7d7a95e4c59457748bcdfec0f1945f69a848d90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682366185, "uuid": "9611efac-2e45-4702-9c3f-808f54e8e806", "value": "T13B831806EF654EF7DC6FCE3385AC0B0634CC951A22A52B367574D438B66B24B4AD38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682366185, "uuid": "c1809aa8-67d1-4ec9-bf0c-79abb893a988", "value": "1536:N/ftb10dFmE2Se0aRVoHZXIVxg/0SWTo6Ve4r7y:N/ftbuaSmRVoH2pTo6I4r7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682366185, "uuid": "13e91cee-0122-43ca-afee-c9d0e462d313", "value": 85060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682366185, "uuid": "49bde5a5-21b6-47ea-84d7-05308e471f96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682366185, "uuid": "b6a36faa-9a7a-44ce-9fa3-7c2f29b02fe8", "value": "0098292611c394272951f2847b1da4e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5dcb1e-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330166, "uuid": "a49d2084-8faf-40a0-8dc9-ed8d8f281cc2", "comment": "Malware payload", "value": "686eb9dfd4eef258282a2f403a8d2796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330166, "uuid": "48569b14-e91c-4ab6-83b8-281d37060a1b", "comment": "Malware payload", "value": "2c540f5220b7ba3cd6efcd2fe8091fc24f8da11be4b1782c4e502261ef48da82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330166, "uuid": "73cafe2d-6724-44f1-a22f-4163e5e849b2", "comment": "Malware payload", "value": "750f2517dadca76eb4f01e6610b3cb6347b0559e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330166, "uuid": "09ca64e3-2e54-4622-aeed-375510c71442", "comment": "Malware payload", "value": "8c219e98521443141b75df0f0be2e4d0ad247bcf4f4ad150525c99a1aae905b56292d9b7c3d0c9c31812aa50f284849d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330166, "uuid": "0513ba82-b526-4dbf-8bcc-d27dcd42683e", "value": "T1B636CF5F609097BEC20A9232C1FE5B34D53371A24467C72E5AC1E2F16A95D608F7EBB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330166, "uuid": "a621c6cc-81be-48b0-8ea7-c84ae16319d8", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330166, "uuid": "3bfaf885-b554-4e90-b170-33fbf9b5e09a", "value": "49152:CQ/hNQGEaNUdcZ3LZicpb3rwNHPb+P0dTKUsu2kRMMkS0DhDItNUZqvQ0wfq5Fcg:B/lRmSZhYAqY0wfoco7G8y7IH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330166, "uuid": "7f21240c-b392-433b-ace9-74e744174cdb", "value": 5096824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330166, "uuid": "0d902c1a-b4e0-4aac-82a8-0b17cbcc514b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330166, "uuid": "11349fc5-f008-492b-a54f-3ee9c6bf4405", "value": "2c540f5220b7ba3cd6efcd2fe8091fc24f8da11be4b1782c4e502261ef48da82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355035bb-e297-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682337458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337458, "uuid": "11e39361-0805-4a1d-aa34-212b0048513a", "comment": "Malware payload (AsyncRAT)", "value": "0d04ed02613ad4f4817d09021cdf02a5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337458, "uuid": "d2d76842-2ee3-4376-835f-719de6344eb1", "comment": "Malware payload (AsyncRAT)", "value": "2d200e9f3549f94af4bd148fd30fe9efa275507b4c5de294a443c5ef26a7ffac", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337458, "uuid": "d6a0738f-bccb-4935-8036-899dfff6f19c", "comment": "Malware payload (AsyncRAT)", "value": "682c022109dd97b65428965cbb0f7a9335a8f0a3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337458, "uuid": "19ca6e65-08c2-406e-922a-8401ac741423", "comment": "Malware payload (AsyncRAT)", "value": "3ff8e9cfb73305a5ba47e7fc1ff697de458411111f9b4c97dcf8987b88c774a1cd1cff4b59194ba9f693bdc9e195c917", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337458, "uuid": "4cead486-1986-4cf2-bfd5-31723a3d3c0f", "value": "T14FC51226F5133666F80DC4B006F43E6413F99DB65B9699C42174F20FE923BAADE18B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337458, "uuid": "1bc5a88c-18d3-4c9f-8fa6-730244fdd40f", "value": "12288:JkVLBIRebuLeTV0a7e9bjj8qjhTVhvxjwK2w6GPKFj6IW8cq22GG2:bRLqV37ojjJhBjwA2OIWEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682337458, "uuid": "cacb0782-e1c9-4e6a-a9b9-892288a0fd21", "value": 2534000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682337458, "uuid": "b0016acf-1a1b-4e08-84dc-ffeede6168b8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337458, "uuid": "1687d60b-65b1-4c24-96a9-3f178e48670c", "value": "Ta.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394befe9-e2b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682349061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682349061, "uuid": "8e28c92c-9476-44ff-9e0d-7df164b6a051", "comment": "Malware payload", "value": "cb69fbd133c69e636c55d55ef20e2476", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682349061, "uuid": "1f9032c2-7a8d-4453-a6bf-3222ec1c2bdd", "comment": "Malware payload", "value": "2dd77e44de67168e5c66ddb21eaef675580f814c89401c8240c7b93a86ebd3f0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682349061, "uuid": "33124356-ecf3-4083-98a3-56cb717a4775", "comment": "Malware payload", "value": "0ddc8c85623189c72ff7b927ca3bc350ba65799d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682349061, "uuid": "a9fd83cb-e2b1-46b4-a420-b546c75d4bd1", "comment": "Malware payload", "value": "86b157ed837cbabe3f2bbdddbf37e04f104c0c810caf049c078da3126499e172e50f55ff7ec525641bc6fb2dafdefad2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682349061, "uuid": "0e62af8a-1119-4231-b91a-69aed5e8c2f6", "value": "T12E641E51A3FE5108FAFB3F50ADB416644E7ABCAAADB9E25C1240515E8A72F40DC70733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682349061, "uuid": "535587b9-7762-4411-adaa-e35e46758a18", "value": "3072:xw1xBzbH5Rq4Cyez4fhmm0cx0M8BILf398F2My8omqD/SGgqzI87DFMQjOGfYXcT:O0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682349061, "uuid": "4c3d71a4-32a1-4767-926b-8bfcaa70cd56", "value": 306630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682349061, "uuid": "379cc0f5-2e17-4a11-87e5-ef9218acf2d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682349061, "uuid": "ca48c344-4748-4b76-9a58-3b7cbbae20f7", "value": "Notice_24_apr_3872856.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b472b3-e24d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682305704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682305704, "uuid": "5f0a4b15-a4a4-4369-9f20-4dcc7a985cfb", "comment": "Malware payload", "value": "1ceb2dd52ff1625e06790d11dda47871", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682305704, "uuid": "3e29aad0-7223-4e4a-8e81-b49f62079086", "comment": "Malware payload", "value": "2e0e484a6cece64e553b8d33414624fc902821525426ca133afaff4097eb2f01", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682305704, "uuid": "cd8181c4-7057-48b9-8be0-a715629b26aa", "comment": "Malware payload", "value": "a6fdd6c7c53f3056dbbffa8f647989364ef5049e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682305704, "uuid": "987216f0-0d35-4480-9692-e4593e080549", "comment": "Malware payload", "value": "18715f6f255a4f23d4950c1739fa076bfb624de2b67ce0542b5b2fa4de1f0f621848407a55b2a985d3c35bb9c3fb520a", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682305704, "uuid": "6e652cd7-5482-4bea-8637-7c88c22d97d5", "value": "T11A9501BAE906AD35CFA3A53C21EC71E1C4489503B02B7D9A2BE87F5E8547C6B436814D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682305704, "uuid": "b00d738b-2eed-40f6-8d8a-9cd923163de0", "value": "49152:xOxUYOEmCkLxrdVkYV6TM81+c+tDaEcvtaaKH+lG:xOxUYOEmCkLxrA5f16DNcox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682305704, "uuid": "6c644f7f-0b54-4ef6-8b22-6fdab0b82763", "value": 1991888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682305704, "uuid": "7d540d58-c260-4292-a915-21ca361c0448", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682305704, "uuid": "60047e1e-3dd6-4606-924e-7713817af006", "value": "\u0410\u041a\u0417-\u042f\u043d\u0432\u0430\u0440\u044c 2023.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183ffd9e-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682333114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333114, "uuid": "c6b50928-9ff8-45cf-b07b-fbdd2aee1e26", "comment": "Malware payload (Loki)", "value": "f9ed7e30576dfd49d253086aa3287308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333114, "uuid": "26ba8803-5fe3-4772-8a31-5b9771961d0e", "comment": "Malware payload (Loki)", "value": "2ec8fccec63295e40a07ea20a39ac4c1e9f62ec0a738e303c3ebf9dedcfd6390", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333114, "uuid": "5f504aef-60a8-44ec-8ea8-6ffda36d90fa", "comment": "Malware payload (Loki)", "value": "3978a3cf01030ac54380bd9e7edbd54e3be13fc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333114, "uuid": "5b02bdc2-0b7a-44c6-b107-f7d20418fd9b", "comment": "Malware payload (Loki)", "value": "5e51b4e1e686644b0303e998bc9f9fa3b649d9e23898ca79903ac623d7998d157d4327a647f93821a59af3e5c63080ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333114, "uuid": "8c388129-258f-44ad-a986-b538b2abba77", "value": "T1EF542357A3596C3BDBD395F011FC332ECC3AAB505310DA07539A0EB7BE20B62660915A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333114, "uuid": "7a288fa7-ff49-4536-b0bb-15ae3d3a7f42", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333114, "uuid": "1e1855d6-d5c2-4c9c-a826-5df977d4d188", "value": "6144:Z92nj4aWVSUNrWq7GvurVAzGSYtFM41c+5yXpJsyYIR/NqMq:sj4Xt9qmRA6Sm5S+YXpJsyYIR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333114, "uuid": "7fce2ea0-de87-42df-8cdb-986c7920e312", "value": 302064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333114, "uuid": "546f86cd-e4ab-4ebe-8573-3ff6cbe8bc5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333114, "uuid": "31ffca27-a7ff-4d3e-8904-df630a9fb7e3", "value": "VERIFICACI\u00d3N DE CERTIFICADO 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce828d7-e284-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682329632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329632, "uuid": "0f7a85b1-b9f6-4ae9-8fbf-dea1f17ce6ed", "comment": "Malware payload (Mirai)", "value": "4a72a1440465e00911799a11361ff12c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329632, "uuid": "b4afc557-e01d-4c76-b71c-0e485d6dda31", "comment": "Malware payload (Mirai)", "value": "2ee3186c8d5cd69f0995042a3f1022f3ea4ef87437f8a084568e4b298c26479d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329632, "uuid": "be8a63bc-dc1b-4839-be64-1f1b1d558946", "comment": "Malware payload (Mirai)", "value": "6a1668fb2ec414b15aa027d66eb44a0cadaa0644", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329632, "uuid": "6a65a597-cecc-4aa4-9556-96c2d8c1aacc", "comment": "Malware payload (Mirai)", "value": "dbad02f4f3e3ba3b3ad066a730ade8e633263acab912841737fe510f10276883b0e47a1d1ff78866386d9f54f1869135", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329632, "uuid": "ff331887-1daf-43f7-a570-fad3447c6bdb", "value": "T173A48D94FA5E3D42D2C7E27EDE4987A2312B75F4C35292B27981022DE4D6DE8CFE2411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329632, "uuid": "13577fbb-ff7f-41cf-b1a7-79c6f22bfe71", "value": "6144:xqOJhlWkij6molICKHt1ClyOireloK65W8iPZN9YIPC3n+WgCDMNfywFL:QuOwKHbUyOKeyKsipYb3+nQMNfyw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682329632, "uuid": "48b1188c-b877-49d7-b2af-e7a5c88c085b", "value": 480952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682329632, "uuid": "daaa7039-0924-47a2-b15b-5d211e941307", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329632, "uuid": "a09b0206-e278-406a-9952-294dab742f7d", "value": "4a72a1440465e00911799a11361ff12c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cec7bf1-e261-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682314412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682314412, "uuid": "9ea7cd29-df27-4821-bb62-ad1635d29239", "comment": "Malware payload", "value": "39a73fe6e9c7b76e288e7914c550f2bd", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682314412, "uuid": "a17b4a07-5878-4495-afab-a93aab03c681", "comment": "Malware payload", "value": "2f1741cfe556fc66be36896332db01de459a27e15e89a50311797280b56874e4", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682314412, "uuid": "a5da80f3-54e3-4ced-ac5e-574e33c64fab", "comment": "Malware payload", "value": "112aa3fbfc18598057c872dcc560ff1d86f01321", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682314412, "uuid": "84fa6907-ce0e-4fb2-9b62-1e0923b5e62d", "comment": "Malware payload", "value": "502b27dffefe89b4bf2ba4df16089d94929a8a37376e26bc5f6f4179e1a729686704989abdf1c6799762e372284431fc", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682314412, "uuid": "5b96972e-deca-4077-8195-7a65e57d65af", "value": "T12DA1182BAA600DB402CF732D902FC49A2AF35B6369576CA7295F00DD8705E7184EDB3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682314412, "uuid": "a4a7b8c5-3c37-4b7a-a0e3-fe4b758edd97", "value": "96:eU7rC7Q5peyLp47e7k7c3787QXp/GCdYApvd:eU7G7Q5peyLp47e7k7c3787QXp/ldYA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682314412, "uuid": "33573467-88b7-4dc3-9489-17053473345d", "value": 4827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682314412, "uuid": "0d956632-6328-42d5-b236-293a82660056", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682314412, "uuid": "ec186920-cddd-4694-bc2e-acac8665bb5e", "value": "FacturaDeuda__557191.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c1fc46-e2ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682346592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346592, "uuid": "33f32f19-da89-4520-b927-7c5eeb49ce17", "comment": "Malware payload (Formbook)", "value": "eecb5ed628aa49f55850fce6c0d54f02", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346592, "uuid": "d7d70928-71b8-4018-84d5-fdeba533dcc1", "comment": "Malware payload (Formbook)", "value": "300500a190d25155cc8c4d880b4017c2ad4d339944091b5eee37be754a3e9251", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346592, "uuid": "726126ff-051a-4b66-ac0e-4c6c51dc6f4a", "comment": "Malware payload (Formbook)", "value": "a855c7bab5a62c5f0b7618ce95e2044c00bde39e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346592, "uuid": "610a732b-0b9c-4c7f-9de2-e587a31377b6", "comment": "Malware payload (Formbook)", "value": "66d91f177f8bc250a1ac865d7a8afb542f1912d94e53173c3e6f4114d56033e3c9d10517515aac606c1fb53f9f26209a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346592, "uuid": "faec60a3-e351-4999-9737-f41e34c26636", "value": "T1D9E25A59D78F02A4CF165277930A5A8942BCB27EF34541B130AC937433EEC3D826A6BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346592, "uuid": "ed04e6bf-c897-42e3-9358-91df2eaab07c", "value": "384:cL0AbZS/DVsA5p08oGfMuWKZB9FkDoMDcUXjG1yiZyjJNPcSdwzuIzMo99zE:cwAbZS/D55pToHuWKfoDoMBiIdiNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346592, "uuid": "886ca132-d6b0-48f7-a726-5ae93e5ca2bb", "value": 32098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346592, "uuid": "91c9cf10-e5aa-4449-a7ff-fe0f9f8c3951", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346592, "uuid": "aa492337-5ea9-4e85-b592-73c16d60c103", "value": "MMT PaymentWire Confirmation.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c72123-e2d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682362831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682362831, "uuid": "79507bf3-132d-4062-90e1-e57045ee894a", "comment": "Malware payload", "value": "4053f1c3a147c3180f5eeee223e12c75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682362831, "uuid": "489761fd-ee07-49c2-a01a-b0e2d4951b33", "comment": "Malware payload", "value": "30659ba72c4977c6017c45a45909442417c5bc07e7f3a2392b352d29494cb226", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682362831, "uuid": "b8ce9369-0fbd-40b9-9fce-2c21b1b183af", "comment": "Malware payload", "value": "85a9cc3298461e1b218e8e2a84c19bf24f3ef096", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682362831, "uuid": "87fe5acd-36b6-4b2f-b211-92e9781394b3", "comment": "Malware payload", "value": "4ccb5e669d4a21f0e29d19cf9761a2b9ea5f9787848cbb4d06d13ad19115b4a0f2aabea0d0aa6089af72e07247b8687d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682362831, "uuid": "dc7c7b2e-e97a-46af-8b1f-233bcc253713", "value": "T14CF23B487FD4832ACAFE2BF529B2651502B4D503EA13D75E18D895AA7F37BC08D013E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682362831, "uuid": "d90aa61f-3f3b-45a4-aac9-4f5855f51e77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682362831, "uuid": "b73b0e89-6704-4572-ac06-5b28f0ce3bd2", "value": "768:/rAKdijXMwX1eJGl8y0UaKt4qlYU/kZl+Bcg4tlTF592hO9hASURS:/UjXMwX1eJGl8y0UbTuUsZcB54HF592E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682362831, "uuid": "a336a0cf-fe0b-4686-b983-e01ce7fa1aec", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682362831, "uuid": "fd8ca638-f7cb-4a16-812d-74b52016397b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682362831, "uuid": "beda96e0-3b22-4f63-bbb9-2ad9d0b6cd92", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd710d8-e297-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682337418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337418, "uuid": "38687149-dba4-400e-ace7-ca37ca885cfd", "comment": "Malware payload", "value": "d227398a27d9f1b942fc4b604a84017a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337418, "uuid": "1bb37936-bd77-4dd2-8362-897263fb87b7", "comment": "Malware payload", "value": "30779b8f03f69ef91617edea13410072e04f83e030dd941862563784454d8911", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337418, "uuid": "c48dd2df-c406-4c5b-88ed-dc990197481f", "comment": "Malware payload", "value": "a6d77e63df27912153bf329c5bfaaf895c96d734", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337418, "uuid": "cc8d1739-a287-4159-a00e-e28284f9a14d", "comment": "Malware payload", "value": "86e0a4cd784d6197f923fad7318eab0a28bc54e8e86a436e0d331e1f31dd98dcbe453319d83da4045a3059c5947e88a3", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337418, "uuid": "3eeeefd4-41a4-447d-9b80-1dcfd55edd16", "value": "T1C1E07D2F72AD3606C17C94E0D8D862C5B426D54EAE8A7DC122DB27365D0A36C56D7C2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337418, "uuid": "2473ab4b-14fc-4549-b245-bdfb27c4ac24", "value": "6:Q0eoLftLYVJ2/CxVDGGIOyYn7G8GSLh8uWfBNuatc18fQ98GLg+XSc7w9:QwZYVJ22Vyk7G8pGuYBNPtcAQ98QF37u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682337418, "uuid": "4ed739f2-9dc8-4d1b-b569-c89bb48c2e35", "value": 325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682337418, "uuid": "9cc2d1ba-1f93-4510-9376-3ad2fd298b98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337418, "uuid": "2c951926-574a-4790-8335-4ea67c46e149", "value": "RevisedXorder.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "395d8560-e2b5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682350349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682350349, "uuid": "2d41aa71-3931-4f9a-8690-9201ea29737e", "comment": "Malware payload (Formbook)", "value": "cc2de3574d37bdd8dc01d94e26c6b80e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682350349, "uuid": "d9d780c0-75b0-433f-b4c7-98d612fe1796", "comment": "Malware payload (Formbook)", "value": "319ed15753e7ce1ff182e1bd2e4900de9c76300f30cb645c01b57324de50face", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682350349, "uuid": "10bf75fc-9c82-45e5-a349-a6dd3ae62cb4", "comment": "Malware payload (Formbook)", "value": "940e2dc45395bd32b3b3feb2385a375478924cc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682350349, "uuid": "7b2c311e-c372-4d79-bb4d-c81710d4b478", "comment": "Malware payload (Formbook)", "value": "8600ea9f71a8117694845061792707be112b54a2bc977116ae1cbfd1ddea93bd4140291624a822a90fcbb7b47fd17fac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682350349, "uuid": "d93fb22b-b03d-4e3d-b0e2-3ba93084b964", "value": "T1FAE4BF1B216AD9B6D15E66B3D0D517FB0F2C2ECAED79A0435BA87DD831723B90F48402", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682350349, "uuid": "094cbc85-744a-418c-bb3b-acd869b7bbbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682350349, "uuid": "2bc0507f-e31c-4610-8da9-2fdec704894a", "value": "12288:uF9NCviMjBCj620DFvG1S/TP+52mectA42tuLV14eKnDD2ti:unN6bBCj6rDFvJ/TjUtA42tuLcBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682350349, "uuid": "2e621dbd-003c-4b52-9c2d-f3c5898e08ef", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682350349, "uuid": "97c1e68a-84bc-44a7-a354-0d2939dadabb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682350349, "uuid": "8a9138bd-98f6-44eb-801c-08766a41b8cd", "value": "RE,RE,RE,RE,RE,RE,RE; Best offer and ETD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebb9c18-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330172, "uuid": "1e46e8a1-060b-4f96-90c9-99b3fbf46083", "comment": "Malware payload", "value": "2cee103bad4f9fda79bdc93f2178dadc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330172, "uuid": "58eb9046-8885-4f5a-abff-5a5770d3a274", "comment": "Malware payload", "value": "31c425510fe7f353002b7eb9d101408dde0065b160b089095a2178d1904f3434", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330172, "uuid": "86729d4b-9710-4d58-bf5b-0025047083b7", "comment": "Malware payload", "value": "b471aab5b59b80ac964fefcc1ad630bbddf6fbc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330172, "uuid": "ea9bf36a-f7ce-4763-a1c2-1cf7f7ec7cdf", "comment": "Malware payload", "value": "93c793830134ff6fb9a4e32a325a5a7d1186d3025d92a0a9a5deeac3e8794dafd7c5048b01bb05aeafa8f790ceb98c3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330172, "uuid": "3808ebde-8201-43f8-987b-45c1c0776ce0", "value": "T16636D07E70E5DABDC20D9436C09B9A30E132F09A1933C76B9D91C664BF4F8610E7E694", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330172, "uuid": "337d3e27-ebaa-4ec0-895e-de85d294209e", "value": "500322c0645738ca4a802cc46aed20aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330172, "uuid": "40b59dff-fc4f-4d89-9f78-55d420823b56", "value": "98304:C3R5EGW/KBUUiTaYyaCtroadLMk/J4VGbTBfUjNGIc+aqa:I5lQKB/im/XtrPmU396NGQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330172, "uuid": "c3785f6e-6b48-46af-a509-61ddca310a5b", "value": 5240208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330172, "uuid": "d53c4632-bd69-476d-aeaf-578638bc2cf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330172, "uuid": "a33ae4cd-58e3-495c-a4cf-4d7a104ac6d5", "value": "31c425510fe7f353002b7eb9d101408dde0065b160b089095a2178d1904f3434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa882271-e27a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682325333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682325333, "uuid": "ccff3c8a-312d-4d8b-b690-9da97a7d4b4c", "comment": "Malware payload (AgentTesla)", "value": "b0ed55482b15a929fc48bbfe4fbb9633", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682325333, "uuid": "e25b6df7-1415-4222-a529-998491e4a4e7", "comment": "Malware payload (AgentTesla)", "value": "321cacca1d81268ded64db8dfe9325631165d5000d4d2966564f6c6f7fb383d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682325333, "uuid": "31d4cb06-0d23-409a-b6dd-713972d59281", "comment": "Malware payload (AgentTesla)", "value": "dee0ad62383cd7cb4404ce66658fa6b6d6a717e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682325333, "uuid": "6650a849-7e81-4dcc-9186-702f30d140f4", "comment": "Malware payload (AgentTesla)", "value": "bc37d641db723b4bbe6e9c0e93355a4820191f795eb7ba6e186ef9e7e3a5ffcad05202e52bd5406579c7b9ffa006122f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682325333, "uuid": "17431743-7bca-40d6-a294-f6bd6861fe6b", "value": "T10FE4BF1B222AD5B6D15E56B3D1E917FB0F2C2ECAEE7A90431B687DD831723BD1B08411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682325333, "uuid": "b0ed1f4c-7d2e-4011-a354-b3ff6714a035", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682325333, "uuid": "e21399c0-deaa-419b-9cf4-1321f30efae8", "value": "12288:P9mhg49MxeP1F5U/lJNZ01cyDMl5p9V4+vdfZv8QffEi:P4hgv1JZ0SB9Vxvf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682325333, "uuid": "256d5ac1-72b3-4b6b-b10b-f5d89286e8bb", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682325333, "uuid": "b6f99b0a-9feb-455d-a2bf-977b7ded4721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682325333, "uuid": "b041ca23-7c2c-43a1-a2b3-442e8c8a3257", "value": "Purchase Order No-6674 -290920.DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3daca817-e2c3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682356369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682356369, "uuid": "0e03c237-aa8b-4f00-abb2-bd7373a25096", "comment": "Malware payload", "value": "816f36d4015e085319b7d2a2218402dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682356369, "uuid": "0cdb4d98-eb7a-461b-8a39-d4877ee6d13d", "comment": "Malware payload", "value": "336624da3a0900617ef5198ac2f32063fd171ca5d3f71100992ad0b94a209d45", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682356369, "uuid": "86d13312-f889-499b-ab2a-e0027ddb5584", "comment": "Malware payload", "value": "d9a5e81b8811cb04c1671199cc3af6109bd93cc7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682356369, "uuid": "10d3aafe-45a2-46fb-9ea2-cbad2d468267", "comment": "Malware payload", "value": "d2ddfc1e5ad9acab19310fab0b227a0b90e1ec007fe23efc87a706fdce3e815d85d393e61e97bd915f88e86a89dea7d7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682356369, "uuid": "0bab9f7d-4ef1-4acf-bd31-3bcf2513e30b", "value": "T17DA01241631301418E81BCC8C9C48907502506447DC4659360C10D14C0015251199898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682356369, "uuid": "3d201270-4681-4209-a5f7-74a418846289", "value": "3:N8tEdsxH4N+DhzzOZQOTqt:2u6t4N+BWQuqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682356369, "uuid": "d7770d69-ec9e-4cc0-a669-bf2ce5bc24cd", "value": 79, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682356369, "uuid": "7aafca29-90d5-4e4c-8bdc-3bd65e79efa5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682356369, "uuid": "95ea0efe-5573-40e8-a61d-e141fbbeb503", "value": "ARQV.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b25b39-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303258, "uuid": "54a1b079-99ee-48a1-bc44-68d12b9263e5", "comment": "Malware payload", "value": "a4a15445b0bf8fe3d652a2ca63e7d202", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303258, "uuid": "2a3a7b66-ae59-4a4c-98f1-9c2a490006a8", "comment": "Malware payload", "value": "33c6038b4b571e511ae48b960a9ed78a2e18fc54ee9f956c93d1bade55e04e8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303258, "uuid": "cb12266d-f36b-4f21-ae5e-8686806ee295", "comment": "Malware payload", "value": "31ae5f0e5734cb33406a5039b503d048160c642b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303258, "uuid": "5e06e8cf-f4e7-4799-b30a-1779821c321e", "comment": "Malware payload", "value": "f4bca2331241eb6501799df314117d1a160480b9376d6533fcd1f2f5762e27d2ce9f3d0d14d0714d449512858f56188e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303258, "uuid": "d631de90-f109-4f87-9a67-128409e46cae", "value": "T148C302A88F44BB33DB934C35974ECAE2470C5BB290A55433AB958937D3487C8763668F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303258, "uuid": "a1072891-7862-4f50-a4ab-2b6bf85376dc", "value": "3072:7+7Xqj3kHLt0bGadRkCQDESXwUVlB7Pm9++hWnujfKI:YqjYGCadRiESXBnB7PcQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303258, "uuid": "e134702e-a944-4fb9-b0fd-0f7e2104a49c", "value": 119540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303258, "uuid": "f36133f3-0084-45ab-a092-f367c85fb330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303258, "uuid": "8262cbe1-dc28-47e8-b7d3-e546750aed16", "value": "SecuriteInfo.com.Trojan.Click3.13136.23853.6248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c0df7e-e2ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682346664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346664, "uuid": "30fd047d-d912-4ff4-b3d4-08fc571da4aa", "comment": "Malware payload (AgentTesla)", "value": "a38e29063cea938ecee440b50b83fa10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Galkbank", "colour": "#A6F130", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346664, "uuid": "6001685a-a5bf-4328-9f6f-24390a265d5c", "comment": "Malware payload (AgentTesla)", "value": "33d9fecb0ee6e90001575832175d001a0391a485e9669751c861afa20430f185", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Galkbank", "colour": "#A6F130", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346664, "uuid": "11cf4d1a-606f-464b-9e4a-c038cbdd6165", "comment": "Malware payload (AgentTesla)", "value": "33ad7a0e6230d5a6833809890733ed596a63bc83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Galkbank", "colour": "#A6F130", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346664, "uuid": "aa5e58f3-ac2e-49cd-8a09-7ab90e02c559", "comment": "Malware payload (AgentTesla)", "value": "487c63992c204fc6f5f012e63e53059bc566b13a57707cf331f07dedfb65b9a3df695da5370dce3a9228e4fb14d6fd5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Galkbank", "colour": "#A6F130", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346664, "uuid": "121b1724-05f9-455e-984f-e132082ccaee", "value": "T15364128997FCC0D3CC5245321C34F6AA1AAB990515689F0AAF10B6DC767B340E67F71E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346664, "uuid": "940180db-edc4-4b97-a26b-d6bf1cb13937", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346664, "uuid": "82197338-9dcb-462f-9d33-7e37e17c57b4", "value": "6144:pYa6ApUDSmb6FyJebNh+rs3fOc2+HIHjADSU0u9iyi9M0o0:pYGpUDSUeNg+WcBHwjA2U0oxiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346664, "uuid": "b75d093e-94de-4e00-955c-dadf6f886c1a", "value": 319556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346664, "uuid": "a3f7bca9-8549-4dee-915f-f17d5502b2cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346664, "uuid": "b54f0e11-92d7-457e-8bf6-da565fc5273e", "value": "Halkbank_Ekstre_20191102_073809_405251-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f748f2-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682323128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323128, "uuid": "7dc02d06-b0e3-4ac9-8d71-7fe729f7f5a7", "comment": "Malware payload (AgentTesla)", "value": "55a4b1839408ca24880d72641c323123", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323128, "uuid": "0ea7a3b0-e652-4b1a-a5a1-c03f6f673f4e", "comment": "Malware payload (AgentTesla)", "value": "33eed90ee9d7f5e5dde26e930f424fc0a6a78b9f99a67837ef0be5a0b3945106", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323128, "uuid": "bf6a2bc1-9641-4106-9f54-016fe88cbdd9", "comment": "Malware payload (AgentTesla)", "value": "02067283b2339edf44ca02794301b29eb529eb25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323128, "uuid": "a7cade7f-29c0-4c25-89cf-28adc0a9d358", "comment": "Malware payload (AgentTesla)", "value": "ddf431577ca5f1e53ffa683cb085704d7e47776e4bbf2f08d4ac0cc27cef50ff7d307f22114f31676422f5ddb7b7511e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323128, "uuid": "e04c1d0f-a53a-4862-ae9a-3cb7756a7e23", "value": "T1AFF34A6892895ED1D32C8174D8B01358CBB2D1469217EB9D0EA1ACF63B767D3723F863", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323128, "uuid": "f076ec1e-a06d-4f7e-b924-1bf91d53977b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323128, "uuid": "b06eaa4a-4918-4e13-bdbc-5cd681d3068e", "value": "3072:pVzltCOCI1BT37lsWe76NxUfjznGkeuQ3k+h3cn:bHNraW9r2zFjovhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323128, "uuid": "73691514-1d0e-430b-a07e-9a2e4ad7f3db", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323128, "uuid": "7ef3ac61-d8b2-4645-a25a-22ebfc4d8a91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323128, "uuid": "2ecf0cec-641e-4805-a4a6-4eafe3d3b132", "value": "33eed90ee9d7f5e5dde26e930f424fc0a6a78b9f99a67837ef0be5a0b3945106", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fbb3a4-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682333209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333209, "uuid": "d3ec2104-ff88-4aac-94fa-bd56afb6136a", "comment": "Malware payload (SnakeKeylogger)", "value": "8db88c72b6b9a3568891d94fe9106ed9", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333209, "uuid": "fb09c89d-4181-4da6-ac6b-256b5b08fe65", "comment": "Malware payload (SnakeKeylogger)", "value": "346be1040b8a3c7f73235c9becda5154c2d0235660a2869c893386fd4f47d322", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333209, "uuid": "1b7d9dac-fef0-4752-8191-5d93af5b02a0", "comment": "Malware payload (SnakeKeylogger)", "value": "3b1fde22a3b886bd8ca819b14d37f26f5356d0f2", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333209, "uuid": "80adcf42-d911-4382-ac4f-63678395e75a", "comment": "Malware payload (SnakeKeylogger)", "value": "4516357f9ce481588c7aa2ad50210144e1afb1dcf511e71c398c81c4da2b68cf75ed7f8ca38b0dcdf57132d96c9af887", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333209, "uuid": "c8073944-def1-48d8-a9af-aaaad0bda9c1", "value": "T174A433A422FDAE632A7B6CDDD352CC58F5614ABC2BCC96B4DC074B4610B8C7F6522385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333209, "uuid": "923fbaa2-2352-4d0e-b9c5-71381f363403", "value": "12288:H8TvRNBoL9uY1MZnKNWwGFfsEJbjOE9csGoL:H8hoJ+1ffsUbSSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333209, "uuid": "7ef56ce0-3055-42bc-b8b4-534c4481811d", "value": 482916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333209, "uuid": "13a25c31-5f09-4b1f-8f87-2cbf7d343dee", "value": "application/x-xz", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333209, "uuid": "6af561ad-65e8-4d95-b6eb-8285220af45d", "value": "Payment-Advice-MT103.tar_1.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d007ea5d-e2ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682346307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346307, "uuid": "3bab82a7-1d83-4e1a-9656-b90d62404cf7", "comment": "Malware payload (Mirai)", "value": "3dd6d68745e77d1001837f17cb9718f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346307, "uuid": "5658bfc2-9dc1-454f-b850-f029b12a3e49", "comment": "Malware payload (Mirai)", "value": "35412304e0d5eafe8325ed877d8018f265f3e9fceeb93efde608cbbea06de53b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346307, "uuid": "e5fda219-291f-4138-ae52-23e23437eb84", "comment": "Malware payload (Mirai)", "value": "b410ff2b5efd78705f0e5a9d8bdb0ba7420032cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346307, "uuid": "25830901-a2ce-41c1-be73-5b72f3d4e914", "comment": "Malware payload (Mirai)", "value": "d53a6d815fa2b738d95dfa5f3d25ee109fd2ee0344f4982b040c900b969be7b977d455e0da8b7b276313f3b477f039a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346307, "uuid": "d1f55791-0d99-48f3-a8a0-a1cdd13a0003", "value": "T188D34D05E7404B47C5E227BAFACB434933239B54A3DB33169928ABF43FC279D4E62516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346307, "uuid": "3a51c845-c14c-4bac-88e1-2e608e9238bc", "value": "3072:p06H4/XZay6Y0gv2SdGd7XHQe6qy0SM/9UJmHws2JsV:YPZay6Y0a2SIwe6qyxM/9UJmHwswsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346307, "uuid": "c57c146f-efa1-4553-a334-d95df8a6d1fd", "value": 137190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346307, "uuid": "63ebbba1-22a6-487b-9249-30de4f5c2914", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346307, "uuid": "3992fc1d-7ab9-4b21-b34a-363f1fc06cda", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03209c25-e270-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682320623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320623, "uuid": "6ce64e5d-bdda-4fcd-9f0d-810f9fb55423", "comment": "Malware payload (Mirai)", "value": "bccee154c4b608a22c2fa9d2e16ce8e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320623, "uuid": "09b55f4e-1094-4de7-b9f6-84a9bb3240f1", "comment": "Malware payload (Mirai)", "value": "35940fb88c226ca20042525533bad8c0095b521e64f614ef53ca09cc5d6091ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320623, "uuid": "5dbc9ddb-6235-441c-9d13-c32a84f718b2", "comment": "Malware payload (Mirai)", "value": "17eaf4cb8e38df3f45241dacfa0f753893c87da0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320623, "uuid": "8b427e32-d5c0-4f3d-be51-91500520de7d", "comment": "Malware payload (Mirai)", "value": "9ee10b675b3155d92063df8e6dc14624a093885b489d6a08e595c9f8e3e57486188a13481e13487fd5273dc341981a86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320623, "uuid": "5b42effe-9020-4e81-841d-3f47b53bb0d0", "value": "T160233A42322C0A47D5A65EB0393F0BE093FFE99020F4B688665F9B468635F771586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320623, "uuid": "951caa49-15f4-4a54-84ea-98f86cd33d39", "value": "768:qbp1X8XL18/9+dbZVRwepJDfaZcpTnMiDDzjORHUKLXSwWt:4sXL18/9S7xEZmxq0OX/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682320623, "uuid": "f9878d97-4b33-4715-b5c9-dfa6b1799670", "value": 48364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682320623, "uuid": "5f760737-fd11-46a0-8690-590f7caa84e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320623, "uuid": "bd41b533-60dc-4027-af73-6ad1e0ad69a4", "value": "bccee154c4b608a22c2fa9d2e16ce8e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c2cd37-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BluStealer)", "timestamp": 1682323129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323129, "uuid": "39c680af-9452-4a7a-9873-0ccbb3e8848c", "comment": "Malware payload (BluStealer)", "value": "6b5440ea657619e7301f3e923654cb3c", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323129, "uuid": "2fba17a0-d4c9-42be-ab69-c5fcace99283", "comment": "Malware payload (BluStealer)", "value": "35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323129, "uuid": "7d05795a-2ad4-4c9a-92e5-a00b90f74759", "comment": "Malware payload (BluStealer)", "value": "1fbafb550989c2c944d3941545b68bd553175704", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323129, "uuid": "585de7a4-20de-4c6a-b4f6-533f83d50514", "comment": "Malware payload (BluStealer)", "value": "d268e93358bcf6c1b2089e51d1d4710cba6c920ad55cb166866688a525b74faedf0cae26622d91710e7bd9969dbd6165", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323129, "uuid": "5af8f3a8-8523-4b1d-8a7b-4e6670fe41ba", "value": "T1DD252209AF66F225D1204F3816B7932441D4FF316FA31E1BBB48AA4AE636E47D1B5307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323129, "uuid": "437cbe16-c92b-46d8-ab3c-503249496745", "value": "df8fbcbe90e1e305a660f0ac2aa4fae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323129, "uuid": "504f43ee-4644-4107-a356-1bb98384888f", "value": "24576:wxgsRftD0C2nKGe0Djsf9nz4mloFQnpXUMPQDR6q79dA:waSftDnGpDYf5zaCpXxPuR6E9dA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323129, "uuid": "e6fc9e81-002e-43b9-8910-cf8d93489de4", "value": 1020416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323129, "uuid": "a2b517d5-8885-49bb-83cf-b90364bc9def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323129, "uuid": "11b2b4d8-9270-404e-9934-5657ff8d7402", "value": "35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97f77e5-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682323130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323130, "uuid": "922df13a-8f92-4a57-9492-1d7be1d14052", "comment": "Malware payload (Formbook)", "value": "6b47d660e4384693d87bfd4427de72a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323130, "uuid": "c277db9d-23b1-4f9f-a76d-1578eb1629b3", "comment": "Malware payload (Formbook)", "value": "35e8f730fa386dfecfb616ff20246d9eec1d6ec4d2b18f9d2e0d53032bff6b7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323130, "uuid": "d2403793-8434-4a5a-95cc-3b47def959ec", "comment": "Malware payload (Formbook)", "value": "9641eaa0152e26184c6325e08dc618c869b99f75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323130, "uuid": "a6559409-6e51-4c77-bba3-3ccec15378ff", "comment": "Malware payload (Formbook)", "value": "cf1b5f4540fdef0b233823fc77330f964442d4595ce24750dc3c6f7431e5e0ff874e68c7181e9cee6a171d728b69cb42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323130, "uuid": "eaa42e9f-159e-4c50-8f2e-16a9855ac42c", "value": "T17304AE32DA42C431F2B252B5B2BD1B7B883D0E353295A4E9A3F115E06EA19D5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323130, "uuid": "438fe879-5043-4097-b468-d1963027b5a2", "value": "3072:+GcUkxSHP3Er83AYT8NGSYW67Oyc3pITU+ucNRPvCwlUKw:KysyAq6x6Kyc5UucNRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323130, "uuid": "47eb9400-b081-4ebe-b41b-a9b46f872cbb", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323130, "uuid": "a7e93b2e-0093-4974-9f4a-e4af88e5f747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323130, "uuid": "254026dc-f617-4148-b32e-2a79ebe3c636", "value": "35e8f730fa386dfecfb616ff20246d9eec1d6ec4d2b18f9d2e0d53032bff6b7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f1121c-e29f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1682341027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341027, "uuid": "54e47c99-34c5-43b0-bc02-72bcd3c9e2bb", "comment": "Malware payload (Quakbot)", "value": "e1031ce77dde7a368159a9dd0ed7e6d4", "object_relation": "md5", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341027, "uuid": "7b990f3c-8e8c-4918-91f9-8db4d4d4d8c5", "comment": "Malware payload (Quakbot)", "value": "35fb99c59c455149681bf4f4ee45db416d45488a7451ac353b0758ab5793d0dc", "object_relation": "sha256", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341027, "uuid": "ffd52feb-2fa5-4506-868e-2c983044223a", "comment": "Malware payload (Quakbot)", "value": "916b6d3ce889af580ede3042312b2b3b90b22ba7", "object_relation": "sha1", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341027, "uuid": "6ca77cc2-8e99-46c5-bd1b-5f450808914c", "comment": "Malware payload (Quakbot)", "value": "c5e18f718b18ee64d5cc29ca4a3b4eb5d2630d7d0f9ced08e820b0a3dd230e27e9cba97b233dc7ccfbd951d13cd7cde4", "object_relation": "sha3-384", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341027, "uuid": "3287ce3e-38aa-4918-9833-f19318a8a8c6", "value": "T139A29EF70B80359149B79A70DC7E6966FC26AE960AD236AC7D0C28018B71F31D7C58DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341027, "uuid": "bc9353a6-da4c-4e52-8468-d9dbe3acdc85", "value": "384:gsJQpJjMUUXzrY0wH/8tq5Pr056H46ftfQHYk3OD1uz9p3A76yt+CHz3:jQpJjMUY9rEYSFf0DpuWy+CT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682341027, "uuid": "a197cc51-ff50-4eb1-bea4-84c26300d4c7", "value": 23153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682341027, "uuid": "b6f71e39-5aba-4d39-b9bf-cbbdf73ec486", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341027, "uuid": "9357e8b2-8b49-4091-98a2-d86dc0822190", "value": "file_deleter.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274ed81a-e298-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682337864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337864, "uuid": "28d54209-61c3-4fd9-8fff-476bcf19b455", "comment": "Malware payload (Loki)", "value": "4806957354e089c4da42ebda7862c752", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337864, "uuid": "1a705c4a-a0a3-4a88-9439-9b9f7435faf5", "comment": "Malware payload (Loki)", "value": "360a617397430c068576949b306bdae63d17bc510a5bdcfd25f7768e3e61ea80", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337864, "uuid": "4a7e7db4-bc29-4c02-ae6e-7fc77f03c78b", "comment": "Malware payload (Loki)", "value": "a1ffce61e8a13b4b241ad83c50973dcd97f47e0e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337864, "uuid": "c8a9bc27-65f4-435f-973f-395ad9633269", "comment": "Malware payload (Loki)", "value": "019a4d9916577fe3e9b345281817ea99064d22422f2eedc7c307cad9e4e075511a40ec285ad40c2ed4c941f1d185d831", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337864, "uuid": "5559f598-249e-4038-9831-d2a6b24f3720", "value": "T189041376C47510D67CECA2F44B6EDBA6458C7C22EEA033247E4212BFA54C4877B9ED11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337864, "uuid": "b0505201-da88-470f-91c7-b3a71b383845", "value": "3072:tpOz8IaLBWFuLPkd0loKXTp5do4N8eQJcnEhkLpGC5Q5cGZ351bY77:tpU8PLMFSPo0lo4pl8eQKnEhnpr1fbq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682337864, "uuid": "3beaca86-6fdb-4335-97de-f6381340d4a7", "value": 178339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682337864, "uuid": "69d0c41d-7725-4692-8e48-79b7c63466fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337864, "uuid": "aa54cd8e-0f05-41ba-bd13-87ab5909390a", "value": "enquiry-BIOMED.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f519b3f-e29c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682339729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339729, "uuid": "fd7a5f4f-de77-421e-902e-b37b2a0b3b6b", "comment": "Malware payload (AgentTesla)", "value": "a69894ee9f0dfac79438e32438765751", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339729, "uuid": "7b2e2a82-174a-42cf-9eac-99ed4514ac05", "comment": "Malware payload (AgentTesla)", "value": "37d331f486ea8b68c0bcff94043e0ada27d3befe60482e0a68688504997cf819", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339729, "uuid": "675bd50c-36c5-458d-8314-8f3806c188a2", "comment": "Malware payload (AgentTesla)", "value": "a1a03c43ecf1e9b50e73b4692581a06cd3bf3f01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339729, "uuid": "fe25831f-d028-4f2c-b862-0a658517ac7a", "comment": "Malware payload (AgentTesla)", "value": "5cba3943dbabeeee1ecb128b228914496e085254bd8bdba0f6b996f26cf93a36f897543f84cbf844e68fe611835bf321", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339729, "uuid": "35e54424-c6fe-4b00-a746-910d66013d36", "value": "T1E444F0457B938212CD0919B5D0D7003613F1E78B2673C69E7A8902E54F637EBBB86B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339729, "uuid": "43e2cd35-96b3-432d-9538-67c280624f48", "value": "6144:K+Gho8mj2HXCXwlexOcy2nfNBPaFjxc4fBQ1CHiO2n4:XZ8hHXqwR2fN8bQ1xO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682339729, "uuid": "52a3b6e1-ccde-4fd8-8291-79957d4a34f1", "value": 267848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682339729, "uuid": "fcc08116-0e09-4e79-b873-2f77bdca4eae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339729, "uuid": "7125c6e9-b8a6-4e80-8033-a141b6c3ce86", "value": "CIF--B-62329O21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b40398-e2ce-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682361005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682361005, "uuid": "19577ac3-c03e-43d5-a1d1-10b7977ca037", "comment": "Malware payload (Mirai)", "value": "a556ec9ab535eb26710ebc44bf389a59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682361005, "uuid": "0d885d78-6794-4dcd-8e03-a073ccf27c4c", "comment": "Malware payload (Mirai)", "value": "37dd49852d6ffdb5e674eb449954a2b0e05cf465f30f55866a768555462117a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682361005, "uuid": "a082a842-5e14-4df5-9561-b59f7fa861a1", "comment": "Malware payload (Mirai)", "value": "cacc70eaac16a474b6f3449fb944802c99bea209", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682361005, "uuid": "eeb4f618-a2ea-499a-bfa4-343602c14deb", "comment": "Malware payload (Mirai)", "value": "48f126cd39ef6976af2939811fb5a8783c9c0c8caaa35f14255634748b2385f81940f1f4f4d5e6fc45899fe6127f60bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682361005, "uuid": "5bd99bec-6f8a-4c5d-929c-bfb37becc202", "value": "T1AD93A73A7E11BFFEE15886304BF35FB083D561A226919385F26CDA486F7128C1C9E794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682361005, "uuid": "834debb6-82ec-4d8a-8586-fa328809b3b7", "value": "1536:J7o4n6b4T/wi1uMnThBzf5q89EGA/rdQT3d6I2H1E9Ct2rHG6pnJjjy/ssShx//A:VoaCmUssmwyuhVKUhr287jL6/nDlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682361005, "uuid": "d03f23a2-be62-4658-9f7c-2b279e80ad13", "value": 95106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682361005, "uuid": "3abb88c6-b6f6-471b-85de-22f19c32500a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682361005, "uuid": "495709e1-6d1f-4750-9747-08169426912d", "value": "SecuriteInfo.com.ELF.Mirai-AJJ.19015.27999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3f9989-e28e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682333716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333716, "uuid": "a28d6894-bbfb-4e86-b68e-15a9ecff79ec", "comment": "Malware payload", "value": "63454a5ff48783a9f526e2a5854cb100", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333716, "uuid": "4eb5a793-f6f4-4b4e-9a5a-037056fef9ea", "comment": "Malware payload", "value": "380978251b2c661ff15b2610763770dfa14fb360ad0ca64243e0d5d5893952cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333716, "uuid": "3b3c2578-cf52-4e70-a971-62dbf8bdc437", "comment": "Malware payload", "value": "8dfe5930c7a72acd4d9d4e22f6543f56d952f129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333716, "uuid": "e29e44fd-5ed3-4ca7-93b9-6f82242113b5", "comment": "Malware payload", "value": "a4710de92a1d3b45ec9be26799a8fd95d7ec8114dcefea7318c2c34296ab84e580074925109a2ca82c8f21fc19362609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333716, "uuid": "dc084178-8f7f-4c56-92b5-c1c6fa606ff8", "value": "T19136CF5F609097BEC20A9232C1FE5B34D53371A24467C72E5AC1E2F16A95D608F7EBB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333716, "uuid": "d5541aaa-38d0-4473-8716-c956824193d7", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333716, "uuid": "cff38cb5-26c0-40e1-a563-c4a439ed25a9", "value": "49152:PQ/hNQGEaNUdcZ3LZDcpb3rwNHPb+P0dTKUsu2kRMMkS0DhDItfUZqv90wqq5FcE:o/lemSZhmAqF0wqoco7G8y7yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333716, "uuid": "17cd65d9-0139-436b-b08e-dcba1f4f4099", "value": 5096920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333716, "uuid": "f2fc6cc7-84b9-4123-9b8b-6cf744b4391b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333716, "uuid": "7bb0ae2c-41c0-40af-806a-fef773a88144", "value": "380978251b2c661ff15b2610763770dfa14fb360ad0ca64243e0d5d5893952cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036ac2bc-e285-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682329643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329643, "uuid": "e9cea229-d68f-4987-b36b-edd406705d6e", "comment": "Malware payload (Mirai)", "value": "573cbd1e0461d0a647bbfb34d3bd69e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329643, "uuid": "571a7361-4ea6-4117-adf8-558661ba478e", "comment": "Malware payload (Mirai)", "value": "386cf51f6231efaa0a953d92d12d36b4dc670690b7e3a207ade928ed256f8537", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329643, "uuid": "4929946a-7283-49b9-875d-7e233ea2bc13", "comment": "Malware payload (Mirai)", "value": "ae320de29d70c1ecf13b9738e6e8c840e8b1f770", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329643, "uuid": "8187791a-45cb-415e-aae6-7a811e095710", "comment": "Malware payload (Mirai)", "value": "1eb7714ec3bf8df50bcdef112be5aa8ac4e76857875e39eb02d6e55f519a1b07241596190c6df03f55e346a204d2a25b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329643, "uuid": "f45a4ac7-e0b2-4297-a512-469abdff62a0", "value": "T194A3C515BF610FF7E8AFCC378AA81B0529CC551A21A93B767934D418F68B64F85E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329643, "uuid": "47496016-4c8b-4ac5-bdb1-916f6156c9ff", "value": "1536:5lDSpCgkICNjPR/5pd9bevvFawu3pZj+PybPcqCuZZ8xr7uQgg85BtK33IZ:5lDSpCgkIC5R/HcYDc4ZTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682329643, "uuid": "6a64e0f4-a84e-4e33-98c4-30554ab177fc", "value": 99564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682329643, "uuid": "f0e654f5-b142-483a-be3c-9cc54ffbf711", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329643, "uuid": "8f3da58c-80e0-4bbd-99bc-9ecfd9355464", "value": "573cbd1e0461d0a647bbfb34d3bd69e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec90aab-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1682330414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330414, "uuid": "fae7eda2-100b-4116-98ab-5321b662e11d", "comment": "Malware payload (AveMariaRAT)", "value": "0b5c131ce6f6ba1e86293ac0b16317b1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330414, "uuid": "d535cca4-03c7-4e0e-8542-2b679ed69f9b", "comment": "Malware payload (AveMariaRAT)", "value": "396346640d472168f07c041e8dfb3648050e2d36f16e93416cafc2354f3a857e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330414, "uuid": "604f53fa-a17f-4447-be45-171260b07480", "comment": "Malware payload (AveMariaRAT)", "value": "10b03b58dceedfd1c99f04200d9692ef846a8030", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330414, "uuid": "8ff19d9a-7f1e-48ae-b8d6-4543d36c2465", "comment": "Malware payload (AveMariaRAT)", "value": "b84fedffcdae06d394170f3671e4b2349ac781e06473b581c53a05644684e2e29c1c14491d7af4ff7d03d1dc6f52fa5d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330414, "uuid": "97957bd9-e0d6-4d5c-bf97-56aa05d7b794", "value": "T1AE35A71066A26074FCB22B74501D74F46A29BDA61B24A0CB7D4C77EBA631AFC1C72F1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330414, "uuid": "caef3953-a18b-4036-8629-fa3c026372d7", "value": "2f997d96f9e0d12fdac20c1f50c8b860", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330414, "uuid": "40d17ce4-bffd-4983-a29e-d0549f305c21", "value": "12288:aq+gtQtCm4yiiguuR3uq+CjCk8feoFgAXuRs2AB6T8H3+H+5CA2G:VIT4i0CkO5HXB6gX+H+57B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330414, "uuid": "005e5f26-d260-4445-8d18-2a4c2c8a7d26", "value": 1059840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330414, "uuid": "14a49b83-f3ee-406a-a266-787d7d6886d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330414, "uuid": "01a81a87-6bf5-4cbc-bea2-9757bbf2acf3", "value": "Scanned008907.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3a80a2-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682323131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323131, "uuid": "4f5bdbff-dc04-40ca-ace2-2a20af61fea0", "comment": "Malware payload (Formbook)", "value": "d13bcf6fb4705d60e1a6bde958894aa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323131, "uuid": "ad8481a9-8939-4f48-a387-f2fd06cbfd00", "comment": "Malware payload (Formbook)", "value": "3974774c9a5c65ce0bd9a1e8c3baa2f6a23f41ce3c0bb25bd1fc65833b869ff5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323131, "uuid": "6885884d-9656-4ab7-80b0-868284c292b2", "comment": "Malware payload (Formbook)", "value": "dca34ba89ce06b279479d260b9a5a5f6aafaa561", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323131, "uuid": "1ee7bb41-6190-472d-b8c6-6348682850b3", "comment": "Malware payload (Formbook)", "value": "1bb163abcd8fea88726d0a509459c5076a82c7ed9ed134b3356f96db7365ca3b9f895e46ea0801d6501e2f65ec9d8c9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323131, "uuid": "ace09a80-305e-4abf-92ef-ff937e602189", "value": "T107041299ECCAA88FFB05E63281540FFD68B0ADB14013D955A3BDA5E0934D4BDB5C220B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323131, "uuid": "7c079cba-0311-4ea5-8d1b-0a27785fe4db", "value": "3072:L5HBEa37mag5godrTsVQp2LpudG7z6BdY7sebtsMCeVYs5b8fBKTJhIZKoJlnZAp:LrVLm/xdrIvLV7eBd0feMzjqpgJqfjAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323131, "uuid": "909871f9-2a3d-415d-9f55-eeba7effc819", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323131, "uuid": "76b86bbf-6ab3-4bc1-91a9-884b1d2a5c08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323131, "uuid": "10364463-02cd-49fb-86a7-07b3f4af66fa", "value": "3974774c9a5c65ce0bd9a1e8c3baa2f6a23f41ce3c0bb25bd1fc65833b869ff5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5014f166-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682333208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333208, "uuid": "461917a8-fbf2-4120-9d87-61b7d9abb50d", "comment": "Malware payload (SnakeKeylogger)", "value": "789cf08b0ac59bc4b6999f888ebb7e7a", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333208, "uuid": "4374bfb3-a26d-4916-9926-e1d891e54d06", "comment": "Malware payload (SnakeKeylogger)", "value": "39e252f4ac027da393bdea5d1d503dd9a14e83b9f51e8fa35deead0d33cd75cd", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333208, "uuid": "0a24e082-68e5-4a2d-be36-53b55778ff07", "comment": "Malware payload (SnakeKeylogger)", "value": "d4db03c18ce655f67be53ac85d4e7cc2013b032e", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333208, "uuid": "ed6fcc33-4747-43d1-b6b3-93629e1a2bc5", "comment": "Malware payload (SnakeKeylogger)", "value": "f5c0586cfc8ce9764b38f95847b57207f0f5903575910e41b3e2072c2d6c260e3feaf14a7e8b75d54cce1c3180613e6e", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333208, "uuid": "6c1d7a64-bc50-4d85-9237-616a31076ac4", "value": "T12FD4AE2B222AD5B6D15E66B3D1E617FB0F6C2ECAEE7990530BA87DD4317237D1B08011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333208, "uuid": "f9cf5613-b38f-490d-af0c-1938de78d02f", "value": "6144:0CG2Er6p2WhX02OkF5efVEqmpxDZXYZPdntRxGwZn0RNW4cpkcPf5EJbP9BgFD9O:0yYTM6nKNW4GFf5EJblOh9csG3NXSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333208, "uuid": "d6865387-805a-4e95-94c3-361c69f5f5c3", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333208, "uuid": "5be74461-e848-4f73-b4e9-90ea9e06b321", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333208, "uuid": "9bde54f6-f823-4022-aed8-0ab1d2282276", "value": "Payment-Advice-MT103.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3f275f-e2b9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1682352369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352369, "uuid": "4703d380-19e4-4af2-8619-9ff2976b3ff9", "comment": "Malware payload (RaccoonStealer)", "value": "1e3f2807ba3de538288d7df74fc7930a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352369, "uuid": "55a5d165-2a94-4591-ab41-862a64014df3", "comment": "Malware payload (RaccoonStealer)", "value": "39f14cd5999264d9fb82867c81c002860794f2c4039dfaf34b9486cdf787e67f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352369, "uuid": "af0a17e0-9649-4af2-ba0d-bb5eae7a85a6", "comment": "Malware payload (RaccoonStealer)", "value": "91f6ea828a53ed52fe7266f60ce35d64131498ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352369, "uuid": "629f8e7d-e053-47df-bbcd-27640a88bd98", "comment": "Malware payload (RaccoonStealer)", "value": "8077588ef1aa3f6080ad65c6c513b0a1ad94cf4effbcee8492ba7dda2a9754007d6a4ff9e4dcf6a133fcc8f8380335f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352369, "uuid": "6bf9a036-f0c8-44e5-a195-e988f00cca93", "value": "T1587623633B5D4140E2E98E38A11B7DAC31F4EE168FC29C7D96E97EC816B3065E113693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352369, "uuid": "296fe4bc-0873-4e9f-91dd-af21fd6b93b2", "value": "3154a8c3e9de2e4b5b6aa20e912520a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352369, "uuid": "5687003f-8718-431a-8156-bf041301bab5", "value": "98304:3IyHTU5oeMtlB1jkE4xMRzzJMrn75pnzHHBJwoepEVtr2FXhO0zf9FGgSGq+Yt55:dU5Cn4E4xMFJQ75Fzn9+FXzf9FbdA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682352369, "uuid": "1d7681fe-7887-4004-964f-9f13336a3c7c", "value": 7186944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682352369, "uuid": "507ae4db-54b1-4277-b713-d42146d38a8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352369, "uuid": "468f88ce-5367-4f73-8390-d07cf44617ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67abb5fc-e2b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682348709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348709, "uuid": "f0170408-d9cd-4f27-82d0-167a84fea232", "comment": "Malware payload (Mirai)", "value": "a0df8c47d9800b7aa22e15fc7b86b297", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348709, "uuid": "e8074edb-b361-47bb-a6b4-caa7622ae3a3", "comment": "Malware payload (Mirai)", "value": "3bc75de28f1f35bff289ea073f133b6d57cedd4238c0322d8f7416d0c2c42115", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348709, "uuid": "c0162105-485b-453a-ae16-3f0cbd92abba", "comment": "Malware payload (Mirai)", "value": "024f0dacc83b0d887c9666502f10bc6145eda706", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348709, "uuid": "65d8a796-ffdc-496f-8031-202980f9a27c", "comment": "Malware payload (Mirai)", "value": "738e956d7cb6260d9f42445774cbec3ea6c7d7aa14f2a8642a076c053cc982ec943e92910363283a13d3ffeffdab6bd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348709, "uuid": "c4a3e28d-29e3-4a31-bcbe-d7a3f2e05cfa", "value": "T10193B61BBB218E77DC4ACD7306D64602208EA15A52E96F1BB2B4D96CF74B84F05F3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348709, "uuid": "6762157e-c14d-481d-950c-9e292adfcc29", "value": "1536:dJ6EzwQkLo6uNhg+xYecZIhJUQDDJ4Kp/+JFnBVKn8DuPpv7jL66AnDlG:ioXcaFj+/yn8k7jL6/nDlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682348709, "uuid": "fd0bfa46-6a2f-4695-b829-2bb8a78cc3a4", "value": 95170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682348709, "uuid": "a53cd768-14c9-4063-8f17-844f887c5054", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348709, "uuid": "e2bdbcf3-e05d-4785-a46f-1d81cad6460d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82512b7-e234-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682295157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295157, "uuid": "96a539b3-1efc-4e6e-85bd-747ada2f9feb", "comment": "Malware payload (RedLineStealer)", "value": "7ca685e8611d7bd7ef52bf3289e06681", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295157, "uuid": "281e74f8-ac34-4df9-afb1-f4f560035a46", "comment": "Malware payload (RedLineStealer)", "value": "3bd5d7b72ff14e9979654f3079edaa96a885d1c80e579b46049ad06f79532131", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295157, "uuid": "8bb75d0d-7c12-4688-86cd-577594fa6487", "comment": "Malware payload (RedLineStealer)", "value": "3bbc1c8e12ce1f8b576edf97feef855fdf4acac8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295157, "uuid": "dfcfe480-be39-435d-918f-e1a6fc832535", "comment": "Malware payload (RedLineStealer)", "value": "c4525ecfdf5bd817a064c8a7a814102439cf79b16ca9d4072c10b29a2ea45c8f2ba24e8acf1118e0b3dfee7d50fac3ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295157, "uuid": "a18e2a81-dd26-4e59-bae5-3226623b2c89", "value": "T11F25231397E95532C8B017704CFA16830736B9D2CD7582DF3B94AA9E4C736C4A936B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295157, "uuid": "90b23d92-bcb4-4ad6-9e7f-8422df758af5", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295157, "uuid": "316c626b-7054-408f-9de1-f95542ba0fd0", "value": "24576:9yIUoKIqvtu9ZCB3jDegJkwzI5fSZbUJgdP:YF2qFz3HeizI56dUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682295157, "uuid": "c70f6ba7-b25e-49d3-b149-8efc2d0e3903", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682295157, "uuid": "01717182-219e-4806-ad08-d848c8bf8446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295157, "uuid": "a708219a-1d7c-43f5-9398-15f302625106", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4520c258-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330183, "uuid": "3e62d396-c540-4dbe-ada3-89e03b7e3351", "comment": "Malware payload", "value": "131d2a54702047b63b564b857bb13e9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330183, "uuid": "a51f90be-ae8e-4df3-baf3-91cc56a52de8", "comment": "Malware payload", "value": "3c3622ab5f449166ad804ee73fde6aedf6934aa960701f7edefca9b5aedfffd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330183, "uuid": "31539ec1-85b8-417f-988a-8a6f92ab784c", "comment": "Malware payload", "value": "556996f16c421ebe9903cb7a64837c3e7cee8f27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330183, "uuid": "a6609f46-2adb-4b50-ba01-02f6c5686e49", "comment": "Malware payload", "value": "35d07f3577271ce805434ce5d0043bfa2183be2b5fbcb099caa992db31aed87939fb27fb37de0986b455a78edfc4b68e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330183, "uuid": "a7354fd4-afdd-4dee-a707-f2ec19cdd005", "value": "T1AC66CF6F91648EBCC20A6131D5BDB63499337D975132C67A97C9F6E22730CB08A6F720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330183, "uuid": "c67aa8fd-cf2b-4345-b3ed-d54fdfac7e8b", "value": "537d4e9c56af07c12b8d0e947bd45d56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330183, "uuid": "d2523811-817a-4775-89a2-aafa0ee0ceed", "value": "98304:1Siil2xGmrMHdOJArHghYyLkunmrQ9x1SKWCkkGi1J3Qvs:1Srl2xGZ9OJA0hYyojc1SKXJes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330183, "uuid": "f1d70bc9-8c3f-432f-8972-7df94fc73ae5", "value": 6686848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330183, "uuid": "4df16170-8c54-4af6-81c1-7b916c3f2e98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330183, "uuid": "8a940175-d2dd-4b3f-ac64-03adebc0e8da", "value": "3c3622ab5f449166ad804ee73fde6aedf6934aa960701f7edefca9b5aedfffd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5058bd23-e234-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682294983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294983, "uuid": "fe75f759-62e6-4a0b-b096-3e2545c22afa", "comment": "Malware payload (Amadey)", "value": "cd822e8b3839c8bedbf550c22d0e9c4d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294983, "uuid": "13a7d718-a970-4a04-891c-b68ad65126a8", "comment": "Malware payload (Amadey)", "value": "3c443d8d2bc6f9495bdbc759832a79edcc7485af42537b27f60891955a99f73c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294983, "uuid": "b1105ff2-4e59-4f02-b5ae-d5bf78477f81", "comment": "Malware payload (Amadey)", "value": "c4f22239513641903ad427c6fab6d4128cbf262d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294983, "uuid": "92e7bf6e-814d-4eee-af75-6426f6d73ba6", "comment": "Malware payload (Amadey)", "value": "42ddb0a641580fc3f36e890b1bf07334835b58ae5c3c36d0df48873e571ba1ecc63a97e6895f849c42b16d35800490a3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294983, "uuid": "1cb63acd-2a99-4ea3-ae93-90da80ffdbf1", "value": "T14835234AB9E59032D4B817F054F50B931F35BCD29BA083FA1309CDAE6CB359495327BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294983, "uuid": "0fb56d1a-ea00-4cf3-ae12-3677cf20685a", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294983, "uuid": "8bd27298-44a5-4831-9bbe-325790a309ae", "value": "24576:3ypIRkq4fFfCynUpmPcREfHOo7UG7w+e8VMEE:CpltfDnUAkWfuo7gsVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682294983, "uuid": "ab840a5f-fd92-43c6-9910-1f0abacc6d2b", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682294983, "uuid": "4d49c478-1d38-4039-b7ec-76a9d34e0885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294983, "uuid": "89fe5da2-e027-418a-8ada-a21a61c4e6a0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819d8ea7-e29f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1682341022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341022, "uuid": "3d1407fd-e3fc-4632-aca1-c2328149bac5", "comment": "Malware payload (Quakbot)", "value": "cb93c679ed14fe409df9a6cb564e488f", "object_relation": "md5", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341022, "uuid": "66577369-02d9-4695-999f-8badb1dfb24e", "comment": "Malware payload (Quakbot)", "value": "3c9aa9fc46d14bcd25da2bcae0a924b0840c6b067c889ba242f0840a9e72fbd3", "object_relation": "sha256", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341022, "uuid": "e2d2483c-ed84-4139-ac3e-43e1c5607dcc", "comment": "Malware payload (Quakbot)", "value": "8b715a33a606489d2c9ae8ea6dae03afecb5c056", "object_relation": "sha1", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341022, "uuid": "56bb5f62-2951-4734-b62e-b158e9498211", "comment": "Malware payload (Quakbot)", "value": "6b4f73f460f926257d56c6e27a38f7e554d5ceb38e0b4d15ea71bd6ec3ae1759cbc99454b8705ce78d34b8b321c6240d", "object_relation": "sha3-384", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341022, "uuid": "2322f77a-4e40-4873-91ad-c4753c00cf2e", "value": "T1AF93E78E92C217BCFA200058540E7B9097F45D74ADA2EBBCF48DC34933A1D64D9F95AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341022, "uuid": "93927ecf-7cd8-46f3-80a2-2bf848e39834", "value": "1536:9ZOKXo/FDInd4JuTGmzsw2LanxOXOSVV9E2fm:9ZOKXolInd4UTlzswk2slEEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682341022, "uuid": "5fab07fd-c0f0-4729-8748-b241b592f041", "value": 91465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682341022, "uuid": "b8dface5-e0aa-478b-bd9e-1d37da805d85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341022, "uuid": "d2b4154d-8cf3-4d1d-8d0d-e855d60f8aad", "value": "767278.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a3f29d-e234-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682294852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294852, "uuid": "5cf31559-2d84-4480-b98b-9c52bc9c0ebf", "comment": "Malware payload (RedLineStealer)", "value": "aee31d4991b649f5e37ab7a60c8dee5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294852, "uuid": "34097f7c-76ee-4237-8f8e-e3fdd521e1e9", "comment": "Malware payload (RedLineStealer)", "value": "3cefcdc7e3a7dc5ae6bdb28bce47c0fa1836b8a6fea0e03fef6639b8bcbe959c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294852, "uuid": "7fb2bfa2-f8f6-4b28-8ff9-6b9c64b5d9b1", "comment": "Malware payload (RedLineStealer)", "value": "15a88bcfbfe5340e132f4cf213cee868cea56c9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294852, "uuid": "f2ab1c4c-7ea0-48ee-bf8e-fb0199f2a39a", "comment": "Malware payload (RedLineStealer)", "value": "b86fb82caa9528a4615a17d12162ebc29670ca96f0eabf441cdda4298db16b443dddd763715d576a75aeea093400d0f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294852, "uuid": "065a280d-c5df-4e90-80e4-8eca01836762", "value": "T1C33523C7A6E584B3D490277158F78A530B7A7C5177F863CF12828EAE18726C46E32376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294852, "uuid": "066aceeb-ca45-4e88-b8c1-312b837b722d", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294852, "uuid": "2774934b-b69b-4180-9d06-1115fbe6d75d", "value": "24576:AyeIUQCPFzpzxBbqFZEfCMZ9Gi8GCFyIgGwtIBZocIVhV9c:He/dzpFJqFufDZ9aT0IvcI/SVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682294852, "uuid": "6c4e5d16-bd1b-4c13-bd31-8346d6815282", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682294852, "uuid": "8df5ee05-c7e9-4170-b32c-576d2dc6b8ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294852, "uuid": "fd03b02f-653c-4389-95cc-7ad5d79ecdb1", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab265d8-e2ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682345976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345976, "uuid": "2e10bbe6-26bf-4ec8-ae72-3005145c4adf", "comment": "Malware payload (SnakeKeylogger)", "value": "296f0264e89df8a1a78d110e5d8326d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345976, "uuid": "111fa327-a59d-4a16-8b34-f98df6fb5b50", "comment": "Malware payload (SnakeKeylogger)", "value": "3d73a129f1b19aed63491b61d5a1c7f50385b90eb7d6eb996b1fc56f5738ed17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345976, "uuid": "7c3d903e-f9a7-4724-b8f0-9bbcba4697a1", "comment": "Malware payload (SnakeKeylogger)", "value": "75b0ceda72c8bc7817df2502e2683aa66f397340", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345976, "uuid": "752381de-d2ef-42cd-97b1-836c86128bb9", "comment": "Malware payload (SnakeKeylogger)", "value": "da4e6bc7d8f3531ac24215287dd03a9beeb8a7c2b0f74d090991085b629f6c143b9e730e3728db2a438246cfc8084604", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345976, "uuid": "09f6facc-06c2-4c88-9d43-001437e40959", "value": "T1EDD4BE2B222AD5B5D14E56B3E0E517FB0F1D2ECAEE79A0430BA87DD432727B91F08411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345976, "uuid": "a6e21302-020a-4da0-86ed-bd964192de98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345976, "uuid": "addbb6a3-bdd7-48e3-a4e6-a3d8eec38c74", "value": "12288:3GFY5hjg+dbB87AmxXFNmNk24cfsnJiqSFxCUodHKfTVt1:3b9xG7NmNk24JhkxCUEqfxt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682345976, "uuid": "8a78c97d-a15f-48fa-a25e-20460504d1b5", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682345976, "uuid": "3959f0f7-3cbf-4155-b63b-0b8e06b20ce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345976, "uuid": "15cb755a-21fc-474b-b2c6-2581d7d89fb3", "value": "PO 000715FH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c20727d-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303217, "uuid": "244ccaf2-3595-4354-8f5d-ace7b5e4b058", "comment": "Malware payload", "value": "62895d3b3bbb9f7937ed1695e9f3b946", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303217, "uuid": "aae6bd42-737b-4c00-a8bf-f816f1495234", "comment": "Malware payload", "value": "3dab107fb6f05279139d2f8603f9f3adaf94c795bdab418ec42b919eedd674e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303217, "uuid": "b79aed93-3b1b-4d0e-b2cf-968adb93cff5", "comment": "Malware payload", "value": "86a23b4aa8b34068fdb0b17215e148526be44f4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303217, "uuid": "20eb1511-20ff-4875-9089-bf5b7df5b514", "comment": "Malware payload", "value": "039d9fa00d8ce939963b58b3e164a88c4f36fa6423b5df9384f70fb5ab41d3a11870b555fbcb4e19f570bab10e40fd90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303217, "uuid": "570a7f45-ac0f-4064-b3cb-9dc1dbb60a62", "value": "T1E8857D22F292D837D1632B34CD1B96D96A26BF201F2855877BF82D0C7F7A7413925293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303217, "uuid": "7eeb13c7-b833-4d0c-8e29-5c0ef950a554", "value": "24576:0N/AM9hT7A9kOxG3Fe89BFUsUNzSKhfRZC109TXwFAV5GfK8FCEJ7Jf6KlT/ro:ulhfAM3F5rwdkRfKSCEJ7JnRro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303217, "uuid": "ccbdccbd-004f-4d58-b3fb-dbcc9083cfa8", "value": 1827840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303217, "uuid": "6cc5f119-e1c5-4dd5-8a86-9b492cf66be5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303217, "uuid": "25cc702c-83ac-4276-a932-484c5d8d539f", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.22289.15321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4691ea15-e2b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682348653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348653, "uuid": "6de223b9-775e-4555-882e-314dcacf4168", "comment": "Malware payload (Mirai)", "value": "c75d49027b56da86ee5406e2c188d204", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348653, "uuid": "85de7448-5aa1-46b1-a6d5-8f34da51b7e2", "comment": "Malware payload (Mirai)", "value": "3e733b23c2a463c12de236e4dd2ec46722c76d2be0cc4b863af3458e74d5e52b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348653, "uuid": "b9bb814e-429a-4458-9a5a-7c1000536918", "comment": "Malware payload (Mirai)", "value": "08708430c5f2b5b898d82c25eabe5fb447b7ad57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348653, "uuid": "a6bee1aa-1bb6-4057-a3dd-1f1829c5d000", "comment": "Malware payload (Mirai)", "value": "e5fc6636561000587023b7b38b1fc910d739efd6bfd4e3a647a45ca9024e3855e6601bdb96f9f5baa84a731d3d58b07e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348653, "uuid": "0aadcb6e-d200-4bc7-bb7c-0e29e528090a", "value": "T1D1730B42E9414707C6D267FBF78F476C3B26A92997DB3301AE395DB02B8179C1E29221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348653, "uuid": "1f6a67bc-6447-4ed2-b460-1a9d456a01a8", "value": "1536:mWkJUCfXAJt4SASDs+idKpvC0es/qS0/p7eSFrREAKdMkCBs1TCrSDzrpQAHHnwq:mXMtsssYC0es/Y/cpQAnnwIOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682348653, "uuid": "9a09cdb1-9bc3-4ed8-ac53-008553bad4f8", "value": 80678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682348653, "uuid": "2a71322b-c240-4f6c-93aa-5213dd69d7ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348653, "uuid": "21cba21f-fdb3-42f1-9d58-a8c083a4b9c5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2bd395-e2ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1682346812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346812, "uuid": "07e05153-5128-4482-9d5a-721ef2c20af2", "comment": "Malware payload (Fabookie)", "value": "b573942c396811112008b8b594be39e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346812, "uuid": "eace9800-9787-493f-8881-2034b7b63a97", "comment": "Malware payload (Fabookie)", "value": "3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346812, "uuid": "3febb987-09a9-4d07-ad10-f25b0443d815", "comment": "Malware payload (Fabookie)", "value": "f862b5e3c4727cd9bf0606db85b38b9ffd27c13e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346812, "uuid": "9b1038f1-e7c3-4c61-a1e7-78f50fefb601", "comment": "Malware payload (Fabookie)", "value": "773cdf37e58ef8610b6cf7beafe57175dd8acf35bbe60843bf2bf27a3f11681919885924bcce20e79cf701e6559f9583", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346812, "uuid": "0c314e32-c027-464c-8103-203830fdaf1d", "value": "T14CF49E01B6A499B5D079C235CD53CBB69A703C605F108ADB7364FB1E2E333E2953AB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346812, "uuid": "a07200ae-6dd7-4e66-9261-e11d7d01250c", "value": "54a4a8876d1423c6fa95d6828708dd32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346812, "uuid": "790bcf46-659e-4698-a7dc-6496fd75b267", "value": "12288:CwtKLXYdOWi1IqB+leXEZCcD8pellpco/zENOeQiV1u:X+CW+lFrApeCoAYeXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346812, "uuid": "8cbbdeb9-6980-4819-8131-c6a553d34516", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346812, "uuid": "651c1e29-692b-4364-8ec8-4c6f9d60b659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346812, "uuid": "e3d7c115-ba0f-4b1e-a3cd-87ffaaa9a652", "value": "b573942c396811112008b8b594be39e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a14173-e237-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682296228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296228, "uuid": "a794225f-b69b-40a5-9e9c-5daa66b3c8d8", "comment": "Malware payload (Smoke Loader)", "value": "7c036e3c5dcf4d37f7f27dd3358ab6dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296228, "uuid": "a9b3b17e-460d-464e-9b18-d8f46b03ca4f", "comment": "Malware payload (Smoke Loader)", "value": "3eae7d0aa54b93f6bced1a04e05f88c6115a75c2223b41954e29a74983751f68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296228, "uuid": "c1b1ec9e-6dbc-45ec-878b-e2a0b994c9c2", "comment": "Malware payload (Smoke Loader)", "value": "2540c79d265d102e0a1619678de4ce37349d37f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296228, "uuid": "e8a7dab9-09d4-46fb-a3c6-7615d61de073", "comment": "Malware payload (Smoke Loader)", "value": "30419dfc6e5b7429c83bd9bc21ea59d39e399082f8ccfec4db28169baaa737808794892fd6b52571a83756dd756f33eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296228, "uuid": "c454c3c8-a1b2-4428-8163-faf439760d29", "value": "T1A934D1217AD0C8B2D74B80708864DAB4BA3DFC50879659BB33681F6F6D30EF1477A259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296228, "uuid": "9a7f04dc-9ba5-488b-b0fb-1cb5f60c4cb2", "value": "cbb199b85bd7e99e36eb212e7f14e32a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296228, "uuid": "50ea521b-f539-4b1b-9d0d-c7922b42ed30", "value": "3072:8th5buzUtMDL4+u4vbFoJLIqIQ6woSZo3BOAuW54qWt4:C/bLM/4HJcPQ1+3BJWVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682296228, "uuid": "9769ec3b-c582-4dd6-aeff-56933ff449d8", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682296228, "uuid": "a9119815-a1ec-476b-b42c-ad6287dd4d9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296228, "uuid": "4d4d868a-705b-468f-ba05-6eaa997f9057", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dced60d4-e233-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682294789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294789, "uuid": "edc3daeb-27bf-4f2b-bef9-4fd50bb632a8", "comment": "Malware payload (Amadey)", "value": "e283f0a5fec178b02236e23aadddf0df", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294789, "uuid": "84a65731-c5c6-4186-b704-fa1d9838b890", "comment": "Malware payload (Amadey)", "value": "3fb1a04e53e8d234ac94d8e9ea2281924c69df623d21eee29514d1a6ccaf95f0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294789, "uuid": "860c8473-763a-450c-b9b6-eef58c102aef", "comment": "Malware payload (Amadey)", "value": "15d05cb65663935cf1ae461a1f42c288b5941154", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294789, "uuid": "84c7d025-ad78-4d09-a6ba-a2e9c0a8e79f", "comment": "Malware payload (Amadey)", "value": "9d3851b0e3ee6a57730c6cdd26bb2de7a3b519e4eac07e6bc05d2888a961626b91bf73f0824e556ef86e20cf2fbc9b02", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294789, "uuid": "595e4b27-8e1a-4bcb-8abb-73df8a51b455", "value": "T10F152352A7E09071E9F527B458FA1383073ABCE017B597EF2366A94D8C724C4A6307B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294789, "uuid": "d229738e-b731-4b29-a249-030db6bd8774", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294789, "uuid": "718f3053-87dd-4f8c-8c1f-0d294bb87c6f", "value": "24576:nyaDIpJK/b2CGYv1yh9NGx/jPx5ozJ/A0yA/YlP6Ms:yaDDKC6W/Lx6zJohKRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682294789, "uuid": "6738b277-3f86-4a2e-ba1c-ebc66907b473", "value": 911872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682294789, "uuid": "abf13a80-0857-4e35-95d3-44bfc10916f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294789, "uuid": "8ee04ae8-bd74-4d9b-9f36-bc51ab83040e", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6c32bf-e270-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682320637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320637, "uuid": "1d0db17a-2957-4894-ac60-9d45b172bf62", "comment": "Malware payload (Mirai)", "value": "7a2a5bad52d4572a8fae8ca36eaa8249", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320637, "uuid": "178f3269-3113-4180-825d-b6b233419c8a", "comment": "Malware payload (Mirai)", "value": "3fce97661343c41002f56c5cf5755ccd7a808af92ee7651409d5c695066e849c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320637, "uuid": "46b2ff28-395c-4fee-be74-0ab16b2428b7", "comment": "Malware payload (Mirai)", "value": "75141d81e3e51ae70d6d8d770691c903a32ce6b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320637, "uuid": "6c0a5818-6762-40be-a209-30139b2ee4e7", "comment": "Malware payload (Mirai)", "value": "f55dfc515cfa056088e0d7f9a4630f3505817c73bbd8c1464e6296c8d115a0b499030c314f1ce8b8989f5aa720a14be9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320637, "uuid": "97d59e9e-9678-4ffa-a097-380705bc9279", "value": "T1B5331891BC929A12C5D4637BFA2E42CD372563A8D1DF33079D262F0077CA92F0EA7651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320637, "uuid": "3e8ff26e-ed54-483d-bcbe-44622299f3fa", "value": "768:/G4pHu8DDbLeRkWVy+ym6ijK4VDusUr4iMibGAwY0GR2LfavYPt1/hud32PZTPN5:Lpvfbi/usUrFBRSaIt15D0pwJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682320637, "uuid": "647d4c31-bb3d-426a-8316-aeb23e96315b", "value": 51420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682320637, "uuid": "1aaf170b-6e44-440e-9a00-221d65f709f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320637, "uuid": "fb788535-083e-49d8-bb34-4a288fbbcc95", "value": "7a2a5bad52d4572a8fae8ca36eaa8249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e045b9b-e266-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682316588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316588, "uuid": "a9680e86-8c3e-4271-bf49-05bf74ededf4", "comment": "Malware payload (RedLineStealer)", "value": "8d94300ff3e6f0e931d135234d3b316b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316588, "uuid": "db07609a-1a94-40e5-81fe-3fd63860fb4f", "comment": "Malware payload (RedLineStealer)", "value": "4096a092b1dbfea5d1087794384ae2871176df61dcd631d9adbe40d2bfffe88e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316588, "uuid": "9f4b19ca-5044-4797-b676-f67511a3cd68", "comment": "Malware payload (RedLineStealer)", "value": "af9eaea7c1fd4647ac3697439e8c3c3c573462b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316588, "uuid": "36d34d9b-728e-4362-8a0b-63a38086dd6b", "comment": "Malware payload (RedLineStealer)", "value": "e8f3413fea1654478e344963a601c2c9f32cf9ca2e80fdb69c3c6011f4ac9dfd6c7d30c1e405172b1aa52e7fdef83134", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316588, "uuid": "f3d1f223-bd0d-4c3f-8924-c82664910995", "value": "T1C8C41257E7E48072DCBA0BF018F662831B35BCE19B7483EB23419D9A5CB1584A53237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316588, "uuid": "96d51841-5c20-4c7f-9e82-6b47fc59a1d1", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316588, "uuid": "6c444ee9-b995-4160-818f-4c1cdfbc1301", "value": "12288:sy90vL1czsRbRvWE9X27/aEfOpEzm0rFeaBhZcAbo42:syELNz9X27/aEfgEt8AhZcWo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682316588, "uuid": "06294fa0-9010-4ddd-8359-9bd715f3e017", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682316588, "uuid": "2c9fa457-f3e1-49dc-9ffd-f1240cb8031e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316588, "uuid": "bd877d50-3b6a-419d-952a-361ce9becbaa", "value": "8d94300ff3e6f0e931d135234d3b316b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e44c11-e2fb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682380521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380521, "uuid": "51987e16-d1c0-4919-a3f8-16b17889b9af", "comment": "Malware payload (RedLineStealer)", "value": "2834dee015ea3d9da3b1fc74a66ea8e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380521, "uuid": "3cd09cd8-62b5-48ea-ba5e-799f0498b174", "comment": "Malware payload (RedLineStealer)", "value": "40abf115761f0635a3fd6c2de5b6e8fa9c59e7f5bb2eddb5c8b2df362ca339b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380521, "uuid": "7f0b34b0-004d-4d6e-8c80-e055221c7ecc", "comment": "Malware payload (RedLineStealer)", "value": "c1273eba818a1272eb59c3dc56c096afe7fcf564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380521, "uuid": "f934ea21-0690-4b9c-a3ff-fe458528af8c", "comment": "Malware payload (RedLineStealer)", "value": "b2ad5c7b916925a3566b4011fcae589b552abbf2078a8eb59d1156d098d9aecaf707d4133d841b136c0d7179c20c4585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380521, "uuid": "f766d027-5e07-473a-966d-2227aa352c8a", "value": "T10355019252E06877D5228B318E1EC6F47BAEB5134F157BDB27589A3F0A302F2D632345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380521, "uuid": "670ffb65-ff57-476b-a088-639c8c5cda05", "value": "6038020e47732a5fd0727c9d5ba31109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380521, "uuid": "c6e99d4b-ecde-4be0-ac87-68ea97e9fa74", "value": "24576:1Cbht9y/vN4jFVkUI4Hiew2ltipvLt87VLLLVxCwaUdw578ObN/4SYrnP4uO:1Cz9uyy4Hrw2lt2CxxCwbdw57fQSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682380521, "uuid": "3ac4b00a-cd17-42e1-86d2-23d18ca878c8", "value": 1292800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682380521, "uuid": "fa2efd97-182c-4fb8-9324-5b6840339531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380521, "uuid": "3860343a-fb65-4cfa-b9b5-e51e7d41269b", "value": "2834dee015ea3d9da3b1fc74a66ea8e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662654f5-e280-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682327661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682327661, "uuid": "b8708727-578e-46d6-adb2-37a2ced772bb", "comment": "Malware payload (AgentTesla)", "value": "9c29cb6a299e45a2f5e688ca9d072b1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682327661, "uuid": "9a7c501a-cd34-478d-b4b2-d98b860942a5", "comment": "Malware payload (AgentTesla)", "value": "4164d3bec950ac04c1a2e8edc8b4bccc4526daa5400e011c2622e9b08c720901", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682327661, "uuid": "c70aef0c-76a3-4718-837b-a11756f9a1d5", "comment": "Malware payload (AgentTesla)", "value": "55d12d2c76fa559d920cd07f93767ed80eeb4cd4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682327661, "uuid": "31ebd392-c0ee-45d8-92a8-00e33c1b64a1", "comment": "Malware payload (AgentTesla)", "value": "9c53cdd09925b9211862ad3df0dddbfd30ca4f435379643963834e6280d3c1b5f8673d9c0f7c9df1279607c6d0766df8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682327661, "uuid": "dfa03e38-d337-4119-abb1-9250affd0009", "value": "T19DF4BE2B222AD5B6D14E66B3D1E917FB0F2C2ECAED79904307A8BDD831727791F08451", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682327661, "uuid": "fe6733ec-7365-49ce-8c0f-677211d526d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682327661, "uuid": "0aa675d6-427d-4a2d-9d5e-2c4e1371b166", "value": "12288:j9aefjUPKHqHR1RHVpYmbO0LgyaLQ0uRZPgCDiAzILY:j97fjUIqHR1R1pYmRgyt0uLCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682327661, "uuid": "04de4aa0-39e5-4ece-a028-1381b1c28dd2", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682327661, "uuid": "b231ac96-d51e-4116-8a2f-66413ae20bb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682327661, "uuid": "a20cf0a0-bd06-4cea-b0d0-547f7dfea4ed", "value": "TEKL\u0130F TALEP Do\u011fan \u015eirketler Grubu Holding A\u015e_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd51b20-e271-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682321203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321203, "uuid": "d3400290-a3ae-4f17-bb3e-ac90cc666200", "comment": "Malware payload (Mirai)", "value": "91ce98eca5a273f73cb884e721dbef36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321203, "uuid": "96350e12-815c-4eb9-a47a-00ad27d8931e", "comment": "Malware payload (Mirai)", "value": "41c2eb59eea2ccc5526415db497cc27614069feb159f615396369812ffa40b38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321203, "uuid": "81323c30-c922-42b0-a4fa-dba3a6bc97cf", "comment": "Malware payload (Mirai)", "value": "772bec9f6d939e5bad0595dfd74422946a734ab5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321203, "uuid": "91a17769-5cf7-4373-849c-984fa689f7b6", "comment": "Malware payload (Mirai)", "value": "fe70c8bcb0cca4d3c663525b6d2cf4cac7a4a93c63568b376a77033e1cb19b0f41d4643f3a38cba3680f61173ed711e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321203, "uuid": "852c3c2a-7f6b-4899-8f72-ae492ba1a835", "value": "T13E63970E7E218FBDFBAC863447B78F215648339526E1C584E15CEA015EB034E785FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321203, "uuid": "fdf54837-82fa-47a7-9ab3-79da1ad243b2", "value": "1536:Q4NDlZDuFY/5hlBYNJCSo7QGgCl2tYXsG9E3te:nND/D4quJVo7QIAYXsG9E9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682321203, "uuid": "de893b39-03da-41a4-8e88-7f26a6409192", "value": 67484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682321203, "uuid": "0c189872-0884-4f8c-9f76-5b9a1e54ce38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321203, "uuid": "23767b25-bd32-4717-a952-d099dc6d5e7e", "value": "91ce98eca5a273f73cb884e721dbef36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9b26f9-e2ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (VectorStealer)", "timestamp": 1682346702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346702, "uuid": "cca08112-16cc-4af5-ad1a-381cb8fd5fd2", "comment": "Malware payload (VectorStealer)", "value": "5297d34e555a60642566a9d2e083ccd8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346702, "uuid": "44e69946-b9f4-4af4-b2ee-8076c5365129", "comment": "Malware payload (VectorStealer)", "value": "41ca800826b6908c46d736c3dd341cbfd4ffad70b05667540465d8fd8f495652", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346702, "uuid": "70426a89-eed1-4d46-a9b5-aa5bf02c288c", "comment": "Malware payload (VectorStealer)", "value": "80600fdad76b07e1acef54640f3581e0aad0fb97", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346702, "uuid": "3768ff9a-3106-4661-813a-37bc58bda6bf", "comment": "Malware payload (VectorStealer)", "value": "a7c98db6dd27325869bb66a9d7334d8fcf4c15cf91568204f61761a0581b7a2e01209e0cb4a6037bd50beca062ca1bd3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346702, "uuid": "0bcc58fa-e62a-48ed-9552-325b76b8f165", "value": "T11206A485490584F62030EDF33697E1A3CC7B6BDDA7F849DCE6952C68A38C7462BE16C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346702, "uuid": "9ed7e804-3ea9-4ae6-924f-d7d96270a3f6", "value": "24576:VqDAy8iaVRG88tOM8VM4z30lieqlRNxvzbW0yij03+7IxuKU1F5fNeze9vi9X/em:um8zgOCyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346702, "uuid": "84da945e-09ad-4709-99cf-4beb9b29b3f0", "value": 3665561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346702, "uuid": "cefeeaa7-f74b-44e8-9382-ecdbcc5f2812", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346702, "uuid": "580a36ac-cc2e-45ef-b088-9c5e220526a7", "value": "Updated Invoice and SOA.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3540f8-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303222, "uuid": "5be5049b-0850-4a51-9e9a-0fab9ce600df", "comment": "Malware payload", "value": "5d6fca0e44f14e1e58e6b90c1e1f2637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303222, "uuid": "a8277e79-f401-4f46-9e50-14de9ac1f4f1", "comment": "Malware payload", "value": "426c47dda3c119c8e9a2d3883b77842e9b52bcdbeaaf929327583fc636abf2d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303222, "uuid": "32a62327-bfe9-42fa-b562-a009b6975273", "comment": "Malware payload", "value": "1974654a56e978f22349a997120642bb9f4e6814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303222, "uuid": "bccd15e5-4cb4-4864-8e2c-1beefba2c2e6", "comment": "Malware payload", "value": "f9bf433bb496366562d589a7f59935a3d6862ce8822d4496fbac954c9d5ed58a705cb6b006eb39d6854c5d00d940e48b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303222, "uuid": "5b76762a-a78a-49d3-8d56-447404b1c6be", "value": "T19F252393FF6D7CC1D0CEB47148EBCE20AA63ED1A2DC14B4F52B9284FE4B21096145AD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303222, "uuid": "c45b08a9-29b9-4f5e-9759-aece109e7be5", "value": "08984bfc5d0313b20229aa305b7ffb42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303222, "uuid": "e8a4b00d-4a4d-4345-9cfa-6f0d25e52bf2", "value": "24576:bd4iBjt9/DSbOoGlRnoYzZhKrhCkExa8D9JGElaFH9TRFYqH:bDBjLDKHGl9K/ExaSoEEJ9/YqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303222, "uuid": "7a9530e5-684e-45e7-8125-612f0aaaf0cb", "value": 1014408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303222, "uuid": "93f7b1ff-21dd-4ced-9e59-34e4b1290a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303222, "uuid": "29c86c69-5ca7-4c30-af9b-ff5c460da2de", "value": "SecuriteInfo.com.TScope.Trojan.Delf.32407.3964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14617ebd-e294-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1682336114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682336114, "uuid": "a9398b94-3b71-44f2-a8c1-fda5e2160f60", "comment": "Malware payload (RecordBreaker)", "value": "9c4b6a9bcd60083fd81b4acca067de27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682336114, "uuid": "1f9095bc-5157-467f-86d9-94a37d12f84f", "comment": "Malware payload (RecordBreaker)", "value": "433cb99f5585535581a53c07ae7747241074d52ca83be7ef2f46c48ae02e7c24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682336114, "uuid": "6edcc48d-6f61-4bbb-8b8c-d98ce0d8410d", "comment": "Malware payload (RecordBreaker)", "value": "5abe4afe13b8a7e3ea294d18a6d384ed3727c71c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682336114, "uuid": "6f471feb-7cd1-4846-b649-bd31b923752d", "comment": "Malware payload (RecordBreaker)", "value": "a6a709b0a9e50853bbd8ecc6f79bafb35ea4c31af42f758b0d383e51d5e46cadf6b1a1c107f030209d94a6dcb6a3a9a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682336114, "uuid": "8e953645-b81d-4b8b-913a-9da84099aae4", "value": "T11A745C1263D0A873E5635B718E1EC6F46AAEF4505F157BDB1B99EA3F0A342E1C232305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682336114, "uuid": "55b6beb5-e2e3-4df8-a183-66d4a700945a", "value": "6a8dd0359e3425dd330b8f8519bc89c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682336114, "uuid": "a80aa87b-e8fb-493e-9cf0-f2e60f77938d", "value": "6144:E4PKV/TCQwQ4jRWSUvL8CXni+6N6tnrOWy:E4PA/TCQwhRWSILHXi+7nrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682336114, "uuid": "c353e9b2-b65e-44c0-9884-6cebe2f8bd36", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682336114, "uuid": "0c86a5a1-8d34-49d3-911b-1fdd80510a7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682336114, "uuid": "3bfe4d71-30f3-4d1a-b92e-ffd1e384dc1f", "value": "9c4b6a9bcd60083fd81b4acca067de27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74174958-e2b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682348730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348730, "uuid": "ea593fbb-3f5c-406e-a3e4-08fa98871bab", "comment": "Malware payload (Mirai)", "value": "b06084b2166e150723be47a8ec217057", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348730, "uuid": "6259c147-9919-4c3a-995e-d1b930a3a10d", "comment": "Malware payload (Mirai)", "value": "43c4becf19f0d296dd1b9928603601853e8ac58e39ee418ef957cf2f876b7994", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348730, "uuid": "822b659b-dfd6-4c94-a376-b30a475e45ab", "comment": "Malware payload (Mirai)", "value": "957c013b08941fc4a76ead193de62fb939c23b58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348730, "uuid": "753a4fce-ff0e-44b6-a4ec-655119720c4f", "comment": "Malware payload (Mirai)", "value": "ea8006f41e233d700aa1253e7d0a8cd83c61abc71c2c148fba8d4d529f0c28480b85ca9c83a366abc9a02e129f51d5ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348730, "uuid": "561f6e09-ab5f-415d-a43b-be918a5838cc", "value": "T16A633B07D9628FB7D14AAAB555A75A300B43E8164F5F1A8DB13CAEF0170F9CDB80E394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348730, "uuid": "05637164-b115-467c-a58e-ac18b0acec71", "value": "1536:Q7wck756ojGKXdKxDcS/icpNWChIhJKpvuQTrEqpTOnFQ4G:mUNkKXExAJGNWxwutqpynFQ4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682348730, "uuid": "11d31a61-123e-456a-b829-649728e6bfd7", "value": 69605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682348730, "uuid": "e77255b3-c903-4f15-8c36-83aa6f7b3bb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348730, "uuid": "12ea439e-b0f5-4b2f-b3de-b0f7df03419b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4992d5-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333471, "uuid": "5837b367-31ea-4ee4-91ac-edf6b89bff94", "comment": "Malware payload (Mirai)", "value": "531f329a0af097022d8b47ce93b43fc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333471, "uuid": "d369ff6a-5ac6-4f23-abce-6c25c85778b3", "comment": "Malware payload (Mirai)", "value": "44367507d2587425433dd589bd0af989757d02a73fc370f1e1f420cfaa6dca67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333471, "uuid": "e99a6265-d5b0-4091-8504-632b7c42282d", "comment": "Malware payload (Mirai)", "value": "462058248798dcce4b7ef23a2e4dd581f4c0f973", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333471, "uuid": "9fc04388-6ec5-460f-8a5c-49833a51ff2c", "comment": "Malware payload (Mirai)", "value": "85ce775a1ccae3f863f252c555d968a3fd01aec2fddd2e452c560899d78501678ca7e30e8303948b97469bdc064f750c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333471, "uuid": "345f1d96-c86d-41ce-874e-85785935654e", "value": "T18D2308C27941B639C3D157BBEEAF014E3354A7D8D1DA3397C8280B947A8A90F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333471, "uuid": "16b518d3-2624-45ee-bf1c-a3c3194f4fd1", "value": "768:sJeKpHsmdjnL1ScK+GRvFES1un1wnjvsDoCerCw7sC/vnX+6k7wCVy/rCxHghW1X:sYFmpJScK4MjvR7sC3nXPfhWt59sev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333471, "uuid": "d674526d-f25d-4fe6-b9d7-29aacf478933", "value": 49140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333471, "uuid": "b53da97d-3f9a-4ae7-b809-021aeaae64c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333471, "uuid": "028a0b3b-b936-46c9-b4c1-4042bfb0df0e", "value": "531f329a0af097022d8b47ce93b43fc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b871558-e28b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682332314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332314, "uuid": "ed61abca-2cc5-4a60-88b2-7adf6b57bd4f", "comment": "Malware payload (Mirai)", "value": "09dad6228b6b00ad46299b619b5e8232", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332314, "uuid": "e76fddd9-4632-4435-b7d4-382f408520b7", "comment": "Malware payload (Mirai)", "value": "4472b2a8263f775566097c331d5c9293916503a33e4c3fb5096f855bb22718de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332314, "uuid": "1d044518-e9f2-4bdb-9767-519861dcb3ab", "comment": "Malware payload (Mirai)", "value": "908f03ed5f529069722e6780668dba3c34c463ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332314, "uuid": "57500a06-13c7-4394-95b3-a17a657bd220", "comment": "Malware payload (Mirai)", "value": "7b7ac7bd31949424912c2fb014497c5b02d1f7140e8b2b3614fd9ce439822962ae27d967c4e0c29bb88cc0de38792055", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332314, "uuid": "d584f606-d21a-456e-b72c-c84c98c0d557", "value": "T1A463961A3E218FBEFBAC863847B74A219658339622F1C5C4E15CEE015E7034E745FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332314, "uuid": "65e594c9-3e23-4121-9001-b9737f7668b5", "value": "1536:AHNFnXDu+/SyZBp9tXI0v6bqfg/Kkz73o2x8JW:YNFXDDrRI0SWYz73o2Ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682332314, "uuid": "50fe1db7-573a-4365-8dfc-3542c35e9998", "value": 69080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682332314, "uuid": "08569b3c-ef56-459c-88a9-abb79a72212a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332314, "uuid": "a97f1385-34a3-402b-970b-e34650065ede", "value": "09dad6228b6b00ad46299b619b5e8232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3da9f6-e2b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682348928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348928, "uuid": "be321b02-ae15-4f51-b6f1-151c9cc157b5", "comment": "Malware payload (Mirai)", "value": "2b22082a3b9c26dcd6bfc565a1754115", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348928, "uuid": "a7ca7456-5fc5-432a-9caa-c3ae1baf8c5a", "comment": "Malware payload (Mirai)", "value": "45554f2212f4f9b5309543b12aef5819a742465d6823fe4926c711dbf420605f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348928, "uuid": "83d241b3-d40b-47e3-b7bf-4d1283e42c12", "comment": "Malware payload (Mirai)", "value": "ae42875576647276c1e44b61e811fefe0d68767b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348928, "uuid": "49e418b8-4432-4d48-9ae2-af58cc9d7b59", "comment": "Malware payload (Mirai)", "value": "6e471a39276b69f2e379a2be4ba58ee2b48fdd56712e2ee6b6078e857f0077f34a83c79103c7a16eb56da5a168cb5a56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348928, "uuid": "fccb8b70-5def-4126-9502-d2111bc95107", "value": "T12D261A117FA45730E0C32AF14CAE5B2C2B71C699D716C7A3482ED2B0AD922D4BE5F5D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348928, "uuid": "679f114d-fa76-4ac5-8205-bd1e4a4ebbdc", "value": "49152:QGm7tDi+dgqIAPGzfphHgrU+j+Jmu3r1Nnpx5PkdcqKI/PZttvTSvaiwCq2th:QGm71iKPGzpmZMth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682348928, "uuid": "070f94a3-6313-4900-a51a-ef3c003fea3d", "value": 4421312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682348928, "uuid": "a9824033-25cb-4c75-8c0f-bd07ab5e095d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348928, "uuid": "730f43f9-0fbf-423b-9d5a-57d43240eb6f", "value": "rbot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d5a697-e234-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682295078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295078, "uuid": "9534e79e-5e13-4855-b740-5c70ec212f4a", "comment": "Malware payload (Amadey)", "value": "45d20b3b4b2294d275eea725d28d15f6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295078, "uuid": "af17d888-510b-4067-84cd-7b52f05e015a", "comment": "Malware payload (Amadey)", "value": "4612abbf556c9e649964e669af3eca0efe5bba72be754652ca449a29be47d460", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295078, "uuid": "c3814325-7416-4f2c-8b33-27e16f396c92", "comment": "Malware payload (Amadey)", "value": "2f29d1bc549f9a8a474ceaa97bb2328205c2deec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295078, "uuid": "7dd02695-64b7-4c8c-b8f8-94bb07b01956", "comment": "Malware payload (Amadey)", "value": "88484a0b5644b34525d8792db24b07a36f1989e48e2b3036650c6224265dff2f8265ae9e04fb12cd16f118944343037a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295078, "uuid": "63c8d91b-0bb5-4308-9a93-59c294249f0d", "value": "T19C252222ABED8573DCB813B004F612871F3DBC919B7543D71A95A69A1C738D8A633326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295078, "uuid": "712858b9-1f12-4ee4-94fc-78c58e8a68d1", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295078, "uuid": "b5222bae-cf8f-4a3a-a981-7188b9086414", "value": "24576:6y/zx+jtdQtNOjHmHwOTDdtr3Ly2yI7SuhaDe+AJ0Sl4Mu:Bk34NO6QO3dt1yI7oAaSlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682295078, "uuid": "ec09cc9f-223f-4d72-bd72-3775f6c5ef02", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682295078, "uuid": "2e5bb3a3-ff51-473a-a73a-59e01bae0caa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295078, "uuid": "e63e9d35-7a5e-4f89-a844-144ecaf1c751", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6ea240-e281-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682328076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682328076, "uuid": "e6f16522-09cf-49f7-9e65-5a103964267d", "comment": "Malware payload (AgentTesla)", "value": "afe3645cd8498f1a9adc124c28e5ca94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682328076, "uuid": "20a67196-007e-43c3-b6fc-035191aff5ca", "comment": "Malware payload (AgentTesla)", "value": "47b95d512aad9b9fb931ad9f1937c88933fb6bd6e1dc3afe20f185d70d96795d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682328076, "uuid": "55a058b9-81ec-4af8-a78f-08e6f13ab74c", "comment": "Malware payload (AgentTesla)", "value": "b5dd6f599976055074386fd8958273d4478dc737", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682328076, "uuid": "c51ddf9f-35d1-4406-a76a-b4600840fa44", "comment": "Malware payload (AgentTesla)", "value": "6e3374f48b6611c510fd3d3c76c36b55e290f804b9259f9aa676b7e379faa51241fb7b5e773b9db65fccb68fb14c174d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682328076, "uuid": "b057cd6a-dfb8-4dd0-94ad-7e8d7d21a189", "value": "T19AF4CF2B621ED4B6D15E66B3D1E917FB0F1D2ECAEE79A0430BA87DD431723B90B48441", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682328076, "uuid": "05591cac-fab7-4273-a056-622e46e11e53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682328076, "uuid": "3eb02d0f-77ef-4063-852c-359e2eaae1fe", "value": "12288:llls8szJ/lOfJZO+LMvGG2wHgb1LMt8M5vwM:llllszJ/l+vOKiGGb6LMt8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682328076, "uuid": "94f9c551-59e3-4c2f-917c-74e020ceead2", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682328076, "uuid": "014b5e65-fd01-432a-a6e9-d25c44399464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682328076, "uuid": "df2233bc-394b-47a9-bddd-a9991bf83dce", "value": "F\u0130RMA PROF\u0130L\u0130 VE \u00dcR\u00dcN A\u00c7IKLAMASI_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881d895b-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303237, "uuid": "9401872d-de79-4fec-a337-1dda420c0931", "comment": "Malware payload", "value": "9f673d0080cb2461dcfae1e7ee6255b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303237, "uuid": "6007b2cb-a23b-4f02-b4ec-0b8c6b5ca009", "comment": "Malware payload", "value": "47bec205b9597e6adaf811006a39e5caebeb22cc636c5577d3b9a42731323824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303237, "uuid": "7996d5da-67e1-478b-a742-c2a6b45e8057", "comment": "Malware payload", "value": "af755ae8c0e570f52aa998e2ebdd894e4c22cec0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303237, "uuid": "e8c9e017-e013-4f2e-80cd-f5c4a88c49df", "comment": "Malware payload", "value": "c39ab7a4536e29609f08b1de3ad28ab59933de3af9865da9e815d0fd6e2f10b67584bd3dfc08b1be9df5fb818caff587", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303237, "uuid": "a11444bb-4fc2-4850-aa5f-250700b07570", "value": "T156744C26B143888FF3A16230EE4DEA154728E5FE96BF54FE3E954D38574C2006A5CF29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303237, "uuid": "24c1ea1a-b519-4e78-9a16-1d6290ca070b", "value": "3072:ZFN9dNDAFlGHV9La7FNI//g/tH4B8RhSsluPsEVwu7G2TIsrBtZ+3UGS0XS:F9deFcHUF+4/tHiY0sluFVwu3TFvKS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303237, "uuid": "0ff988a0-9aa2-4598-aeca-c0bd75f8ea23", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303237, "uuid": "5a16e284-4516-4371-b3a3-edecb94af971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303237, "uuid": "c58cbb97-6226-4b8e-9b20-f727e7e87ee0", "value": "SecuriteInfo.com.FileRepMalware.16891.16162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805b6d44-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303224, "uuid": "3a979514-74c9-44b8-b3cb-256699f0b05a", "comment": "Malware payload", "value": "6830755ba148ad34470b0a7ae92bc925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303224, "uuid": "ce18e1c2-2d9e-4d34-b1e8-f8374f174975", "comment": "Malware payload", "value": "47e3dd58f0254e77c3f352a8a8d659edb1be6beb9e8a0d66285ffa0b97da0f0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303224, "uuid": "f73be6d5-6198-44e0-8182-c5a377e766b0", "comment": "Malware payload", "value": "b74927b41706d491fc5973f5bc7ae3f590ed4967", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303224, "uuid": "ea35a7ab-ad2e-4d4f-b0de-852e7eb2fc48", "comment": "Malware payload", "value": "476314a835da099537425f89ba9df29c8311e26e7337577cf597e45455af4a5e9af4dba9defd7f69421493545fff326e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303224, "uuid": "65cb61e4-7bdf-45c1-bc95-fc5bc11946b3", "value": "T1DAE239227EFDF9CCF28008F10763E81D52B87F3D3AA502C28575654E59F3BADA80A558", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303224, "uuid": "8b34c41b-a084-4da4-9d98-7495572bf042", "value": "0b93ca6c39ddad3bac0880ec10ba28ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303224, "uuid": "f350193b-9f2a-42b8-9505-45b409051451", "value": "384:K8KsYIhuvvR6KNP+xost5DICPKcVvWhjduDaLvKg/mWTk+tCo33DNm3:K8KAQvvxs+sjXSfrc0mWoiCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303224, "uuid": "6adc044a-da54-45c6-b262-db2fb1fcb6d0", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303224, "uuid": "42191169-9a5b-41ea-aea6-76ab2aa1196e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303224, "uuid": "9a5f40d8-7b6d-4a98-86e9-324e8f8244f8", "value": "SecuriteInfo.com.BScope.Trojan.Wacatac.32730.20124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb6359a-e238-11ed-b3cf-42010a9c0076", "comment": "Malware payload (PandaStealer)", "timestamp": 1682296673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296673, "uuid": "cba2e638-28ea-4fe6-b6d6-0ed9bdb858aa", "comment": "Malware payload (PandaStealer)", "value": "b6d03b0ec3c9d7ffb57a45b36924612a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296673, "uuid": "182c848e-55b1-4c6a-82b4-a2d9d5f9a7a0", "comment": "Malware payload (PandaStealer)", "value": "47e8958d7ae26467cb5b9e1d6e0b206139d18f5a7ccfb834286be5aa76c8a3ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296673, "uuid": "51dc3856-24d9-4346-a7bf-90f2961f376e", "comment": "Malware payload (PandaStealer)", "value": "6b9d534a757642b733bdd85f33160a9bdcd96ea2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296673, "uuid": "f91679d3-b797-4cbc-b932-e72a3019bcc0", "comment": "Malware payload (PandaStealer)", "value": "5f09a5fb889711027d650d5e0421892e0371527ac177c502b735a7c14af23b9dc7a85797e6a3247e193401a78abdc067", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296673, "uuid": "55332ed2-2a27-4aa9-8204-489ad79e6909", "value": "T153F4F14330EA2411D076D3B740E1B16A66DE6C1163E8B9DB37DCF09F9D0C2616AACE6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296673, "uuid": "689366d1-38b9-4e74-b1e7-78ec320661e8", "value": "bdc5460897466ea2db5d4e59ab3f0e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296673, "uuid": "a7911fe6-4923-45b4-a634-870ea34a57c4", "value": "12288:SF+Sq1UMUOEdKh88XBRDn/IZDtMZGlLBVXBXKYw3tKzeLiIwX939:SF+ScmKyqZ/YZD9VBkdKzb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682296673, "uuid": "1227f03c-e888-4ec2-96ca-ef3880e100a4", "value": 757408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682296673, "uuid": "40a5b16b-621a-4cfc-b878-79374ad6647c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296673, "uuid": "805f9606-82dd-40e0-a6ee-de27a535483f", "value": "FortniteHackMod v2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7737ddfe-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303208, "uuid": "46016d90-3882-4fd2-b5f4-660f9a24a578", "comment": "Malware payload", "value": "4a4a593f1188da1ad8b45d0bbcab47ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303208, "uuid": "646dc8e7-9550-4698-9e6d-35dd44cb346c", "comment": "Malware payload", "value": "48740af46b65e1ebab6a8ae64b5e20fa010132944c225e684f4161032ef5a6c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303208, "uuid": "221f42cb-b6c2-4ea1-84cc-9576fcb1c2c2", "comment": "Malware payload", "value": "54f954c568e9bffd8030f5bdee8bd9a600342698", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303208, "uuid": "1309e9e4-7da1-4305-9ddb-ce40d6eab66e", "comment": "Malware payload", "value": "d8589f829ed69e27dc019b79df51a8fc748656fb58999f05721747ad15454f68a0c70b6f8a3c0398d6ebe96d6f9a6e77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303208, "uuid": "858c541c-a72b-48f4-970e-622c11983657", "value": "T1AF818CA72D444A84FFA528B659F80775F3A2B0A30399E8F8493B914AFE01B4C063B710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303208, "uuid": "a5f193af-c8f4-4217-bcec-ca59a4598af0", "value": "992b55ac6e4285130bc78a171683f859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303208, "uuid": "de934d4b-f9a6-4473-9efb-a38ed8ceded6", "value": "96:cx4+XviiRInc1TAJZikOP3ym0otL7mzujbC4wIfrv2/1:OWiRGTrm0otvzO4tfq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303208, "uuid": "7d8c2ab3-efea-4d16-9a43-35b0cdb3b61c", "value": 4094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303208, "uuid": "a923ac71-f458-4c25-b004-81c32cfaa88a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303208, "uuid": "db9d7469-27b8-4ded-8f6b-ea1839428980", "value": "SecuriteInfo.com.FileRepMalware.31812.11732", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af2c3b5-e2ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682346648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346648, "uuid": "33a112b0-53bd-4884-89cb-e767656aa15d", "comment": "Malware payload (AgentTesla)", "value": "10aadf4f39cc791889845a45ff7000c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346648, "uuid": "d4432e30-eef5-4d0c-8501-663080c8f382", "comment": "Malware payload (AgentTesla)", "value": "4918ca9b45ac35ea8c6c75c1524e3e87e940e373189bc7b6d18b0219695a8f78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346648, "uuid": "287370a5-d8af-435e-a361-239dd4dae65e", "comment": "Malware payload (AgentTesla)", "value": "30dddcb4e011d2f246b10371e7e3fca211c0a4ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346648, "uuid": "ae168399-198e-4aa4-bd74-1afc84865d55", "comment": "Malware payload (AgentTesla)", "value": "0c28249f90b4532befa2b85189069a649d60a46977616c67f1be09d945b2cc2719d176c018f50be17721c2fcec361f21", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346648, "uuid": "dc4bbf94-f83e-493f-a8ff-744d8ed66be6", "value": "T198E4CF1B622AD5F6D15E26B3D0DA17FB0F6C2DCAEE7990431BA87DD831723B91B08411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346648, "uuid": "d943b001-982e-435a-a676-2bd9f2cf2151", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346648, "uuid": "54b103c7-8742-4aae-8cc2-c91d16a11f6c", "value": "6144:NCt1ErAp2rhX02OkF5efVEnkwdP0/BExTuN0rOfjrMmK6/hs33zbih6UTvasqcAx:Nrvl0/t0irrMmVZs/ixUVN+yLW/fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346648, "uuid": "ab33f983-fe86-4351-841f-17bd4bc60d61", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346648, "uuid": "6349232f-9cbd-4b55-b98b-ad43602d1f73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346648, "uuid": "4d0c623a-e238-4e26-a3d0-2932f96b867c", "value": "DHL-AWB 4679876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f0e77e-e26a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682318208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318208, "uuid": "dea1f840-7410-4d58-a52d-8248cdca8636", "comment": "Malware payload (AgentTesla)", "value": "0ee8f5ed1a3b69876b5663402c9b0ceb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318208, "uuid": "bdfadd65-218a-4e29-b681-3f5781716ac9", "comment": "Malware payload (AgentTesla)", "value": "4938c7763c8547704551867ead9f6d375d7922d054fad339af66705ff35fe57c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318208, "uuid": "ff08ad6a-97cb-460a-9490-1c6ab3aa58ca", "comment": "Malware payload (AgentTesla)", "value": "a0505f6cf0f107aa82d4714138e3a5d95390a505", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318208, "uuid": "08e0a673-76d3-49db-a5f2-cb40df46b456", "comment": "Malware payload (AgentTesla)", "value": "72bfc7744ad2f94023786c34ed37e35e3f60520897cf6d678cbb6ccd9c4707df7d2fbb7bc12b2ee1f6dfd8b4324daca7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318208, "uuid": "3b3a6642-ffbd-47db-bba1-869394b438da", "value": "T1BBE423B666124AF4211C0AF392C367962E766F1B2FBC3708965D38217C6B18E75379F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318208, "uuid": "c0eac9df-0f85-4b61-b5df-e9c01ccf2365", "value": "12288:n5Y8/ZTHPkJ37qHUdjSB4MQn9LZ9EukyB993haCqynbqWBzixj5QtFqTnE:5rFPsxdjS4BnX9E499xaCqKbJBY+Fr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682318208, "uuid": "71f4da2c-3a06-4065-aa9a-8b816cf488dc", "value": 678924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682318208, "uuid": "e97cf41f-4414-462b-9341-03b2144468d5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318208, "uuid": "f4c33223-c258-4e5a-b42c-1e640edb2137", "value": "New Order 2023-04-24-006645 Q73619-rfq 50007155 6000654623 #514.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89da71e0-e246-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682302810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682302810, "uuid": "e4765064-f258-47d0-92d6-a48f78efd4b1", "comment": "Malware payload (Loki)", "value": "b6fce55e8bd0ae825447eecc5a191f1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682302810, "uuid": "f8c28369-b553-463e-9c9a-a08044012792", "comment": "Malware payload (Loki)", "value": "497f1767839d62e5bba3a33a89841eb2fcd196bd743014b6c5ede55d6a3eecd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682302810, "uuid": "5f0ba97a-50da-490b-8af4-17e2e1318fd3", "comment": "Malware payload (Loki)", "value": "87ab87da830486ef0135d20b569fd9edc2a0e6d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682302810, "uuid": "2a805f99-1f64-4f9e-b560-eadef28e4101", "comment": "Malware payload (Loki)", "value": "83cd4067aad38b7f7bb22c7ff359ee8075c7fd5aa0595de6921ff9cff9f34b3fe8adfa16148a8aba92a28d28e1154b5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682302810, "uuid": "b57aa318-aaaa-444a-aa39-b46dcb26a191", "value": "T16CA4025A0177BAEADDCC5BBB052824464731A0E35129EB2C9BE40D8ECE43B47FF4546B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682302810, "uuid": "d9cc2e70-df97-4cb3-93f0-2799e4aca7f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682302810, "uuid": "7eb87e41-a399-4d3f-adcb-fdf3b669c5e9", "value": "12288:q3vaOpCOLFPMpqgTzygvs/tW0A8M9PeQi:q3vppC8F0pXT0W0S9P7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682302810, "uuid": "5d0ddfe7-95c5-4392-b508-4455bd465ca8", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682302810, "uuid": "82c8d55d-1a34-457a-aad0-fd28d6d166b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682302810, "uuid": "985eec32-166d-4abd-8a42-75d80dcd5c01", "value": "TNT NOTIFICATION213596003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce2ef8b-e26a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1682318197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318197, "uuid": "c8811d6c-b495-4abc-a21b-56043c0784d2", "comment": "Malware payload (RemcosRAT)", "value": "6920cb4c0607df7929c95f79c3fcded2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318197, "uuid": "3c5416f3-55cf-4325-a671-e9bbdefe2887", "comment": "Malware payload (RemcosRAT)", "value": "4a1e5a07a7f7c0beaf43da551c77fb3fb3298660ef10b173b9a7a37bf2b8ce78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318197, "uuid": "45ad46ce-ef0c-4738-8c5f-29542018fa1c", "comment": "Malware payload (RemcosRAT)", "value": "d5b11899e5a780d5962cc0e4378fb33243e2b60a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318197, "uuid": "92cea6aa-b857-418b-bfff-13f269cd84f2", "comment": "Malware payload (RemcosRAT)", "value": "376635b0df314bd42a84a9d8add29a9bfe51eaef557e360727c01a4e2bbfb72a1b815b45ae8ec0e9e1912acea3167164", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318197, "uuid": "c3062cb9-0fff-4009-85ae-0872ae7f9c0b", "value": "T1817412B993B08172D31768311E76663B2BF5ED65CC841347D388BBD93A727C24E1A60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318197, "uuid": "f9962cc6-82a5-48a4-8f9e-245cb0d295c1", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318197, "uuid": "08e7b35b-fdb7-426e-a9ad-f22e5dc59ad2", "value": "6144:jxFS5OORv/jOGTlhyqh3yQ9cZoWjfJoeWPTdPQ2WQA4AFI7RKZuyHuh:fEOORjOmyqYCgo2CDrdPQ2W0AG7RKZuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682318197, "uuid": "5bd56e99-c4e6-45ce-8e5b-a8a4b2465ecc", "value": 352424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682318197, "uuid": "1ddf20d9-c059-4fe7-8648-053a11b63b18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318197, "uuid": "0482be01-1789-457d-b865-474016d8e26f", "value": "New Order 2023-04-24-006645 Q73619-rfq 50007155 6000654623 #514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489ee41a-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330189, "uuid": "fb196b42-18ac-45aa-a45f-ed719413789e", "comment": "Malware payload", "value": "368c9a68d499867fea8f92063105a2bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330189, "uuid": "6eff5a0b-4905-4de9-950b-0ddf5489fce2", "comment": "Malware payload", "value": "4accbeea02170cb5215fbe937fabae030986f84ee7acc983cc15ce120e073861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330189, "uuid": "11ba2cef-7277-41c3-b689-95034ae8df90", "comment": "Malware payload", "value": "39155af82f3bd5ee6f8637b1b1ed5b08efb5834d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330189, "uuid": "ae9af9bc-557e-4425-a3e9-529856610c2a", "comment": "Malware payload", "value": "128f3366a92efb2b0391874b0523b4d7911ea551d9466e91cda726f9cab7dc270f979b5ddd7be82d2d06f44492419723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330189, "uuid": "02b2b17b-6bf6-4163-9a3b-a316871af484", "value": "T12436BF6F2120C27DC16E85FD89AE9E31A133E2643E73C728449DEA612B5F4534DBD368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330189, "uuid": "88aaf144-2107-452e-b91b-d1940cb75b76", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330189, "uuid": "6434e535-4173-436c-a654-dbd2ced279c7", "value": "98304:fIoYCQETcpjx1Rb7wxRKhMM+K3bSGC8+GYgHaylfAG:vYMT01RUKhMM+Mm6+GIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330189, "uuid": "d93f6494-d107-467b-9594-6ef132da23d9", "value": 5108040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330189, "uuid": "eec041c3-1842-4d98-aa9c-7638a1759a5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330189, "uuid": "2fd40a53-1f10-450f-a29b-683348178032", "value": "4accbeea02170cb5215fbe937fabae030986f84ee7acc983cc15ce120e073861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ebf8201-e25b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682311811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682311811, "uuid": "6bc3ee75-00e6-42b5-b2c0-6ecff6a49f9a", "comment": "Malware payload (Loki)", "value": "0276be39190d11708dd28c908575086a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682311811, "uuid": "d2bce538-5ba9-443b-9b9f-d16cfee6a754", "comment": "Malware payload (Loki)", "value": "4be412cab845dfa0a80431b758bf2196708522eb4d6d118103cfa56a0d967fbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682311811, "uuid": "cf0b784f-3729-45b9-9fb9-4a23b128d652", "comment": "Malware payload (Loki)", "value": "2b09468f4ddf52f9c40c4a9ecd47a0460e03f7de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682311811, "uuid": "1282c293-22a8-491d-8a6c-ca040470404b", "comment": "Malware payload (Loki)", "value": "4ba07360ebccbb669e610e181c410dfa847f7d6b1e19a5a8eb1d38a9e7b6942dfff126d87e81d8644bce14d5fb6a54fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682311811, "uuid": "15a5f2ad-0a9e-4171-bf6c-4c58a7d5b025", "value": "T180A402942277B5EADDCC17BB4660245D03706183203AE7AC9BC88DCE4E86F47EE4556F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682311811, "uuid": "3c170738-41df-4ab0-95e5-8bb3b387b56e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682311811, "uuid": "45c8b244-b664-45df-b014-fdfe3a15c1ba", "value": "12288:/J0PfaUPJE8odDmAh8r62DumhlBp+9P5MltI:yPflE8oF8r19hlBpyP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682311811, "uuid": "f2ae9990-74c4-412a-b615-f10dc3114517", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682311811, "uuid": "a7e2feac-a62b-4698-904a-4b637e5b1ca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682311811, "uuid": "761d6e1d-46e7-4193-80fc-0230bff49faf", "value": "M100538944177.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2337e37-e236-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1682296086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296086, "uuid": "322f4643-db82-4dda-9b09-e5598c8742fd", "comment": "Malware payload (Rhadamanthys)", "value": "f362cb8f2ee027b58acf0f90cf82b81b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296086, "uuid": "10a78583-3a68-4504-9e2d-358ae1b2e3bc", "comment": "Malware payload (Rhadamanthys)", "value": "4c28b05908f654ddfc919958942ebe72299ac08d5d0313d2bb83a5548f939c5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296086, "uuid": "3f6c861c-a4ed-49e0-ab7f-cc10470aef68", "comment": "Malware payload (Rhadamanthys)", "value": "3408e8b57c28eaadd8300f223417a4333cadebcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296086, "uuid": "54a4dde2-9d11-423a-99d4-51e4e5fd5a8a", "comment": "Malware payload (Rhadamanthys)", "value": "3d75d18058c2d5e2910703474ef31db7337039df9f411db6c24ba7f124515a4bc00a03313e14fc02deac4fb9eb360225", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296086, "uuid": "6e275e70-097e-4fac-86c7-dcf514c2f609", "value": "T12154F11179D1C8F3C81344346821CAAC997BFC60975A85CB73687B7F2E31FD18A7A216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296086, "uuid": "9d56c300-7285-48e0-8bef-d89b1beec182", "value": "d3c7a24c19f12a796b6b821f5d28152e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296086, "uuid": "a05f40e6-44dd-4cd7-a4e9-506a17a99133", "value": "6144:8py6l73pyg44sO36qlYGUcYxN9EUjxSr:6LkOqCYGUcoPTj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682296086, "uuid": "3f522afa-be5e-4e7e-b344-6c6ba42ab968", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682296086, "uuid": "5e413429-e220-4792-ad92-1fc8e821a86a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296086, "uuid": "84eff12f-3ca8-4946-8828-770fa945fba7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ef55b7-e28b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682332325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332325, "uuid": "435dc07e-6b2f-493d-9d77-edd35844c683", "comment": "Malware payload (Mirai)", "value": "18eb364d819de6da38a208ff7a76e1c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332325, "uuid": "3765bc86-d017-4598-b501-c9ac9088accb", "comment": "Malware payload (Mirai)", "value": "4cfaf1bebb13d331fffd5057a31493360c225452fb730bfd78d67ad4510f0931", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332325, "uuid": "6498098e-59ee-486f-b7b1-fbcb58881c02", "comment": "Malware payload (Mirai)", "value": "f829ee80888e62808cc5f0b608ec4d85e4bc326a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332325, "uuid": "0d9ef0f6-79d1-4658-be61-f409cca7224b", "comment": "Malware payload (Mirai)", "value": "c28088d45c6e727b6f6e9a4bf549e976cb9b1854fea9876f8bb672edd0f77abb9132cc32c2c49a59a8930653525154ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332325, "uuid": "8b55cc78-886a-4c9c-bb42-6eb352c643a9", "value": "T13F83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332325, "uuid": "5f9b2c50-8ba5-478a-99e0-459bf468e150", "value": "1536:iVLyu95K+Hkj752dCexuV/8UZlDwfkJ4MYfWC:iVLyMgrFezxu5VD1er", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682332325, "uuid": "d2e34ab6-7011-43c2-9df3-e6846e577d99", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682332325, "uuid": "248b7302-b16a-4eeb-845f-e62af2dedb30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332325, "uuid": "2422b19a-7904-4b6c-a2ee-70a1af34f296", "value": "18eb364d819de6da38a208ff7a76e1c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a4df01-e234-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682294889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294889, "uuid": "1bfef4dc-01e8-445e-9936-033c3535755e", "comment": "Malware payload (RedLineStealer)", "value": "d60052749f877fafc42258709c346ffe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294889, "uuid": "7d757400-e87b-481d-80e0-186f932f2411", "comment": "Malware payload (RedLineStealer)", "value": "4ed6b4334a719de0889896d7d029a542e8919bed743800f44eca87199f0667ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294889, "uuid": "1bf53e29-3ed3-4100-9126-5e584cca4eca", "comment": "Malware payload (RedLineStealer)", "value": "67ec324bf0c0cb1cecc4e603d98ad757266eb096", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294889, "uuid": "14a8d0a5-935b-475a-92cc-90f133f0cdb0", "comment": "Malware payload (RedLineStealer)", "value": "be1f6668671f0b5cd691581328f3efe46bd7f1c34bf580edce168cea7e2d2f34c420febfdb9b3868a750d5439c5950fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294889, "uuid": "268733a7-e1b6-460a-90c0-87e0af96d6d8", "value": "T1F6352345EBE86532E9F057F058F412831A39FC62677897AF33428A8D5D72284E236737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294889, "uuid": "b3f09c3b-fc39-4387-abb8-68d42c6adc1c", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294889, "uuid": "7c9490a9-539c-4edb-887c-9c3adc64b638", "value": "24576:WypibqVIqokRse8+EfRRIgsC/LguxzqeFg0uzUt:lEmV1okR6nfTIgsC/lxzqljQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682294889, "uuid": "58e975b3-be03-46bd-b397-a60e8faf383a", "value": 1114112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682294889, "uuid": "dffc9178-470b-4c0e-868d-469ed8dab1ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294889, "uuid": "fcee5063-0aa4-49cb-a435-9584d64cbdb5", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f994398-e272-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682321610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321610, "uuid": "e6a1a5e8-1939-4795-b61b-45b21baeec77", "comment": "Malware payload (Formbook)", "value": "5e00fa6a5295e6453759335ecaf99eb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321610, "uuid": "6f9cac25-1b81-4abe-abb8-503b30414b45", "comment": "Malware payload (Formbook)", "value": "4f3beb04e0d4713530c2f9c369c300186ab01d902f060a904e5648490e8ba708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321610, "uuid": "6ba91034-3647-4863-b6a8-d2a964b0faeb", "comment": "Malware payload (Formbook)", "value": "8f5e96b5a91021e4b76c75f399a1954a0c8a575a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321610, "uuid": "71c5cdfc-06be-4cfd-bc7b-573be8b80285", "comment": "Malware payload (Formbook)", "value": "c49fc007f123ce8a89d0ddab80e79b248200f1bc03c24cc57c293f49d60ed116c6cfc5b6647b7218b6a44a2e4946129c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321610, "uuid": "8b2ff8d3-1679-481c-b4e5-9beb0b177803", "value": "T1E2C40254516BA9FBEC8D1BBB0634309D0371B0939429F73D87E44D8E8E46B47EE490AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321610, "uuid": "16d03647-bb8f-41c9-a0ed-de6d8aac8834", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321610, "uuid": "5385b8d6-7acd-4955-aa2b-9b572abdc823", "value": "12288:Y9AaG7JIuCQHFx57KqoUYxBU5nnN5cM3tgnH:Y9Az1IjE5eDUYj2be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682321610, "uuid": "93eb985b-bc88-4daa-91a6-56d4ac24942e", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682321610, "uuid": "4119e74e-994d-4d23-a62c-40b47bd704f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321610, "uuid": "cf403c87-4575-4665-991c-7402a626bb69", "value": "5e00fa6a5295e6453759335ecaf99eb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8680ab41-e236-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1682295933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295933, "uuid": "fd7241c5-6e20-4964-a452-8ee13e79be36", "comment": "Malware payload (Rhadamanthys)", "value": "f94041cd7a8c14d02d07a7ab26c28c26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295933, "uuid": "eb01ce03-607c-495d-a7c7-196422c0fc00", "comment": "Malware payload (Rhadamanthys)", "value": "4f4f6ba8137d0c529cc928b0c77f8a09b8a296d553de6312ca3e4edcd08f3391", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295933, "uuid": "b48ad258-907f-4d08-8b1b-7ddc9cbf3f14", "comment": "Malware payload (Rhadamanthys)", "value": "a54b040fe8734abaac0a721401f0c56d810b477a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295933, "uuid": "15fc5b05-dfb5-4b56-8631-8ca704731337", "comment": "Malware payload (Rhadamanthys)", "value": "78d4338f8fdbd463f9cc887c841347da0de9c1e60e401948158ea9931bba1538ea833e5af28c2126ab0ba3a331975ae6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295933, "uuid": "6ed56e5f-d2c0-46e5-8547-b7bd44f0c398", "value": "T15754E0127AA0D873C45789714C61CBB46A3EFCA08695869B37583FBF3E312C21B77615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295933, "uuid": "a96c69b0-8546-4935-a6f5-22b6c8a8ed76", "value": "cbb199b85bd7e99e36eb212e7f14e32a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295933, "uuid": "c95861be-b022-4202-babe-4dfe42864320", "value": "6144:GUhVOpWmHieie9ZzlWqU254G1lCBhyOz:8pLi+ZBWnhgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682295933, "uuid": "9da338ec-a50e-4e14-a0e3-94b11f749276", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682295933, "uuid": "ddbcae23-4b61-493f-9585-3a91498d3b86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295933, "uuid": "4138c4a5-a5df-4fe6-9e63-82e5d9272a3a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59c9cf1-e28b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682332492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332492, "uuid": "43ec2bb5-8f8d-4084-b38b-0cd13d5410d1", "comment": "Malware payload", "value": "b91c96b657120ff443174f7489dc18d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332492, "uuid": "0ac6a59d-aa73-47fc-b5e3-c35e706c0990", "comment": "Malware payload", "value": "4f70c8bdd5c6816cc90695d522457d5b774886df0ab94ea0d1ee570a75286a01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332492, "uuid": "bac4450d-d50a-4dd8-b827-29eab9141d33", "comment": "Malware payload", "value": "fdc36ed52e6ac811f30032e08dc53ca151dc1879", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332492, "uuid": "1d722779-37d5-4a55-a12b-901fea0e8f14", "comment": "Malware payload", "value": "0de838f7396ea00fc9428a57464e29bda95b888dcccd6ac0c2cae955760d3519240b4c12e4b2eb12a744052daf4075e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332492, "uuid": "8d3ebb0d-725a-4e43-bf95-97087eebec01", "value": "T17022E8C5EB269CD5C80119BD1E775D2B2E6D3423A4140D133ACB7B9EAD229266033B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332492, "uuid": "d0f38051-ef1d-403c-ab40-81230d7a96b8", "value": "1f83362a57e6d6a2f15132c167d7f42c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332492, "uuid": "bb97a36e-1968-405b-a979-afe540805e5a", "value": "192:9CUg6H1+7fiiLX2HS9yxSyrsRt8G3mSF6z:9C4Aiiay9ycyrsR2vZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682332492, "uuid": "72a6f372-cf53-4154-afcb-6e5b6314e7b0", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682332492, "uuid": "a1e74ec4-d673-41cf-969c-28ec6bb61fb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332492, "uuid": "01df440a-9037-42d9-914b-0ad3ad0aec94", "value": "SecuriteInfo.com.Variant.Razy.920040.20757.9153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950fffc4-e2ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682346638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346638, "uuid": "dca0fdc3-bc86-4921-98d5-dae83f5ae12f", "comment": "Malware payload (AgentTesla)", "value": "f91e287d6e638f244e470cd57bbf3b72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346638, "uuid": "393228e1-7c48-4d53-b9e3-e35f400217b0", "comment": "Malware payload (AgentTesla)", "value": "4feea6d3f9c62a894c7dd5661c14c0c1bf6d897356d16de74375c01c44acb735", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346638, "uuid": "c8a86155-0371-49ff-b482-c978ffcabf9e", "comment": "Malware payload (AgentTesla)", "value": "48f5b5d7d2a9c39753dd83acb6abfe8f65e55468", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346638, "uuid": "6e6c1de4-76f4-4287-ae37-eadc72bb2786", "comment": "Malware payload (AgentTesla)", "value": "8ffc36f9f408aaf3b2cfff3eb4a4a32e9813f3689c574da19a0f0b898facebaf0bf98ea801293887bc00697578979dde", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346638, "uuid": "8f52cfb6-02f4-4cc8-aabb-2846beb54ad9", "value": "T1DEC20859E78F02A58F421377931B5E8542BDB27EB35511B2346C533433EEC2D912A6BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346638, "uuid": "13a3e132-4f15-45e8-859b-b9351af9b8e4", "value": "384:kL0AbZSfZwOjkb6MZpe7LDvQVbl6zmo9SVVUHXh:kwAbZSxwOjG4DIVblfe3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346638, "uuid": "270d5d40-104b-49c9-9c8e-082cc02655ce", "value": 27786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346638, "uuid": "0ea1b49e-e99a-48da-ac21-76ef5160e7bb", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346638, "uuid": "fbd48381-be3f-4e39-9b99-7a2fa661fe2c", "value": "Needed items .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a133e089-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333344, "uuid": "1361b981-bf14-4735-8dd2-25e27acf8f5f", "comment": "Malware payload (Mirai)", "value": "89564e50de263aea059bcf66c4852aa2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333344, "uuid": "dca1e844-54e0-4672-9f0f-97b49cad10ef", "comment": "Malware payload (Mirai)", "value": "5065887654570a3c37f03d22ee2377f8a228f51c55f01fdeefd01ad887374cd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333344, "uuid": "92329990-58ef-4f59-b112-ac51e1ac9129", "comment": "Malware payload (Mirai)", "value": "7869e2f47f4dbcc52497676ff532a0cb5d61f0ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333344, "uuid": "a0fa00c5-f085-4bcb-abc4-41431df2fca0", "comment": "Malware payload (Mirai)", "value": "276eeabba7aacd87decdbd97b042d65c63d32fd32937bb8a562eb444391b0a41c4899246fe380e4730da88a0039829f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333344, "uuid": "772e3b5a-cc53-4b88-a8a6-ffa8eb662368", "value": "T14233F19258043165D9702E73B835388ABF9E1BB0E8D5B427063543FC55B086BABBE8D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333344, "uuid": "cf786b31-6ba9-4bf1-b86a-9f30d1cad3ac", "value": "768:QMte5B4PACtw/YciEQGMscgRdUBoVkd8a50OVQJnDQ1Z9q3UELbOs8qMLPVhMwRL:QM84ImvscGdUaVkd8aGYQJs1MLIVmWjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333344, "uuid": "da692691-6597-40b8-a7e9-c9fd7f90fc9a", "value": 53628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333344, "uuid": "0e85c780-fa68-465f-8a14-e226e05b38c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333344, "uuid": "9bc2fc20-a306-43e7-89e1-f4b40b4fb04b", "value": "89564e50de263aea059bcf66c4852aa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced9f437-e266-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682316670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316670, "uuid": "b19560b6-88ee-405c-a30c-8b19e006c2ab", "comment": "Malware payload", "value": "90716974d425efd058207e884bc3237b", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316670, "uuid": "1ee70d4b-d956-4478-a3c0-7568a25fcff8", "comment": "Malware payload", "value": "510cdbb92c4a6e3b5807b9a2bd8fd4fdbb55f4c413b38630a5231ec6a42d1791", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316670, "uuid": "71329092-3a3f-4aac-8e02-40bed5e0b559", "comment": "Malware payload", "value": "9a3551631a7a1b09387f91446456848248d21186", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316670, "uuid": "d1554fba-6d3a-4f8c-a80b-0732d8664375", "comment": "Malware payload", "value": "ed717dd50f70b5cc014111fb08de0a6f3732ddfe40cd3fbff6fb7e0f9b914405bfb3cbb3713879fede21363cae98430c", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316670, "uuid": "dfddc340-a969-4bf1-9a5e-eb3f7ae19898", "value": "T16335F101FA41CA2BD7A1C9364CE7E2E95768BD069F168A5B3348731E3D36F609A0735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316670, "uuid": "bb64cc8d-e73d-4a4c-906f-5c10f4f7c6a9", "value": "24576:NWFBcp/+2M0no07bl5owPeTzRM1x2m3B+vZOTmIAf:NWsjJfvowGTz2x2m3ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682316670, "uuid": "be0429a5-dbf5-44bc-b742-f4db40e77ac6", "value": 1150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682316670, "uuid": "3d919ae6-236c-4504-af92-18d8a543779c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316670, "uuid": "4e2ff707-1207-45a1-a14f-6e820f3cd0f4", "value": "BYO230423.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acf0c2a-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303241, "uuid": "81b376bd-4866-4aec-9954-171c2c40e7b4", "comment": "Malware payload", "value": "b5149ccfe83dd5e95c26fc93d5a9903b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303241, "uuid": "a4d0fbc9-3ca1-44af-a4db-8843865b03f8", "comment": "Malware payload", "value": "51d82c6b405f78ab236d8649d9572497361c2be15f54d7e7e17825eb7ebbe0a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303241, "uuid": "0b027e04-f226-47fd-8672-03a447346681", "comment": "Malware payload", "value": "1a4461ecca99394327612cc57aa0741b9d6a174b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303241, "uuid": "3c03c93a-1a8f-4816-8c78-5f428fd92a03", "comment": "Malware payload", "value": "72d5f1b72f5dd1feb406d681e76ddfeeb59ed9e16535aadac22e96cc3976a2161e0a60cb48c4d582c7974fbd1d3ac61d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303241, "uuid": "475a602e-e82a-44f1-8f17-0ea9c1b5d4b8", "value": "T1E4848E03BAE0C4B6C67B213A0AF757B599B5FD945EB18643B380FA2EE8705019F36315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303241, "uuid": "f3e5d5ff-10b1-40e5-9ec2-67b75143be63", "value": "6144:rkH0xfO2wuT04o0KpyVwZhL6HpGOEQKdqwNs0VKc2wpS:rkH8yI04+p3L6HwNs0EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303241, "uuid": "ea6a339a-b3f6-483f-92c1-9c7192e745a1", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303241, "uuid": "5f8b9258-652f-4507-837f-7c28419e65bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303241, "uuid": "9350c339-8eb7-4c3b-855d-41d26d14e1b8", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.17317.29650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7b5ace-e237-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1682296156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296156, "uuid": "51dc3ab6-06af-43d9-af69-d91ed52d538e", "comment": "Malware payload (Rhadamanthys)", "value": "c6015cb9612e9a6009f619ebf7a79ad8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296156, "uuid": "d6c800ae-4ba1-4907-97c1-369f736a0e31", "comment": "Malware payload (Rhadamanthys)", "value": "52b583610e7e14592e34a046dce1e4fceb6887ce55a0d85ae875ed40e27c2aba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296156, "uuid": "dfe4964d-b04c-4d45-a251-18fff4ca7299", "comment": "Malware payload (Rhadamanthys)", "value": "bea79435df2de60ab3ed93388c8f2d925e776c6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296156, "uuid": "a9c8ce98-531e-4d4e-a114-c8763bb6acc1", "comment": "Malware payload (Rhadamanthys)", "value": "5e755b119b683cb9ca722c8c6efd0b56c48698151c97d4794671bb9e27bf62a56756c146a14fbcb076f686b047cb4337", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296156, "uuid": "7f81f2b7-3b65-4292-9286-97bc99268777", "value": "T1EB54E111B9D3DDB2C00785354875DAB49A3EBBA0976F868733283BBF2D313C29679611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296156, "uuid": "c435aead-29a4-425b-bab6-021952824b52", "value": "d3c7a24c19f12a796b6b821f5d28152e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296156, "uuid": "7fa910b5-910d-46cf-ac39-15239ea2ff22", "value": "3072:vt56RogxVNl+qFmlPwmZqYH6VlvLX4L0hmUqQGZt9bFSr0eenAPWHu/XP7wIJ5Ya:VIy6l+MGNjHQljXhh7GL9+0vP2PM1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682296156, "uuid": "7d4784e9-b7c4-4e51-ac37-beed02e61e6b", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682296156, "uuid": "7952da8b-6bf4-4b14-b938-8977f8b05b36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296156, "uuid": "8d8b5909-046e-4bf7-b010-2133ca04ce1d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00467514-e272-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682321477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321477, "uuid": "084a6f30-4fdb-4870-89b6-639df7d1ef60", "comment": "Malware payload (AgentTesla)", "value": "86bab2137b261c20fb755f41fa0bedcd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321477, "uuid": "2fe05a60-b2b5-49b2-9725-1785957373e0", "comment": "Malware payload (AgentTesla)", "value": "5316effe64674529171a00872d992e275aff5abfdb3165021eae3b5ac5529f70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321477, "uuid": "192f9e9d-c5e0-44aa-b6ca-9c10f12783a7", "comment": "Malware payload (AgentTesla)", "value": "8797c96b60ce2af56becf837f8d29744ac083558", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321477, "uuid": "dbca85b0-413c-466a-a05c-e81b2334fe20", "comment": "Malware payload (AgentTesla)", "value": "3ff0c42e839f76ac76748fe0508994caf57a8760116e9e491e644095ce56f4f9b753401a6d64f200d4fb94e9dad44864", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321477, "uuid": "5ccbcbc6-df5b-4918-8f15-19121e0752bb", "value": "T15F24F109A78CFA5BC26F0ABDD0D28261A7B2D03F368BC7571C4C5164AD2EBDD49452C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321477, "uuid": "65e125dc-c8de-43ef-99e6-d8cf706ea011", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321477, "uuid": "fc936040-4709-41dd-abda-50cd95e97558", "value": "6144:4LhlUWmBWmfoKffKJ8lG7FLXqcbuNZQJ4fGEpFl:4LABYmgifq4GRacaZQEGEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682321477, "uuid": "aab2ac1e-78e1-4cb8-b3df-c0dc4da6ab35", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682321477, "uuid": "8ce0cc7a-de3a-4e1e-871f-14899bd7cba7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321477, "uuid": "7c04c0cc-a24f-4601-818e-1bb3c16e0ff3", "value": "86bab2137b261c20fb755f41fa0bedcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d84a17-e29c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1682339713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339713, "uuid": "83679d75-e727-4307-bc8b-d64a122aa10f", "comment": "Malware payload (STRRAT)", "value": "a11eaab0a2de9d79390793ea19206742", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339713, "uuid": "ff33b6bd-a787-4397-8812-cd74a043cad6", "comment": "Malware payload (STRRAT)", "value": "5385dc6d3d9c0f9c36015eb2bc2274ee2aa3dd285dfa1c8abdb362a84723d8f4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339713, "uuid": "c8cd6f21-1090-4d6f-826e-29fbc0a7bef5", "comment": "Malware payload (STRRAT)", "value": "fdb795658c88ff83cd7da08800577472840d55b1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339713, "uuid": "d65662ae-767a-48ee-90f5-f3f3eb72bda9", "comment": "Malware payload (STRRAT)", "value": "c96fbc754fba037781daddf3bbf4ce4077b8be4099b34af8ddc78bcd440bd3865bf8afb4d829161bc00c8a572f5d0595", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339713, "uuid": "0b0fff89-d912-4c89-ba28-7e85065617fc", "value": "T17963F1BA3CD9E7AEF707753B50024417689781DCC2C5966308F895AB08A5D9E4F027DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339713, "uuid": "23c1059d-6bde-47f6-a6c0-d37fdcb62c44", "value": "1536:NI92d0hT5CHNNDclR3hc3cZJU17nHNKxmws2JUSJlBhFWuOyKcG:u92d2AN6R3w7yhs2JUMlB61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682339713, "uuid": "31fae4e3-9179-45ab-a131-2a9e2b6961e0", "value": 72285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682339713, "uuid": "53ce97ab-6515-4a1c-aeb4-c77ce4e27015", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339713, "uuid": "5274667b-4e3b-452c-87ba-e259e20a44ec", "value": "PurchaseOrder230424.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae0ddf9-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303215, "uuid": "928a0c28-f637-4c7e-916d-6fd4da502ada", "comment": "Malware payload", "value": "54589e90692d0f4ce1ee922961631ba9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303215, "uuid": "ef9dd104-9bb2-4748-b233-d90e19c217cb", "comment": "Malware payload", "value": "552b0efe0cd029702adb947989689bd21bd63c6115e9fcfd86d6caf7c16d040d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303215, "uuid": "f9bb1836-44c3-4392-9479-cbd9472fd144", "comment": "Malware payload", "value": "612701ec9b7f7c7d6d0216f2c2fc9c40b3d364d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303215, "uuid": "cf2dfbec-1ab7-4467-bf14-ddb9e9a5b983", "comment": "Malware payload", "value": "28409abcdee3f54792d3c44f100e96e2899a36017dd4cc5945ef5c1460b4e27e355166183922d1b274d0954dca22bd24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303215, "uuid": "ab591fd4-0404-49ee-80b4-f5bd62b50b25", "value": "T1584412932F623C4AEEF59070654297C96A514BF9B10A4F3B6F24D52BD8E0385EE237C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303215, "uuid": "6b150d52-14cf-4b5d-93a1-6bdd0db20a37", "value": "ab9e6ea6a03a676ab2ac3ba490f84159", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303215, "uuid": "7554bb45-fd46-417b-a487-c3196c39d557", "value": "6144:RAseXXAq9+LxGo1s7yOluL8Q4EvJJMMq/grXb5zWsWCzyeWYo8oS:es6XqLfjX4EvLMMq6Xb5iVCzyeVo8oS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303215, "uuid": "8be4f2d3-eff8-45a2-8d80-a9f35b9d59b7", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303215, "uuid": "8305ce68-79fe-4c18-a816-d871342a40dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303215, "uuid": "b4a2ee50-2138-4807-965e-6d9547e847bf", "value": "SecuriteInfo.com.Variant.Jacard.164525.14861.597", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d278954-e2b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682348718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348718, "uuid": "117ccdad-7050-4c7e-b4a0-91ae20622453", "comment": "Malware payload (Mirai)", "value": "395f7c0bcd343f41908504d37e917625", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348718, "uuid": "15b91712-081f-440d-aa8b-6d7d7e7268d3", "comment": "Malware payload (Mirai)", "value": "56372078dccff783f8b6cf03822c8f641919e2b665306ce2037b59ca287f5c55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348718, "uuid": "7a0906a0-218e-4709-874a-31e91363a9ec", "comment": "Malware payload (Mirai)", "value": "07929afa4eb369b1202955e32bd1ad4d7a9aba08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348718, "uuid": "e9c96758-dff9-4c73-b2f8-2b8d1d4c62d5", "comment": "Malware payload (Mirai)", "value": "6035050ba8f995f0f211107c8a407f91b54af6d47c25899694da7a72f4d0e45245e8d9080aeee1c6d9d5e2d7bc6b08d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348718, "uuid": "8bc78320-56e6-4153-8729-cf7ca725435e", "value": "T1AE634A43A71E0B87C0AB9DF029F727F087D6F93116A62581E10DEEC45772AB02626FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348718, "uuid": "7ccbe6c4-ccd1-413f-973c-63c0594ef6f9", "value": "1536:0IOj+9L0z7RLtIGzoskKpv7Y0umHNm7JZQZG:0rj+JqtIgoS7Y05HNmNZQZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682348718, "uuid": "83c0a4af-865c-4c03-8ae1-07fb6cf76ed8", "value": 69979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682348718, "uuid": "9506c355-e931-4bf8-b75b-a6f7a57b5010", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348718, "uuid": "894faf13-e1c0-423f-a070-92b9a8c0da66", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404914fd-e26b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682318578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318578, "uuid": "a8e60ac5-ec6f-4252-a346-5cc1db730785", "comment": "Malware payload (AgentTesla)", "value": "93d2b0d6872a507221e97d596506813b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318578, "uuid": "2e28909e-c07d-4ad8-ba98-56d0cca2e8b4", "comment": "Malware payload (AgentTesla)", "value": "5752b91a014cd7a4553abc1d0a75a683c2dc1429723b41598f643b32b2c66730", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318578, "uuid": "4ed22770-1a56-47bc-a529-e6252d87e74b", "comment": "Malware payload (AgentTesla)", "value": "16eaf0899ed415a8c9e0aa55e7350b863673fa64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318578, "uuid": "a208ccbf-e9af-4fd4-83a4-d7fd01784feb", "comment": "Malware payload (AgentTesla)", "value": "5596e8c96882cc61a6bf935ea5d6a2ca11741cd5d7f7381ba59746d6d88ea1b399d7e248c07a9701bc2021eb3a84f2d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318578, "uuid": "cc5175ca-0fed-4361-84da-9e6f2209fb5f", "value": "T1905423630587C8D4820BB67C75BAA63C4F8A6F4145A2E5B76F31836C4F81C4E0B9BB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318578, "uuid": "073fe030-faa6-46cb-9f03-5621add6e17b", "value": "6144:oYunZvJMcUEqfcd/dEu3wylA4IddSDh3/qHTeriBvjoIHGPar+m:oxZxza2U4SSV/qHTeripjnGyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682318578, "uuid": "f546c30b-1cd6-4c2d-affe-a3f9ca6646b9", "value": 302935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682318578, "uuid": "624d5570-1f18-4c7f-a77a-401e35f6deea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318578, "uuid": "5626fc74-6c3f-4d65-b36c-e5ea64a1156c", "value": "swift copy 62710958.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f450b5a1-e2aa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682345938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345938, "uuid": "885b59bc-60c5-4ccc-94db-9ea499108765", "comment": "Malware payload (SnakeKeylogger)", "value": "7e542232ec05321a7d1f1a0eb6597b11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345938, "uuid": "ce607f35-a265-41ec-b72d-59d488c2c4a6", "comment": "Malware payload (SnakeKeylogger)", "value": "586153476e8cae5ad225cc3e1e033357e2ba4bc75f30bd7923afddc21c96b0da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345938, "uuid": "90701f6c-9f57-49ba-8a3f-41d42ed5e877", "comment": "Malware payload (SnakeKeylogger)", "value": "6fe1c3516e286efc108d0dca2f31290e779e753a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345938, "uuid": "27b60e56-8aa7-4f34-bd8f-17a9269f09ed", "comment": "Malware payload (SnakeKeylogger)", "value": "71f8b15f68bab9f4ff9d741d50be960184004cd477641aa0183759ce02d30d91aac6d5abc15b0c4b59ff539a50ee804e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345938, "uuid": "b6ed7d6f-291c-4802-9cd2-dc155863ec64", "value": "T1D4350203FBC094B2D076073519A75B21697EF5302BB68ADB57A4496CAE317C0EF31BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345938, "uuid": "d9f852d6-5f12-4c22-925e-a5c7e544e2ed", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345938, "uuid": "ed11eef0-e9e6-438e-85fe-d55d2f4ce194", "value": "24576:NTbBv5rUan8Pr1yqBYB6UXmmNxrndGryTBZX:HBjWr0VBBXVdGoBZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682345938, "uuid": "51cdfccf-36e1-49c7-8cd2-37fceeda458b", "value": 1138823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682345938, "uuid": "43859884-9885-4a4b-b567-f323d5539868", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345938, "uuid": "7cbfb1ca-2431-4b95-965a-7b8bdbcff3c7", "value": "swift-remi-ttance-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba906bb-e2ec-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1682374217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682374217, "uuid": "9a251cad-335d-4a40-b184-80ade194f81f", "comment": "Malware payload (njrat)", "value": "002c9b357b4d75703ef43bfd202e1fdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682374217, "uuid": "7cf16b50-cc9e-4ebe-b742-e0ec56c1285a", "comment": "Malware payload (njrat)", "value": "5952410be9024c73511bed6734b10c99e250b9bab5fb09823e75dde6da4384fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682374217, "uuid": "1bef8cd0-8fe2-45ee-be0b-92d326a75735", "comment": "Malware payload (njrat)", "value": "2a094353218f0b5e7ce33929c2b921fa5de2f1a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682374217, "uuid": "17ac1109-01eb-4675-b5c1-c667eb03a5f9", "comment": "Malware payload (njrat)", "value": "3485b500082f85aedef3c0dd86eb730b383527c6113b0af6508878b479ffbb9527bd11be8dad0e641342919e39eb8765", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682374217, "uuid": "3b7ead1d-d5ff-4957-9dec-e32d10483ce3", "value": "T1B9033A4D7FE18168D4FD067B06B2D01207BAE04B6E23D91E8EE5649A37236C1CB50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682374217, "uuid": "78d8816f-12d2-47b1-baff-d8d24f92a443", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682374217, "uuid": "6225ddee-db12-4f18-b24f-b0729c75b75f", "value": "384:MQ8CT0i99dTe/kCOyU79ePb2DvcpLrAF+rMRTyN/0L+EcoinblneHQM3epzXONr3:Thj1CFU79eqbcVrM+rMRa8Nuo/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682374217, "uuid": "83e637cf-516f-4bec-920d-f2ea8511d100", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682374217, "uuid": "34e81156-3c23-474b-a7ee-e38258e9bb71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682374217, "uuid": "d26a14d3-fc8e-482a-89a1-e86161451ce9", "value": "002c9b357b4d75703ef43bfd202e1fdc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94184698-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303257, "uuid": "5001a577-d192-44e4-aecc-0d50c49f0410", "comment": "Malware payload", "value": "0ceb3000ec822da07594472eda229e39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303257, "uuid": "8204950d-f5b7-43a0-a800-ffab5b2465f4", "comment": "Malware payload", "value": "596b60ce8813bc4c457b1472e8b9e399ac6220498935872c3bd5bfb21094bae2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303257, "uuid": "52ce9fb0-f020-445c-ab54-19af8d871aa5", "comment": "Malware payload", "value": "13ce9ce049ba9b5ff980eadf6b14ceb3f90dc9a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303257, "uuid": "8053002d-36fa-4481-9d71-5d4be13b3307", "comment": "Malware payload", "value": "14a3bd5e4b01907781e9c32f879dddb3472973b9b9d9f95330aa789b143f0fcc0056c146f423d130d6e32b086f6846b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303257, "uuid": "e9029f00-6338-4d80-87d0-49437fa94db3", "value": "T1E2046C02F552C0E6EA764DB1067E1635A2A5AD089B06F5C327C8CEDE99753E33D3123E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303257, "uuid": "0b35712c-f248-4537-84a9-ee3f5007796e", "value": "6e58517f37a95bcdda008cc1131d527b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303257, "uuid": "ebaf8d08-b80b-408f-a119-d3c701ca222f", "value": "3072:vozQefAyAVH3QIZhmLPJBheneAp6je0081VSFsdoh:qQUAyAF34by6V0eIGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303257, "uuid": "ce3c5672-8c92-487d-998a-08d0d0f8c315", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303257, "uuid": "40bcc2de-4deb-44d6-ba24-c833de905a0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303257, "uuid": "bf5ac518-076c-46d1-b051-6b88fc24ec4c", "value": "SecuriteInfo.com.BScope.TrojanSpy.Zbot.15288.31946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfc248a-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682323134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323134, "uuid": "c80d0c3f-64c7-4f1f-8eb4-9bfd6bdd4c2f", "comment": "Malware payload", "value": "fda32078f95178e37a9a4561659b513f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323134, "uuid": "73e4986f-cf72-4fa8-856d-bbcc82395990", "comment": "Malware payload", "value": "5a3b5f30760008c5528ec77c1ed1cc010c6028781ecc9d75f21482a8f794f158", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323134, "uuid": "0d756a4e-af09-4b33-8898-06b46dc10f33", "comment": "Malware payload", "value": "29d562aa0488385ac86c83735a6de5d8e568fbab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323134, "uuid": "285791fa-9a08-41bc-a998-a1feb154405c", "comment": "Malware payload", "value": "501fa8d543575f008613ace35e1dca4d74cbf12c292c5795d94b39a6ba9655de2ad9ce21068749d2e4756e0603125743", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323134, "uuid": "72c6b233-7a20-4c1a-b008-f2922c17242a", "value": "T10B54AF18B69388B5C0511171D9AEB7B4D6F9ED254878274376C0FB2E2F35052FB28B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323134, "uuid": "5ce10910-330c-4059-a25b-bc48462a264a", "value": "6144:noFKnHi1PXs5nZMX7zUcIg6VWxtoloBV+rLx:einZM/kVJ6BV+rLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323134, "uuid": "a1246e75-9366-4d44-95cc-5fed68955d28", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323134, "uuid": "102daa8d-f610-402c-86ec-1a6b17429d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323134, "uuid": "2a81261f-12ae-4e35-8aa1-30616384299e", "value": "5a3b5f30760008c5528ec77c1ed1cc010c6028781ecc9d75f21482a8f794f158", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef245844-e268-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682317583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682317583, "uuid": "991fa554-3eeb-481d-a345-6d30f69bd544", "comment": "Malware payload (AgentTesla)", "value": "eb1864fa704f54e7f92dd0f65584863b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682317583, "uuid": "c3a8833a-555a-4480-a96a-9c58cf0ba0be", "comment": "Malware payload (AgentTesla)", "value": "5bbbee07077b7c2b73f75dfc78006e5c9e295ab11d67dc5dbe6d82c03d57dfbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682317583, "uuid": "84cb16c1-25ea-4bf9-9dd2-b8c84bc5af5a", "comment": "Malware payload (AgentTesla)", "value": "6cc1db291683b54c0c037569ecdb6be9b3da2631", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682317583, "uuid": "ac74e677-8e98-4f8a-820a-40eff186e1fa", "comment": "Malware payload (AgentTesla)", "value": "4d6f854e38ec3bab4a42d194d3e66387025e38240001f889299bea91ce3fce63ed77cc45217d39a9372dedc301868d15", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682317583, "uuid": "73ff2d53-3a07-48a1-97dd-4e9e1515cc1b", "value": "T166942336AE6BD47A42DE6E8494F5CADA2B2327CC8B5851DCE0D1ED9084DA6D1340B3C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682317583, "uuid": "b6feecf1-06be-4598-852f-f8c25f960b5c", "value": "12288:7n6Ux2muIk729n5C1Lv7Y5YEJV1lIiVv39:b6ixW294ZT2JVJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682317583, "uuid": "018c8899-f996-4375-8fd8-2e52d1dbcf12", "value": 409830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682317583, "uuid": "f6d75ebb-e459-4b57-9304-c0313fab6464", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682317583, "uuid": "1b935c81-d636-4922-9b16-51821871b712", "value": "TT copy.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607990cf-e26a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682318203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318203, "uuid": "0c45705d-1059-476a-862e-d96b3bd44933", "comment": "Malware payload (AgentTesla)", "value": "47dd468803e2efd8c02e35bd2256a81b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318203, "uuid": "7957eff9-c84d-48b2-b2aa-4975ce51cf6c", "comment": "Malware payload (AgentTesla)", "value": "5bca553324fb4798736c704ed8aaf8c69add72959486002736bd185bb4829fbf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318203, "uuid": "38d4a439-9028-46a1-99e8-9a506eff9bc2", "comment": "Malware payload (AgentTesla)", "value": "84a0dc5c5a8d7e6898c87967792584e51a98f290", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318203, "uuid": "112bbacc-a7ca-4be0-a0cb-c01ee15d00a8", "comment": "Malware payload (AgentTesla)", "value": "2adae65c91e4360cc724fddf6f07cf882398ff114844c8d33445a1b2afb86c8a6f466716265c87af7c675141fddea130", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318203, "uuid": "fa05f72e-bbae-4dde-be93-36c92fba9165", "value": "T1007412B473F454A3D7B247702FBA1D16CBEA5F26CC90660B6768BD897270BC3850B126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318203, "uuid": "232aa73e-2485-4816-9f81-9cd4a9d4f0be", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318203, "uuid": "fecf11f4-82a9-4479-8aca-35d6e104d4ce", "value": "6144:IxFS5rzHfk4WQKayP3tf2lc3wTwPfais9WTk3rWwESov4+khqsAzTc3eh:yEPH58ayQa3wTGAWTqovwhq5Tee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682318203, "uuid": "58298825-3d6f-47e5-9689-d3d8471eabe5", "value": 365624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682318203, "uuid": "b32321e3-7dfd-43e2-bbb7-ac1cf4658d92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318203, "uuid": "e1efcc54-8028-45e8-837d-9973d9bb9c72", "value": "New Order 2023-04-24-006645 Q73619-rfq 50007155 6000654623 #515.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d678e28-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333310, "uuid": "1943c608-9499-4240-926f-c6bf269d3180", "comment": "Malware payload (Mirai)", "value": "0c0d287f8635ee47d9145bd05ccf7cfe", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333310, "uuid": "2981470e-3850-4207-b84e-999b9ae7da47", "comment": "Malware payload (Mirai)", "value": "5c20ef4795a3f80ff1b05c6346befee5d6e48846b871fd0bbfc645ab1bc25d43", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333310, "uuid": "7b10e889-5c78-489c-92b8-2bd9620716bf", "comment": "Malware payload (Mirai)", "value": "bf03b57b642fbbacf8ce15bf232b16f7668f179a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333310, "uuid": "3860f3ae-e388-4b59-9db9-e7e93931a121", "comment": "Malware payload (Mirai)", "value": "052343293f8f55ac170e38f957e3d1bf4c135152f696f0b1a882075fa2f1cf2da7213f330abcdd49af8222840d521790", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333310, "uuid": "972bb2e3-11ec-4ec0-8fdb-227609ac4ab6", "value": "T103534B17B54280FDC09AC1744B2BBA3AD93775FD0378B2A67BD0EB222CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333310, "uuid": "99e8a33b-ac05-4c43-b2ab-55eebbd88e6e", "value": "1536:rpmbSQ6U3q7cCBT/lZsK/UDiQBrCupimfFoktCeHJYEQMb:YShU3q7cEDlCK/UDJjpi8Fok0KJYEQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333310, "uuid": "b91662b6-54aa-486a-9e09-36dddfb3a9a4", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333310, "uuid": "67cab503-a8c3-431e-bc5c-d377be4c9842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333310, "uuid": "a69a09bb-859a-41df-8d02-bb8c57584035", "value": "0c0d287f8635ee47d9145bd05ccf7cfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1082e0-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330194, "uuid": "e38f74e2-b4a6-448f-914e-9bc069cdd7b1", "comment": "Malware payload", "value": "fe9d3fd7e0081a0f875383fb1aafe2a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330194, "uuid": "7ecd9b21-a3a5-4679-b053-bb649d2a95b5", "comment": "Malware payload", "value": "5c9f5082e44e91e1aed15261e82216e59f2668ec5b25348526aad98472c5d722", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330194, "uuid": "8db6413d-5182-4758-bd23-b9c0a8749769", "comment": "Malware payload", "value": "3969be2d57943ce169f5acc3803639f3ef4d5ff9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330194, "uuid": "f7d6fcff-8c85-448d-8a2c-9630f8de3401", "comment": "Malware payload", "value": "0d409afa6d2dec6cb6ec337f00f3ef4e495ccfd4b4cec86bef5d378ea37e1a84f39ccc2aaf89a7b0b9c42c0768de9610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330194, "uuid": "a5ff6131-4a04-4caa-bdc6-da6d14ff5736", "value": "T11166D1DEA044826ECA5F07B9E4C68E72E431E1F11FBED36A5964C0E41B974A44F1FE60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330194, "uuid": "13623e6b-579c-48ba-95dd-d33ccf3832e4", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330194, "uuid": "6aa05a15-ee5e-4ae0-beba-8ba91ac3c6d8", "value": "98304:W21PeRxnp14RpcySxOwxU01lp5dT70RdJ6APzEkks1d3ZqazpUuqX:W21WeRp5wx91xSR+qXAVNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330194, "uuid": "3fb00d6f-66b8-46d7-8b24-8ab6293e023e", "value": 6676104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330194, "uuid": "24e56c7e-ea21-422e-8ee4-4fd9d9574037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330194, "uuid": "fbef9b5e-5b37-4524-ade2-ffb5876c0428", "value": "5c9f5082e44e91e1aed15261e82216e59f2668ec5b25348526aad98472c5d722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f694e58-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330200, "uuid": "f1de126e-f769-47ac-b2ec-bebe2e093de9", "comment": "Malware payload", "value": "291397c3c864e1cc01c0f3dd49a502d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330200, "uuid": "1cfe3c3f-896d-4a64-86b5-d51c293a62f8", "comment": "Malware payload", "value": "5e4b6272dc2d955c5e52c755ea598f44e324b04466a4e3bacf6c9d845345322b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330200, "uuid": "23fec672-e340-4ac4-9dfb-424e8725008b", "comment": "Malware payload", "value": "64f8b6f162c8faceb239d97ef339cfdcca22aeeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330200, "uuid": "c276f2c8-44ee-453a-a2bb-0baa17812509", "comment": "Malware payload", "value": "66d7415feeb19252ac3f637b43a3c508bade9cf6593854464a30a8ae483ea4f4386f3e8c2bd6ce6edd2cbf2e2fc9fcb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330200, "uuid": "6dc4937c-661a-4c51-823e-5fd40657639a", "value": "T1B536BFBFB10E8A7DC13E933C90868A31D137B5721977C11947D4EA74EB499EA0E7EA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330200, "uuid": "a9de2ebd-d2f6-48ce-999d-bf35e165b8d4", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330200, "uuid": "1fcd1736-7462-475d-b16a-fdeb00123d76", "value": "98304:3VNlCUQ7VJ7aZbsfYMZxU2Tai1x1OdsaDSvd/IYi/:3Veb+ZiYMdTaIxQdhDSvdgYi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330200, "uuid": "7f4120ca-a6fa-4b54-b50b-d44a131608b5", "value": 5187448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330200, "uuid": "c6e48205-798e-4fba-bf23-34da8d103cf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330200, "uuid": "91bfb9d4-f55e-4e9b-9dfd-9d644e11a36a", "value": "5e4b6272dc2d955c5e52c755ea598f44e324b04466a4e3bacf6c9d845345322b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899e6de4-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303239, "uuid": "64046ca7-bbfb-423a-99db-36ce5c7a4b2e", "comment": "Malware payload", "value": "b02eebe4952f275ec87f912a242a7a75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303239, "uuid": "49217090-840f-4db6-a675-bb5d8768377f", "comment": "Malware payload", "value": "5f5b3678e2f303b1ab07e4ac7eb693257113c273a181f42a96ca59077c755987", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303239, "uuid": "8dfffde2-874d-4e62-8809-5ea9f0ae2cb8", "comment": "Malware payload", "value": "14e7117679105c3432871aebdda0c9526911e427", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303239, "uuid": "cd732a70-beb0-4e07-b5c7-3a8d7c477ee8", "comment": "Malware payload", "value": "630d6f9516633cadc80f0fd2c0beab1bceabfb637dfe2de163469a0f1e58f8e2cba3ec2e1f598f16019047f46f677670", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303239, "uuid": "4f19adc2-c0d2-4273-99a0-9121e4db9c35", "value": "T13DE69E81FFDD81FFFA4176F90029D32C81A69561572C29C3F2842AA66D712D2BE3D319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303239, "uuid": "4d7b1427-f6b1-4e4f-b96f-20e39ac20ab8", "value": "d5f43c450f2a81d477c7ac16aa13ebef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303239, "uuid": "d48ebbbd-2bea-4026-9dda-76601340d835", "value": "98304:wa9CzPeL0qXpAU++ukCgQZC3HSt2napOb/11OycxFfHJQh8yCyI54xhuC0Jnb/cz:ozPZ63SCitHg1n6Qua98R/ECbXjOwYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303239, "uuid": "fe7ae85c-64de-46a2-8402-3281616944f2", "value": 14409728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303239, "uuid": "1e236ada-c7a7-49c9-ad1a-301d3799f3dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303239, "uuid": "7f084f71-cae6-41bd-9d19-d82084d99544", "value": "SecuriteInfo.com.Trojan-Spy.Agent.6504.17710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcbc3185-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682323136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323136, "uuid": "d07daf6f-8a6f-4250-9601-23f94131a4dd", "comment": "Malware payload", "value": "b717f6ca6c3d95aee19f13dfa8ef8cec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323136, "uuid": "03bb85ae-7496-4428-9866-636c2b49a588", "comment": "Malware payload", "value": "5fa96b4a828cdc1e5c49d1f428a7d29f440e2dc1c7e916219273e0dde4b51f12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323136, "uuid": "d187dc78-687f-49c9-a3d5-96e67676f3e4", "comment": "Malware payload", "value": "8b41ebc2851b79c83463093be7d7e69cc5911653", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323136, "uuid": "55bee8c1-1a4e-4da1-a667-d34a1cfa2e6d", "comment": "Malware payload", "value": "9f3f6d13529abd7593cd0afdf551e85a7643726dced515367678423432f71655f1a63686e77d3af75568ea35f82163ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323136, "uuid": "efa2b25e-434d-4dce-8760-c4ca7e447133", "value": "T153545A49A601B072CA560170956FF7B18BB9FC359A09E987E2C1FD2F3831641F329B5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323136, "uuid": "5d8ca5de-f822-4fdf-8151-abef8c8b7266", "value": "3072:TQ8heZb/3+yC/B0T/GfH//vxm7PGYXvJ5JjyG9rsc:TzeZ+nmyn/pcPGYx5JmqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323136, "uuid": "dce4ced8-3080-489d-a52b-6090083269ba", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323136, "uuid": "e5f667ff-7cd4-49cd-a0f8-7801d526db80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323136, "uuid": "6cb5df3a-c262-4083-ba07-a2c9bdf134ea", "value": "5fa96b4a828cdc1e5c49d1f428a7d29f440e2dc1c7e916219273e0dde4b51f12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5526d0b-e2ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682346235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346235, "uuid": "e12e66ee-ee07-4d0c-883e-d55b33e6e1b5", "comment": "Malware payload (Gafgyt)", "value": "dcd358d416a60dcdb8b8b39b4c408a7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346235, "uuid": "1443668e-1db8-47f1-bad6-80091017b3a4", "comment": "Malware payload (Gafgyt)", "value": "60da4e8c31d4903d564d8a2b820816e5a5473430836c47e1a4e1c036cde32ed6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346235, "uuid": "d0670e17-3a8f-483c-863f-a1adabb0896b", "comment": "Malware payload (Gafgyt)", "value": "c1f27865b7ab1863198e8c62df47ea6659eff7ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346235, "uuid": "7adb247c-ab7f-49b1-8839-fefe91912c9f", "comment": "Malware payload (Gafgyt)", "value": "454e8da0c9a361af13a97ed2f44baaedc81cd961f60bcb9c678f68a4952364571524d41ccbe4aa0b48b0637e1a2cf126", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346235, "uuid": "835740ec-9865-45db-97ee-0f52ddaf3626", "value": "T1F4734B03771D0B93C59BAEF02DF727F087AAF96112A66580A10EFFC41372AB06515FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346235, "uuid": "980c6d77-cc1f-45e9-a762-06326a913cfc", "value": "1536:lotQm3qLiuNGOHBIeFaBXzI23mJn2vobXqNaW7ZZz1k8iVmX02q2//8fBgj:lotN6LiuNGOHB4jI23a2QeZI/VmX02qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346235, "uuid": "825f14ea-30f5-4ff2-88b0-1d201b681ce4", "value": 80349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346235, "uuid": "e6551abe-c531-49c5-adff-8f276ba14f74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346235, "uuid": "2bb1ac02-5aaa-4929-a2cf-7b44cd31f6a9", "value": "dcd358d416a60dcdb8b8b39b4c408a7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e9228bd-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303221, "uuid": "53bff888-8828-459e-9d67-2e83a5d10000", "comment": "Malware payload", "value": "99fa9ab9dafaef36874cf46b49b870fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303221, "uuid": "88401103-beac-49bb-aa5c-8150e0170ffb", "comment": "Malware payload", "value": "60dc0394a6513819065a88025a9d270e1bb45ab22aa34fc011df99f487c33e8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303221, "uuid": "4730f5c3-0530-4246-90c4-e16618edb972", "comment": "Malware payload", "value": "8228e277eac1539f83597a0618dadbedb57d3850", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303221, "uuid": "84e2a2bf-dc94-43cd-8f02-0a3674726204", "comment": "Malware payload", "value": "5645ff62b3939cbd5e6295c10c1952d813ee90a523b43514b031d8873b1a476289ea7b4396d30c9f039ed6c0c16374ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303221, "uuid": "ca3c3520-916d-4ef4-b03b-2a178616d706", "value": "T153816EE29E49BAD1DDAD3A710147910D6B5BE5C725CC31D30F6B5EB67E7234A0C04612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303221, "uuid": "1acc6b56-657e-44c8-87e0-12adddad0446", "value": "992b55ac6e4285130bc78a171683f859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303221, "uuid": "ce87a9bb-3c38-4ff0-8fd8-1217ee05196f", "value": "96:cRvJf3iv/rWU+Has/behhROxslkO3l5CmkJV8Q3JDYNHEKqk:avJf3FUWasDcSxslkO/wJiUKHIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303221, "uuid": "e7a18b37-6788-4558-834d-ad5a62b945a9", "value": 4088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303221, "uuid": "c9fdcfc1-4d4d-42f6-b9fe-8a4ae3cb9532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303221, "uuid": "14cc6380-8ed5-4ea8-bd99-57b1bb1761b9", "value": "SecuriteInfo.com.FileRepMalware.5378.16772", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0076fdf-e237-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682296539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296539, "uuid": "5beff59c-085c-44f8-a51e-a9517e45faed", "comment": "Malware payload (RedLineStealer)", "value": "37d92fe11030583f0550d6061890d3fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296539, "uuid": "3107e127-6a9b-4132-9e49-f3a4286d0ec2", "comment": "Malware payload (RedLineStealer)", "value": "61c10fb9611d706df42e866fe224f5116523042bec9e48521b571a6307168198", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296539, "uuid": "ef6d6bb5-ba33-4972-8810-dc0b8dc55ec6", "comment": "Malware payload (RedLineStealer)", "value": "5cef0ef3b5dc41b91e7588c10dd43611579903ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296539, "uuid": "0bb767e7-ec9e-4f33-998c-76bf5943abb7", "comment": "Malware payload (RedLineStealer)", "value": "3ee3518fc1a6582499c6f8bf58e103d00f9fb988a3c080003fbaa7213aa9eb209e18f6b0c55955ee23a408ecd76dd536", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296539, "uuid": "e510fff5-eb7a-47c8-9522-67525d6fb48e", "value": "T116543B1BB1A59010E6DEC5FF01EFDE78883B6421A7F21395E28D9B17121B15662BF0B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296539, "uuid": "c90812d8-96d6-48f5-a76e-ad58a0e7d20a", "value": "2ec1e43fddcd7fe383eaa8dbeb0dd6de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296539, "uuid": "04970e0e-7a15-4c55-a3d3-349fd241177d", "value": "6144:TESKVM1LFleTxVH9iMj4d/lcYZ/YxQ8l9x:tKVM1Lw9beloQ8l9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682296539, "uuid": "14e26076-32ab-4dee-b727-a58393333a36", "value": 279712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682296539, "uuid": "271b6364-5267-416c-965e-8434da7ebbc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296539, "uuid": "9e735058-96f8-496e-a9a7-9c238ad7b268", "value": "SCRIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c059545-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682333201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333201, "uuid": "c5be39fb-214e-488b-b2ad-3a8fd893c572", "comment": "Malware payload (AgentTesla)", "value": "8a19dcc52939c0d4a3f6e03ee303a15e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333201, "uuid": "b40332c5-33a9-4ad5-885e-c2733afd7899", "comment": "Malware payload (AgentTesla)", "value": "626c7261b4b4a048d5e33a12d1cdc21a2c7f6ef5524938a372a1578692ab1838", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333201, "uuid": "a91c2f40-0b85-41b3-b415-559cefde6731", "comment": "Malware payload (AgentTesla)", "value": "1cb0228c249f8c430786021224d485c375996dd1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333201, "uuid": "bdaf6134-fb12-45ae-9eaa-f2f467d8878b", "comment": "Malware payload (AgentTesla)", "value": "38488ad4ebe3eeb85251e03f6b74cc42ce54c7d1af459aa9b12f96a4e709eefa14963746c850c0823209081fb7c474c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333201, "uuid": "6a9aab18-b0f9-4adf-b8fb-2f253f841bc9", "value": "T1BB33F1034F90F7E8525749BBEFACFD1A5B21C68D5C057613328A1DE12E95EEC0286817", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333201, "uuid": "64e9f38e-cbba-4da9-bfac-4f9070883ee7", "value": "768:WbwJrq+VRsc+PcNsumboMboZ0qiwsB72iAIseIwAgqliihU1g5gjkDu/pXn0n3Ju:RJf1N4boMcuqNsAQI8IXSiQ/pe3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333201, "uuid": "3890dbef-ff65-4afe-803b-f27b5b768cb6", "value": 50194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333201, "uuid": "20e7bbf1-9b31-4cfc-979b-97c95a26629b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333201, "uuid": "e26d1e42-a136-44db-9a22-09dedeb004bc", "value": "60847253_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c512d59d-e26d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682319660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319660, "uuid": "d3f684ab-aacb-4604-810d-5bb4491f169b", "comment": "Malware payload (Formbook)", "value": "a9f7999b4e36f74de3c8309745eb7456", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319660, "uuid": "8622ae13-a34f-4a55-a93e-dbee4f5643ae", "comment": "Malware payload (Formbook)", "value": "639bf7ee39d021e52f513f8f18a28403a6022dbd7f0a63dd5fb7a097ece5a6f5", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319660, "uuid": "eb036da9-3fc1-4533-9c66-f80788c4e404", "comment": "Malware payload (Formbook)", "value": "6b6d4bedf95a1795a2be331d8912cdded013100a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319660, "uuid": "569bb588-273b-4938-9c79-8d6a048372a1", "comment": "Malware payload (Formbook)", "value": "738b87c2439ab7595c28919cf520f8f04a480186f1c271e1cee2be2fe490ae6c2bd8e025a38dbf3a617583b45b99ea22", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319660, "uuid": "9fcf9d6b-55a3-41c2-b1a0-7ee22b9f4b1e", "value": "T1C484D04584F8C8EED1B9D5B20C91F98E76137C1A5C210E965E13F4D9E8336822AB3E1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319660, "uuid": "6218e397-23ae-44d7-b9ed-7077e1a2e4f8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319660, "uuid": "1a7cbda8-12ae-4044-a34d-925c88e8dcd0", "value": "6144:8Ya6w8IPXKtO8tPGFlTcyLpsFecHG4mBJ5w2cR9XyJt9p5Xo7:8Yi8Q6wDFlTcyaF5GDBJC2cRRat9p5X6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682319660, "uuid": "491156ae-b3ba-41c1-a00f-3f3ecc8a4d49", "value": 390432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682319660, "uuid": "92623237-6617-4100-9cf1-a025ec1cae4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319660, "uuid": "d892e94a-239e-4e94-b7dd-221dcc8ef64c", "value": "DHL Notification_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7705b6-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303249, "uuid": "8024e420-a914-4936-a911-f6fa6486b039", "comment": "Malware payload", "value": "e7b56336f3039c17738849cd25d99b12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303249, "uuid": "1a83f6b7-3414-41fd-942f-c5b6cce79c4b", "comment": "Malware payload", "value": "646d1bbe3f55cd98211696ce9eec2f0f3d3d6c774b1be77a677fe2f383220816", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303249, "uuid": "da1e8c49-0592-451f-9954-758898a0ea27", "comment": "Malware payload", "value": "172d50813798bebde8c81bae59348f6076b9df50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303249, "uuid": "26b25699-f98c-4b3a-94b9-9916d1bc30e8", "comment": "Malware payload", "value": "eb213a45772b5b34f9c3d4e2a0cf26611fc629e3b3c7e01d4f0d78785747e68c33300a1f693917fb786a6d9bc34f7896", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303249, "uuid": "f4a94c47-bacb-4e54-ac63-cbacbabf5640", "value": "T18DC2E9E52F41E993FF292532261D731CAC8431879A10B6F9FC0E8DD99D6A3611A2D13F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303249, "uuid": "d2c655e9-3b18-4c55-8280-83b49676dbe3", "value": "384:DhlUBDgO9F4SBCshbcm6NWGmDykPt7/neTOjKAR84MS+oJ:DbU2O/4SBnGSGmLFa49+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303249, "uuid": "5ee8f16f-4e67-4233-8d87-b40d263a1c8f", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303249, "uuid": "c80327c3-d03b-4e1e-85b7-d331463ec349", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303249, "uuid": "51cb118f-474e-47ff-aaa3-2ca4547473c5", "value": "SecuriteInfo.com.Variant.Zbot.4.9210.11477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b1e21b-e236-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682295747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295747, "uuid": "ca1d5d94-4ddd-46b2-8d69-540c0d3cd3b0", "comment": "Malware payload (Amadey)", "value": "808bb423cce6dc2b2b1cf053032582ba", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295747, "uuid": "ebab789b-ab51-40e0-87da-685c61171d0c", "comment": "Malware payload (Amadey)", "value": "647afe227b07e0b2eee651cf8273b18a225a306c1bfc46119de5d1f6459db409", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295747, "uuid": "10a3b5cc-cb00-4319-8e33-dfb3ffcfd71d", "comment": "Malware payload (Amadey)", "value": "512ceec6fcf045330d15a906c3d7718e746d5c11", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295747, "uuid": "e483a2e8-73d9-4b11-b04e-4d3adb313163", "comment": "Malware payload (Amadey)", "value": "1d537f6085b1ce5717e9becd37000da3265a3becd064089e79a4986cf877618e25426565dd2f4a95e2b92a07b4bb5595", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295747, "uuid": "251bf04a-51d4-404d-a4b1-1e4b9aa9aff4", "value": "T12B34D012BDD1D0B3C40B84714864D6E87A3EFCA057A686C7339A3B7F2D717D18A7A291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295747, "uuid": "8b83852b-fa14-424f-96b6-c569c6beb123", "value": "642f639d014c52fc4358f30dfb7c046f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295747, "uuid": "54777748-24c4-492a-96ab-ca12375f7766", "value": "3072:ytPKwWzVvYj1pOFxwqKjC1vth13AAZ5YR3HrJBxQ/:4Cw0y1pmVK4v313AAsZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682295747, "uuid": "b1987c04-9ec2-44b6-8ba9-7762c7ff4849", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682295747, "uuid": "3c6124df-8012-4891-b937-144a506a8cf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295747, "uuid": "e9b5b442-b814-48a2-8ee9-623f86ab3611", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11955368-e2ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682345988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345988, "uuid": "4451f094-533d-4015-bc0e-a2d90a2abce8", "comment": "Malware payload (SnakeKeylogger)", "value": "d6e0f16cfee6b5c9acd6907a39772e17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345988, "uuid": "dde96646-c3f9-4f8f-ae2d-44427ae779a7", "comment": "Malware payload (SnakeKeylogger)", "value": "64879bdaf4add0db2f52b2cfc4c579b15fa5263601aed7c3aeeb926f0dba1acf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345988, "uuid": "dfd921e3-7638-4d04-9178-ba67536bb531", "comment": "Malware payload (SnakeKeylogger)", "value": "cee93aca3ea268de092969938907434da4e1952f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345988, "uuid": "5cc47784-6042-4cfe-b0e1-6f983e20202c", "comment": "Malware payload (SnakeKeylogger)", "value": "c06b2cfa6ef268fd8e002860164d58eabe5f1454cc7ca6e4868649bc2b26805229d46abf4c3a782c12f8680cd2555695", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345988, "uuid": "1508ce28-5c0c-4978-9ab9-75d788548f6d", "value": "T156D4BE2B222AD9B6D15E66B3E0D617FB0F1C2ECAEE79A1430B6C7DD431723791B48411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345988, "uuid": "c3cb2ee8-835f-4e4a-beb9-473b0a634a1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345988, "uuid": "bc18535f-e7e7-4b8a-bcf5-ab26cb4c1bd1", "value": "12288:X84SE833GmQ7LnWC+vVK8tIPOySYxnV3y3POPysW:X84wHG77LWCCVKh/SY5VSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682345988, "uuid": "a2e3dc0d-c4d7-4bb2-ba25-ea78b502ad94", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682345988, "uuid": "e072f08b-4544-47fe-a579-22a7977cab7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345988, "uuid": "c54d8ba7-9e71-4e14-b58e-7dec4e28c840", "value": "In.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cd1bbe-e235-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1682295601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295601, "uuid": "b31aec38-10ef-4f64-9d61-8d9dd011fc3b", "comment": "Malware payload (Stop)", "value": "896554b49f480f41f671b8f550818b38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295601, "uuid": "fd3a528d-fc61-4586-a5f3-f878028c2246", "comment": "Malware payload (Stop)", "value": "65677a9fd2c07b15e5fa70ec64a78a425da7def6c77ab5e8ba9fc5629da6917f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295601, "uuid": "ee3b67c5-a65d-4d05-842d-4f2cd961781a", "comment": "Malware payload (Stop)", "value": "194c9ae587d1107c37879a83766c5de0d6ba26c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295601, "uuid": "9bff3a31-8711-45bc-9c79-e63ab29e54cd", "comment": "Malware payload (Stop)", "value": "ff92915bb4ac1ee329ccf3b438241e2e7e32e6b0ac9739a3ba5530cf1ef20ae589ed9c298fa7f9b3218beb1d60fef996", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295601, "uuid": "da264145-7c8e-4555-8ec2-58f63b66db45", "value": "T124F42202B550E973D90B49392844C769BB3EBC62622E965BF34C563F6E703F18B38356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295601, "uuid": "3dbaebaf-192d-4b7d-b28d-869049dbe64c", "value": "cbb199b85bd7e99e36eb212e7f14e32a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295601, "uuid": "f703ade7-d029-4e39-a011-553e0f9939ff", "value": "12288:l/6onYZWtdFDOt1Y1KsVZ0TR/4s+Gw6wimG3XR/OJmYsQ4CKb3M0hN3:56O2mzyRRBfOJma4CihZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682295601, "uuid": "0a2eaa20-515c-4978-9ee4-3bf3b2d9d2b9", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682295601, "uuid": "04c64bb9-f5eb-4d2c-a561-b049f85a57ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295601, "uuid": "b1aee583-3d1b-461e-bebf-59188030ccbe", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a21e15-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303253, "uuid": "8744209f-b5ea-4aec-bd65-f4ca2c05e0a8", "comment": "Malware payload", "value": "8b597483f836ec657f87c0b68799d2a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303253, "uuid": "68a39896-109f-4ecc-9f38-1d99d7e6941d", "comment": "Malware payload", "value": "65834f2d4a3bd00772bf6b5c6f19e79332e056f8f5c8fe566ee5d09a38fcc91b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303253, "uuid": "ac14e5ae-e43f-44d1-a849-af01caad784f", "comment": "Malware payload", "value": "de478db4430b74697f3eaac4e3c037a6e3d61755", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303253, "uuid": "c6e19a10-07aa-4921-9d5f-2794b3d52c4a", "comment": "Malware payload", "value": "08fd7afbfb8a5964c0beff18fec3773bbd1c95926b318d660b24e7cfba22f738f8a4603662ea6ca18630dd78bbdacd32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303253, "uuid": "092651b1-9c94-4cc1-a768-ed38f14e9aa1", "value": "T175E3127A5F634802EEBCEB73E1EFA2515754DE16D857C98D30846869EF78D022D09CB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303253, "uuid": "889b5f41-2d04-4b3a-9d71-403df97929a9", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303253, "uuid": "298a9ba6-d2dc-4896-ae54-1e5f321fb142", "value": "3072:b7Ad8qnfe48aFDJAI4USbLxoKcZj6Nrg3C9wd2Q:XAd8SDL9AI4UShoKcZMM3C9I2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303253, "uuid": "fd43efb0-5033-413a-8ac8-6eb594a10b05", "value": 143221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303253, "uuid": "7882e44c-a15e-4e67-b09f-b8835090e5df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303253, "uuid": "4ceaf568-c1e8-421a-8a4e-9c86f5387244", "value": "SecuriteInfo.com.Trojan.Heur.RP.iiadbqEaQci.30508.7934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c76e5d-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330206, "uuid": "c905fcd4-4839-4fb0-a5c0-f3780797dc5c", "comment": "Malware payload", "value": "760106dae12f02764137bf22db38a284", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330206, "uuid": "5ded3492-f23a-43ae-a1fe-a320da859b8a", "comment": "Malware payload", "value": "66383d931f13bcdd07ca6aa50030968e44d8607cf19bdaf70ed4f9ac704ac4d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330206, "uuid": "4d9e8928-3fea-48f1-b979-e0e578e0fec6", "comment": "Malware payload", "value": "e8746bfcf02e33773312432f65bfbb3efcdde1cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330206, "uuid": "90361abc-caff-42f6-a241-fada6c1ef297", "comment": "Malware payload", "value": "e39c94eeac91eea01dd09d562f115ca2f06c90dd4e9a09d2edf05f1de36f464494396aef83f1e5fb4c32a19bf2e9bc23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330206, "uuid": "e1a2eeff-f710-4cb2-b3bc-a31cc4fb5e15", "value": "T10C36CF6F609187BDC206D232C1BE9B34D93371E14863C63E96C1E5B16A95D248F7EBB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330206, "uuid": "63c172b6-27e1-4c62-a60b-dee099efa005", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330206, "uuid": "e45b9cb9-b727-48f5-9c44-46994918aa25", "value": "49152:ZpghL0GxlIP8oa2op+pChboi2CjASvvhyZVW3JvDTiY4ekJb7keVPPm3RYnfjJ0z:zWunEMe3SuLeskqaTVm5alfYPy7FGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330206, "uuid": "8774ce93-78b4-43db-9865-81ac492f8bc6", "value": 5096032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330206, "uuid": "a0b6d28d-9ea9-4bc1-876f-64eb706520c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330206, "uuid": "54bbec70-8c4f-4cba-82ba-62a8ba69ad59", "value": "66383d931f13bcdd07ca6aa50030968e44d8607cf19bdaf70ed4f9ac704ac4d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470d02ef-e28b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682332333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332333, "uuid": "04923a31-12db-45da-8984-fe77f18dd3f3", "comment": "Malware payload (Mirai)", "value": "6b9b201c2eeddfc465b81c92f3e058e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332333, "uuid": "8f7c150c-7f32-44c8-b972-a2b7b5fc28b1", "comment": "Malware payload (Mirai)", "value": "667e266b26e68bf39c356841c7f592a8f927566b6f9e40ce143f9529c95d194c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332333, "uuid": "a27b3bca-6abf-4664-85d5-ef6eabf7d2e9", "comment": "Malware payload (Mirai)", "value": "3b6cf805ef99c5f5c56a0408fcf6c2d1a03ef748", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332333, "uuid": "4bfc66ed-5c9f-41f9-934a-f6d35ba01737", "comment": "Malware payload (Mirai)", "value": "20b81e02ce2301990fce9c0d6fc2dcb8b1a3934c8c44a1a2459c967b132e046da51b2eff143de907764037409bd5b72d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332333, "uuid": "48a4d99a-0d5b-495c-a167-c2bf5ae4ff46", "value": "T1E1735B24A97A2F26C1D4A17E62FBC321F1F6230E25B4961C3CB60F8EFF1465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332333, "uuid": "89f51ef7-7eab-4ab7-b08e-f31e1a3a04c2", "value": "1536:ubHmkTSo3BOIqS5aq+Dc03FR9QuEk6vNNicKzfOFx8:kmcjaq+DccFJ+vN4FzfK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682332333, "uuid": "de4fd776-48c1-499e-8d71-58f3700aa1dc", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682332333, "uuid": "46ad7c33-b2b7-4e91-8c6a-a9e024931778", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332333, "uuid": "715ef0d1-bdb5-4652-b39e-4f5abc59a98c", "value": "6b9b201c2eeddfc465b81c92f3e058e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82da668f-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303228, "uuid": "a7e796fb-fc62-4ac3-8bea-610c64767cb4", "comment": "Malware payload", "value": "6fcf9be5658d950df6f325c3e122c809", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303228, "uuid": "c438be15-568d-41ee-96cb-c32bedd2907f", "comment": "Malware payload", "value": "67807d27c793c63b053ad67a4f7ff8a4d50a0e852363ca4965825117c173aba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303228, "uuid": "3a45c3b0-4975-47d7-a07c-706cba1a6220", "comment": "Malware payload", "value": "98bc7c94e1cbfae87de3e08a40c65354c0de9e11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303228, "uuid": "0de618f0-26ea-4c0d-8dae-7ec47fb637d7", "comment": "Malware payload", "value": "d2fcc709d22162cfec90b2062322b97ab1c93c3ac49c734f0df1c2f400adc816770c4a2ec13b584c3e33cf899ebfc73c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303228, "uuid": "d263fa52-ca78-4517-99dc-89f4d8764dc3", "value": "T156817E53AEAC2F13FB5953783C4C80643DDECAC10A8E97B3562F11487DE2EA84619770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303228, "uuid": "b091b4cd-8e48-459a-ab13-7969a7c53cb4", "value": "992b55ac6e4285130bc78a171683f859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303228, "uuid": "bd21ffd7-42ca-4b9b-883a-241e8ff1492a", "value": "96:cAWTbEjV8b1ElBDK5h9oEhzlG5ZqCuuthYLJPDw:PWTbEjeb1QBDKf9Bl84CuuthYLRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303228, "uuid": "cc87e23a-cd23-4c86-a5e6-1d4b00a6f8de", "value": 4075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303228, "uuid": "2efcd96a-0c36-482d-971b-4ec4392c04e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303228, "uuid": "04ecf3f8-b273-4a82-9964-86ff3f5f3525", "value": "SecuriteInfo.com.Trojan.Crypt.21376.17981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82499999-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303227, "uuid": "9ea9b20c-9c7a-4bad-9acb-21c5cef53250", "comment": "Malware payload", "value": "1a4f7f1844a3805e382e7247cc9aa5db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303227, "uuid": "a303b73d-ada3-46d8-9a23-221474934ba0", "comment": "Malware payload", "value": "67b03f8e51476cff5d97b5de0d73c4df226ab2733c3858fe504b9a270c3539ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303227, "uuid": "adacada3-2ce8-483e-bfe5-0014436e1d48", "comment": "Malware payload", "value": "3e03305a506937167bad94dc6e02b08b8dafa1c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303227, "uuid": "24d91d79-dbd5-4f86-a0fd-2f0a6f12b966", "comment": "Malware payload", "value": "89d09a947b0abbfe4ec2f256eaf0e0f3d0b1d5634c88b67b7a6ba3430ddf5c99af6b107b58e81a26641e2cb2bc60a3c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303227, "uuid": "4eaf388f-88a3-467e-bef8-97a628a89e56", "value": "T1AAA5EF662481877EF84C357D952F70452D00FAA6BCECAAAEF530DB5748932A2DF54CC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303227, "uuid": "024b97f2-889f-4c5b-beed-411b9ba406d0", "value": "871f566131c40f544851d687e3ef38f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303227, "uuid": "ed142f88-584d-4467-a3e9-6635b59423cb", "value": "49152:N6hY5hr5NoR0M+bqralcz8NaV6Z1oZKGkQv1tPf3AVal31MYOKt278DsyYUw:NEm5U0M+bqWmz80YZ1ITkQ9OcpOoXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303227, "uuid": "ee5e8ac3-735d-42d7-b86c-596351464d9d", "value": 2225401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303227, "uuid": "192234a8-5fed-413c-9ffd-dad4b8ed4799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303227, "uuid": "1c014e0e-40ce-4f74-8d78-e51183bcc4c9", "value": "SecuriteInfo.com.Win32.Ih-C.26923.27307", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f35abe-e235-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682295415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295415, "uuid": "25b24185-0d72-484e-97e0-7d7624f04c5a", "comment": "Malware payload (Amadey)", "value": "5aadc98d71baa32b9a42daeb1570e48f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295415, "uuid": "c5820dc4-fa20-421f-a54c-5b46515feba4", "comment": "Malware payload (Amadey)", "value": "690a0c8356c18e5c281e9403a7a63de8448e1a1cba798e7ea6be3d1c72d50cc8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295415, "uuid": "a2042ee6-7134-4b15-ba53-af1c5f039f8a", "comment": "Malware payload (Amadey)", "value": "fcdbc81e8e7206fb98da9fa7339e7281e14849ba", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295415, "uuid": "f3bcc5be-1488-4dd0-a8d3-73f432bdf7ec", "comment": "Malware payload (Amadey)", "value": "f7f2306146334527959214b3b3dcf3c929a2baf34327851e52d6d6d7a54c7706d4e3d8af636928cee0bc06e5354f691e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295415, "uuid": "e90b6d07-464c-4d33-86fe-714969499102", "value": "T1F3152262A3E85172CDB5137008FA57C30A3EFC805A7693973798995F4CB2A84B5353BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295415, "uuid": "df613490-c22c-420e-8edb-b9553e9e68dc", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295415, "uuid": "ddf98292-f5cf-4e27-9ea3-4913ba69e8d6", "value": "24576:tyRAeKyKs/lvfX1LI27pzP41JOZI3awOD4z+yjdF:ISeNtVLxPDZI3JnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682295415, "uuid": "fd8076d4-4754-415b-92c9-2bf0d21b2eab", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682295415, "uuid": "f6f1a2a2-c655-41b8-9495-d8cd7cb8815d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295415, "uuid": "1f1b00df-a984-49aa-a1b1-7cb96f508f27", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f31eeb7-e271-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682321180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321180, "uuid": "3f2b0675-8da2-451c-9b52-02981b996db0", "comment": "Malware payload (Mirai)", "value": "2ade19b4a3d52e40bd7be26dd1cb9f04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321180, "uuid": "029aec8a-6756-4380-8e1d-943d43af76dd", "comment": "Malware payload (Mirai)", "value": "694b3d59a3d711afa27da20418444e5372beccdc95d0eeb0cf41253d50004803", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321180, "uuid": "4539bceb-46ac-4166-9db2-fad1df9d4064", "comment": "Malware payload (Mirai)", "value": "c79cdc4f634f70366ea1d2ec1d2fafada1c265c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321180, "uuid": "0b1993a5-28b4-4aa2-9837-29cfeb1e5eff", "comment": "Malware payload (Mirai)", "value": "a6307c9376af53fe87e38f4dc91e4f9381753317c5d0507c9b43775eaa07c75168c60d9cf21f68e1684efc6aa147e2d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321180, "uuid": "8a167745-e8db-45ed-af89-67feace097a5", "value": "T121C33C46EB818B03C4D527BABAAF42493323D755D3DB730689286FB43F8675E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321180, "uuid": "7f2d5fb2-28d6-42dd-868f-c690fc7483b5", "value": "3072:tmq4EWJ9ns2qMdi0MspujdP4+tND+XxnM/96B/:94EWJ9n8CMspujdQ+r+XNM/96B/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682321180, "uuid": "9d8f4f3f-428a-4974-8cdb-dcc36131c920", "value": 122670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682321180, "uuid": "7c0b66c5-c1f4-48fc-9599-5803ef7a06e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321180, "uuid": "fb02f843-b662-454f-a91f-377cecffd81e", "value": "2ade19b4a3d52e40bd7be26dd1cb9f04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f1e58a-e2ea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682373018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682373018, "uuid": "c08adfda-0d1b-4560-81ea-ffbb82846f12", "comment": "Malware payload (Amadey)", "value": "00ecf5354e6fb6ddd33d4c3cd5e14463", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682373018, "uuid": "b8fe518b-489a-441d-acae-05df634f09e5", "comment": "Malware payload (Amadey)", "value": "69526b6f69c287a4aed9846e6635471ce98723cc9f0aff839f6a22d310a61492", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682373018, "uuid": "4ef5aefb-9e4b-4b51-a090-ef73f84a2449", "comment": "Malware payload (Amadey)", "value": "fc62cfa4c9949f32e9627fdc8f594e94662c61b5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682373018, "uuid": "3299f8ba-4073-4e5b-9670-4ce0cc715fdd", "comment": "Malware payload (Amadey)", "value": "a374aaf4e89543364850450996836be74b10f976ee450af6997b3331f30bf94dfc5002766cc47854f828dcf510f89cb5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682373018, "uuid": "448e129b-eb2a-43d1-b1dd-08aacf6c743b", "value": "T1BE2409217D16C032C565917629F9BFF2C19CA8269BB049DB7B800F7BDA112F72970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682373018, "uuid": "116e69ca-6583-40d4-a87e-979bf8e9ad57", "value": "88e77976ee88242bd495e2b66bf3b0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682373018, "uuid": "4a1a707b-5197-45ac-869f-6ba9ce397139", "value": "3072:LYPem9FABIZr05LqT/6JeLECzdhgMYNB2tndulyzphHe//KWQeLJnaCG5BW:Ly3ABW2meJNEdyz2vulyd/WjG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682373018, "uuid": "3190ed2d-0d28-4684-90f5-dd251a9fd447", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682373018, "uuid": "11a50e82-e441-47a4-bb4b-252de7649203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682373018, "uuid": "41a2bcfd-1516-4a4f-bc3c-8e9d916fbab3", "value": "00ecf5354e6fb6ddd33d4c3cd5e14463.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a1edbe-e272-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682321756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321756, "uuid": "b4be7ad2-b668-403a-92d8-5e4cf8b3c081", "comment": "Malware payload", "value": "adf7d435a5d534353b4dfde77b51ec2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321756, "uuid": "65f305a6-940c-4f36-b550-f4b2222cd099", "comment": "Malware payload", "value": "6a2ba4bf69188bc9791b026558ae135ca2ae4bde1d4af21656b3838b807e170a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321756, "uuid": "8bba004b-b218-442a-8f38-93911029b2ae", "comment": "Malware payload", "value": "ee104cb62e0b6c0a765405ba4da0ede1242c3ac9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321756, "uuid": "a65cc72a-3fa0-47b1-9df3-30fb67b8f730", "comment": "Malware payload", "value": "c0840c9d2d105a401c449c4eb560a5a8824c7bf78359e864136e06785bc2c7a0abfc54aeed3a222926e798e661a0d770", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321756, "uuid": "aa66e7e3-4282-46f2-8590-92a250a91df4", "value": "T157B533FE5E5B3728C13A6A790C1FF10999B740EB1E21742E039DC279B6449D1DA22F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321756, "uuid": "f97f122b-77c8-4f14-89eb-7c4ab0a3d3c3", "value": "49152:7WwK7lyjmmI5subRUshGjMzudNpXpakPaEjXjD/1unhVH:7WwsKmb51RUnjiiLaEjXjD1wVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682321756, "uuid": "84072c20-1ab8-4cde-8c8b-4b335f98c419", "value": 2299050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682321756, "uuid": "fd89431f-73a9-4606-ab77-dc7e668fce90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321756, "uuid": "c6668eb0-a907-496a-b4b9-cc1f5bb14312", "value": "adf7d435a5d534353b4dfde77b51ec2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af50ec8-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682346943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346943, "uuid": "bd07a625-2809-4e51-9d0b-d87dd7c84e08", "comment": "Malware payload", "value": "cd4c5a53b0ae2ef3e44bab2321ac93f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346943, "uuid": "1e450a1b-adca-48b2-9933-616fd244b8f6", "comment": "Malware payload", "value": "6bb4fb7b7aa4a2cfe672f6c0c6872eb2bd5ec0580552d60d56f69dcd44272e75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346943, "uuid": "e9767003-b544-4543-ba19-bd62ba939454", "comment": "Malware payload", "value": "0affedbca37f030ca3755ab8c0bde2f83807bd91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346943, "uuid": "378afa1d-6fb7-435e-a4ad-e41a0ecc2d47", "comment": "Malware payload", "value": "3d95d9bf0513e818f467fb2db5024e5b0ff49a28e92fd0c1ef7819510fcbce61c4f99bff7652eeaae7b5a4cda1b2e74e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346943, "uuid": "e6cb18f9-7ca6-41a7-a6b6-f440dd03c5b8", "value": "T177A5F1373A83FED5FB690EA4D4C225090DD06C7BD36CE168BCC856EF64E5710AA418B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346943, "uuid": "996081a3-475e-4e3a-96bb-058b8c0adef7", "value": "24576:pNT5rn591lIwP5cOZ4eFGPaAHFRZzHrd5id50pxl20viulp4MSIPMUUGtV2ptJed:H4eFXqD5/sKVa4ui3xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346943, "uuid": "8620e06c-8784-47e6-8da4-d2458bf0e5a6", "value": 2236055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346943, "uuid": "bdcb8444-2d36-41cb-b88c-76e2adecad47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346943, "uuid": "b53e896c-da8c-4d97-beed-adf1155a35fe", "value": "cd4c5a53b0ae2ef3e44bab2321ac93f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88a4083-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682323182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323182, "uuid": "238bc5bb-d9c5-4927-806e-afdb544b7bd5", "comment": "Malware payload (AgentTesla)", "value": "59561a56dcbc72fca5e64d39c2d7f5c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323182, "uuid": "1d78e34c-5618-41f1-b682-f7bbd5a30971", "comment": "Malware payload (AgentTesla)", "value": "6beb6c8530ae26563b435151158d82e6e097cf51a4e27693c694aa237207d57a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323182, "uuid": "d9bbd755-8db2-43a2-8441-74a963f1dafc", "comment": "Malware payload (AgentTesla)", "value": "396083a37b5695a019e6639820c249cfb1d8ea4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323182, "uuid": "0160e910-baa6-46dc-b453-374362bedfe4", "comment": "Malware payload (AgentTesla)", "value": "9731a829d404fe4ee65a6fa9b85e76e6679f4274bc87bb2024c7d22acc9d95b5a00ccf3b48917182e8e04bdd4bb5afcf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323182, "uuid": "9ccd62e8-7df4-445f-b5cb-02bfc1551820", "value": "T1DDE4F1C95B55D392C6253D7C226E72BD3B7044DBEA5BCA31FD8950AA3E32BC81E40385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323182, "uuid": "d7cb70d0-a121-4904-b242-8847fbeb6568", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323182, "uuid": "9e8fd776-63b1-44ff-bea8-a48f14fb7045", "value": "12288:k2iNYqZcU+HnOddX9Jk5zeCycZxnPXnk+o7HgXmFu8aVDy:k1SqyWdX9q5qCycvPXknA2rIDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323182, "uuid": "264891ba-b72f-4590-8762-b75536a65325", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323182, "uuid": "9d6c55bd-9755-4c99-9946-f6150c10bdd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323182, "uuid": "be428771-ebed-406c-8a65-6689f093a724", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7bc86d-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682323137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323137, "uuid": "774741af-e233-480f-9534-5515f272bdf4", "comment": "Malware payload (Formbook)", "value": "e8e05995c60d8da58bf8fc63f2ad3303", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323137, "uuid": "a995d892-3707-4b60-a3ec-8c2742b16566", "comment": "Malware payload (Formbook)", "value": "6d2bb754aafe182e4e4f041a651d1b47a168f82e0db28961ed56e8ebf2b4267b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323137, "uuid": "4d93d694-ebd7-4652-8bfc-8be6b2c57a46", "comment": "Malware payload (Formbook)", "value": "ac08d988e3ed4856200100f474d797d42fb85ad7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323137, "uuid": "8dd0af42-6399-470a-a87c-af1d21a238f9", "comment": "Malware payload (Formbook)", "value": "451370bcffb70fe320d8429caffd19d7e350c93cd83500e05b7f650cf97c682412d0b5978b6cb091bcb885e5b9f6ce16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323137, "uuid": "e5ff7838-e05e-462b-b93b-31d288d2f0b4", "value": "T1C104AE32DA42C431F2B252B5B2BD1B7B883D0E353295A4E9A3F115E06EA19D5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323137, "uuid": "afb279d6-51ea-4656-b2c3-c639064e292e", "value": "3072:nGcUkxSHP3Er83AYT8NGSYW67OycvpITU+ucNRPvCwlUKw:ZysyAq6x6KycxUucNRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323137, "uuid": "7be504f7-c220-4446-a3b6-23059c35abc8", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323137, "uuid": "d047f8de-bf41-45bc-a583-28b8403ae36f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323137, "uuid": "377fd86e-3150-42da-aed4-14544e4c6a9a", "value": "6d2bb754aafe182e4e4f041a651d1b47a168f82e0db28961ed56e8ebf2b4267b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97ed02b-e2d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682363959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363959, "uuid": "6d0197f8-a2a3-4072-a3ab-1490f620cb18", "comment": "Malware payload", "value": "e7fab81f6277826dc5b398caacbaf037", "object_relation": "md5", "Tag": [ { "name": "2141273191", "colour": "#93923D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363959, "uuid": "cabfc45b-1c97-4725-8e6d-a81c8477e711", "comment": "Malware payload", "value": "6e3c30327a0977ffdce8fc5103c9d3c9b5e11b078a260ffa63ddbe06960a1720", "object_relation": "sha256", "Tag": [ { "name": "2141273191", "colour": "#93923D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363959, "uuid": "4dd7ac71-b16e-4e25-aa40-f881b2dac4d1", "comment": "Malware payload", "value": "be671105c2b381a179f0e25650f42df9b9322967", "object_relation": "sha1", "Tag": [ { "name": "2141273191", "colour": "#93923D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363959, "uuid": "659a2834-a4e6-48e8-8db2-431fed18a7e6", "comment": "Malware payload", "value": "f6947a0d5bbe6540babae81aef1786c2871e617944fdd6a143eb3c7683f4c02891cb35d28aee37223194c737f0244109", "object_relation": "sha3-384", "Tag": [ { "name": "2141273191", "colour": "#93923D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682363959, "uuid": "20e1fd10-0564-49fb-a562-9993e09de8d0", "value": "T16A8302BED33C0876E20F297806032A0B7669E77E5AEDC1E0C352C1D959E7628B734566", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682363959, "uuid": "4b73d296-70b1-4dcf-aec7-51b86d1e1c95", "value": "1536:t8ix2ml1FVhbx6uwMDqARP6kZffIIIIIIIIMTZK5rFx1Yk4yOL0DHr4ugmy:5T1FbV/MAxNIIIIIIIIMtKdFEzLmHr4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682363959, "uuid": "62cb2226-8499-41d2-9aba-dcca9955c8ac", "value": 81944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682363959, "uuid": "accce82b-a5c9-4db9-83a7-43d845551291", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682363959, "uuid": "4ead3749-6b59-4811-b9e5-cdcff2a8a40f", "value": "Inv_04_24_#280.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb206d2e-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333414, "uuid": "5764d5c0-6de9-44b6-acf9-0ff527099529", "comment": "Malware payload (Mirai)", "value": "18f63c26db494b34b786a6fbcb4cbe87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333414, "uuid": "33861bed-b4a0-4850-b7b9-4c8e5ff1e8a9", "comment": "Malware payload (Mirai)", "value": "6eb290c6f807f1c9a30784baa5929bf577e55dbffa31effee705bc28a7609a2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333414, "uuid": "d0c8f02b-7447-4184-b0de-da2e63f1559e", "comment": "Malware payload (Mirai)", "value": "1481f9b0ddcb11c420ead59b0a24dc50a6b91ecb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333414, "uuid": "ab764f6f-b609-418c-a276-232f9066426e", "comment": "Malware payload (Mirai)", "value": "995ebb39ec2cb9a1bebbd5b8f234227f165f096d6356d58d31bbfb7d025316f6d6ccc91bdf3f0d53774f0d31aa9dbc85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333414, "uuid": "c33f9371-5a47-45d7-b8e2-3341eb4cdb27", "value": "T12D633B9AF802DD7DF81BD77A4453090AB630F3D502831B37639BB9A7BC721981D12E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333414, "uuid": "60e1222b-365a-4573-bd3c-f3ede22e8c9c", "value": "1536:kEgwF4REJc1eDYbfNa8VBzW1vxb+45dJCbcVd6WhjQYS:kEgg4RE+IEjNvW1pbl5/QWdVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333414, "uuid": "e222de47-180f-45b6-ba15-f3489f6ca3b0", "value": 69628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333414, "uuid": "dfa6de4b-e34d-41b5-bfd1-2beb042fcbda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333414, "uuid": "ba449169-f8fd-4445-9dac-05d98c4a4af0", "value": "18f63c26db494b34b786a6fbcb4cbe87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de23b168-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682323138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323138, "uuid": "e831597e-1229-4d8e-824b-76a140f2afcc", "comment": "Malware payload", "value": "0ca6a8ab986b17baf1129b9dadc36955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323138, "uuid": "3b694b9f-f15b-430a-8c6b-4f31f6e0a37a", "comment": "Malware payload", "value": "6edc056f76d4a6c741776ce300b1925a6dc27fc572b17caa52a1bbabdf556c6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323138, "uuid": "0b2215aa-efac-4f6e-9b34-2995eb798c92", "comment": "Malware payload", "value": "cc4ae256f704ded78b93f825f5e47bf1a3d571a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323138, "uuid": "211bf96a-1671-4572-8069-02d49e608adb", "comment": "Malware payload", "value": "5467c25d24e63a4117cf5d3535df55ac658e2f8fec5e096ad23ca751a5401122801a2f6be721930daa4f3dcd14ed4c21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323138, "uuid": "fa5c66a2-e52e-4a09-b577-24bb17e44185", "value": "T1EB632951B7C67030F0B155313EB962328476BC73282DF20EB394CA6A2E7159AD739B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323138, "uuid": "27045148-6f72-4468-9ad3-0c9538a6d190", "value": "1536:b/kFKZe95xZaBfLQfDxdMSLfbNJ2iG7xb/Di5NvfBv:bMFF95xZaBfLQfDxdMSLfJJ2iG7t/DmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323138, "uuid": "5d9d0cc2-f169-48de-84e0-1968e8ccea58", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323138, "uuid": "1a3f4b52-fca3-4206-bb5b-7e42cdfffec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323138, "uuid": "25079540-b374-4f27-8591-8e14fb76f1c1", "value": "6edc056f76d4a6c741776ce300b1925a6dc27fc572b17caa52a1bbabdf556c6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3f69d6-e2aa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682345957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345957, "uuid": "5cde91c7-8513-4f98-9ce8-7d94806911ff", "comment": "Malware payload (SnakeKeylogger)", "value": "34aad4cf4e2eaff477944be25df41837", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345957, "uuid": "5d868bdc-a2c6-4850-a28d-fbb4e7b1d787", "comment": "Malware payload (SnakeKeylogger)", "value": "6fa45e57a0c10b280baeef2d8a446499a2fd29f5745535cb8f7e0c0d51852009", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345957, "uuid": "4a173020-af55-47df-855f-ce799046e31b", "comment": "Malware payload (SnakeKeylogger)", "value": "ed808f2f8b9634e8a513401122ad8b03152742b5", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345957, "uuid": "88aef5cb-99df-4d62-a6b4-f7ad5eaef3a2", "comment": "Malware payload (SnakeKeylogger)", "value": "7c9b68ad7914c1df82e4bf84a40cfab4c71694ebb9a2d56928ec507b00b3fef6156e870a3d725a6dffee5ae2a35fc8b1", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345957, "uuid": "23e0a544-48dd-486d-8beb-e2c844e2d084", "value": "T1F0D4BE1B222AD5B6D15E16B3D0E617FB0F1C2ECAEE7990430BA8BDD432727B91F48451", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345957, "uuid": "66627e67-efdf-4904-ad06-9d1a70709e46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345957, "uuid": "4d4df534-f40e-4032-8818-99698663b061", "value": "12288:buFqUvdP5Kq/XpKQKr2fjJswmvTPVj9Y/:bpUvKq/pKx2fjmwETt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682345957, "uuid": "6940e7b1-8d29-46f5-a712-53a02ab1ecbd", "value": 636416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682345957, "uuid": "ef21f711-4d3f-44cd-9deb-a390aa1cb602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345957, "uuid": "e09a893a-8338-4959-aad8-377a6d8fe913", "value": "Confirmaci\u00f3n de recibo de transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cfe3f97-e260-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682314009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682314009, "uuid": "5e2a1af7-5c65-493b-86b1-5ffe4bd329f7", "comment": "Malware payload (AgentTesla)", "value": "2818671e46042173af35e5f009284931", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682314009, "uuid": "b5feb194-9861-4c93-ab71-41ac4e434217", "comment": "Malware payload (AgentTesla)", "value": "6ff86780faf33da714a11fec5aa9c9eb1cff9d4ca221303e2cc3dd1847526926", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682314009, "uuid": "090c0d7d-edad-43ba-8575-768778db3441", "comment": "Malware payload (AgentTesla)", "value": "d9d410407b5e4e9735bc5d599d46adddc66648ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682314009, "uuid": "27f6fc08-0de2-4921-b5f7-53af9c9f169e", "comment": "Malware payload (AgentTesla)", "value": "7340c648d1b79f4cf81778a61cc959a9049f92b4b9f3e647a545e12354817f2ae2c24d34762f53b061261e1b61dc8c13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682314009, "uuid": "0f0d9421-4581-4564-ae87-e3e4ffc01aeb", "value": "T1F8C412A1622BA6FACEDDA7BB0654344D47317093612AE73C57D84A8D8D02F83DF4116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682314009, "uuid": "f4041071-948e-433b-8b51-9843b49fa3f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682314009, "uuid": "06ca1240-655d-4bbc-a2b8-910f09ab284a", "value": "12288:doUakIXr5INZIgcSc43xNeaSyGJ8ZiVJhdD9TwH+ccUKcvb8oW/7:doU+iZE43xNo8ZITUPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682314009, "uuid": "923cdb21-5da7-47ee-af45-c905cf65d61e", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682314009, "uuid": "6feec391-8f02-48fb-bb0c-183f985026ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682314009, "uuid": "a99aa24d-ce57-477b-ab06-fa4f8d8f4076", "value": "SecuriteInfo.com.Win32.PWSX-gen.7804.9016", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd663f08-e2ca-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682359617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682359617, "uuid": "bbcd512a-79cf-480f-bcf1-184c93cfa5b3", "comment": "Malware payload", "value": "7efd33c9b3da8fb2d777f0e81db1ece0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682359617, "uuid": "967b1f73-16b7-42ae-8f6b-6686cb33b828", "comment": "Malware payload", "value": "704c75deb0b504ec8c6bc8242c3bc5ca896efdfc892089d4326f8f0fdc11cc6b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682359617, "uuid": "1b6b0bec-c81d-49e6-ab45-cda1d139e8bd", "comment": "Malware payload", "value": "d2399659b3429c2c01424d7d50b8483f7c09f345", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682359617, "uuid": "648aae5e-2912-4e0c-9527-80edf6d365dc", "comment": "Malware payload", "value": "4f8e062f1ce104fe48be738a1a77144eb31596a28ba94e5dcebd0af7edc4527f4a596abd97fbdfb14d5758df555ac24a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682359617, "uuid": "1db4994f-f08e-4070-8583-43399ba489d3", "value": "T1DA2442A86093CDC9FE8A7771762FFB5D503B72A3D5D40A3123245104CBF4BAA1E8A49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682359617, "uuid": "b3fa7e55-3f4a-4d92-8a33-f0201f858e65", "value": "3072:5rWnYk7cqs/gY/7dsgA54HHX0315N3Apl:9yNgA5kE315N3Apl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682359617, "uuid": "1cb8bbfe-cb65-4fe2-b4a5-8067053959a4", "value": 227144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682359617, "uuid": "b9d049ea-387e-4f12-bb10-8f6f08490e96", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682359617, "uuid": "87eb2c69-bc56-4ee8-a286-d1594f992dbc", "value": "1.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b1bd8b-e298-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1682338097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682338097, "uuid": "9db31b65-9e63-46bc-87e7-00dad5ab7bbb", "comment": "Malware payload (DarkCloud)", "value": "fec478d2dbf1e189bec7b5460d552d68", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682338097, "uuid": "87a0ccc9-da91-4832-ae5b-8ec229303509", "comment": "Malware payload (DarkCloud)", "value": "706c16f29d4d4e71ce3790dc3b1297373fd2485dd3b4535df307fba02083c3e8", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682338097, "uuid": "bc213677-f377-4e6c-ab82-966b7c47336f", "comment": "Malware payload (DarkCloud)", "value": "be6d0ae94e8a8fe44226683b95e1704fe5c8c989", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682338097, "uuid": "07b0879b-64f3-4d2e-82c8-86d24617126c", "comment": "Malware payload (DarkCloud)", "value": "2a336df5858a3ea5dde0595078136d27145854ac31822011bc760953c832b7096a9e2d0f799fb31e740ed24363e463ba", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682338097, "uuid": "34cef363-5421-4339-b15f-987b1f50ec4d", "value": "T19125E01B222AD5B6D19E56B3D0E917FB1F6C2ECAED79A08317A87CD431727B91F18001", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682338097, "uuid": "322047bd-27a3-44e9-a5df-6d6efae533e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682338097, "uuid": "7b89e224-7812-4d87-9bf3-8ce698d15474", "value": "24576:EIwfHLXcqHmsISQPIbMID5K2W+W3Grh9dCHOd:tgHzcBjSiADW3GF9dC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682338097, "uuid": "44a5dd20-a0d0-47b5-93ce-08c8ee9b0d67", "value": 988672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682338097, "uuid": "03687418-d386-405b-bf61-6b878cfbd84f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682338097, "uuid": "a7011fa4-8911-4fb1-983e-c3a78a3838e1", "value": "PO246667.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1075e775-e270-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682320645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320645, "uuid": "7eb6477c-8779-4f64-945f-39b8795c2e5d", "comment": "Malware payload (Mirai)", "value": "b9e7c269855f85c0071af938cc7a1ca4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320645, "uuid": "ada5355d-6cb3-411a-ba68-712e48431e74", "comment": "Malware payload (Mirai)", "value": "70f4133f276f1feea932af93da3264c648b30bc3811ea035913658b3a7f0fafc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320645, "uuid": "1f22ce63-2ee6-43c8-a903-2527046a3ad1", "comment": "Malware payload (Mirai)", "value": "b1540c2673b37bc952731508b575823a234a3760", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320645, "uuid": "115ac4ba-82f5-47ad-8da5-a25d9efb1446", "comment": "Malware payload (Mirai)", "value": "cbd691a8ba68371b66bc2fc6f9b42dd0b8fe06c8cfc8c90e969bdc533fd9a55338fe6ad3217a740af341e346765c1325", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320645, "uuid": "23ecfd5d-b82d-452d-ba7d-b04f1275fe20", "value": "T1F5238DB7C46DEDD4C1198678A5298F782B63E009C6A36FF54A4685B68047FECF6093F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320645, "uuid": "70f9be41-d435-42dc-ad86-e40266da494c", "value": "768:eaxiJwtjJJp7Pf2teo/3OJEqPr6hHuOpYMnC0o42KCQ:ea4JwtV6Kr6hOOSGYnKCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682320645, "uuid": "5ecfb8af-a09c-49f7-ab76-ffc65c75336a", "value": 45892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682320645, "uuid": "7adeb88b-d54a-4a0b-ae76-a34ac110af14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320645, "uuid": "0d0ddc31-bff5-49f1-97b8-57b44b13dfe4", "value": "b9e7c269855f85c0071af938cc7a1ca4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e6e546-e233-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1682294536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294536, "uuid": "3b9e5a8e-e1f5-4547-a46f-f932193227f2", "comment": "Malware payload (CoinMiner)", "value": "c89df8c541cdf2146313ecdeba702078", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294536, "uuid": "e2a2e950-f1dc-4b0f-a31b-fe0be7afd917", "comment": "Malware payload (CoinMiner)", "value": "727b88b3af6bde1c93f96df21f82c48fdb0a09c691e5c8066ea7c06adead600d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294536, "uuid": "d688c50a-0d15-48a1-8561-42183f22dfc0", "comment": "Malware payload (CoinMiner)", "value": "ce10b657d68bb8025be4034500fee79a7be601bb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294536, "uuid": "e598bf3a-7fc5-41ff-9463-cd32087fb23a", "comment": "Malware payload (CoinMiner)", "value": "d6c992645a4146aca968258158bde3fa72709afd62a4828119fc4104a62d09985c98222dde1a30a673ddd89cd0645168", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294536, "uuid": "76b94976-ef81-4cf1-ad01-4b220ffa2f8c", "value": "T17864AE2331088076E976D5796CEA967967BC31313B8F24CBB7482B6E1E357F0662124F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294536, "uuid": "b68d017e-93cd-4c4e-903a-372d1c73fbe3", "value": "a0222e526294c98d9d0ec63a7fbbe6a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294536, "uuid": "76ab8a8d-64eb-4d77-8d9c-81989c53d11e", "value": "6144:ZMezUCrMU+pomBerXTZQhbZ12s3oQyrFj9m:ZMezJ+ymBerXTybZUzQyrp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682294536, "uuid": "35bd33c0-eff1-47ab-8991-eaf874d3b6b6", "value": 321696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682294536, "uuid": "ef2df117-2b10-4a5e-bb49-c0ba52203202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294536, "uuid": "0663577b-9719-4180-8a6f-520e510532a8", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94e82ae-e235-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682295642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295642, "uuid": "2e47c101-196c-466a-9562-2c5fbe7a8e3a", "comment": "Malware payload (Smoke Loader)", "value": "903142394c0c6ac7769fa2e14a880bb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295642, "uuid": "c9dd8148-c3be-4c20-8033-a25221475034", "comment": "Malware payload (Smoke Loader)", "value": "72840b84449c8925db2e61821818fdcbb9ead01d982f913d211eed08f1d96973", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295642, "uuid": "b6fe3499-3f0a-4ba9-9c1e-80606243e658", "comment": "Malware payload (Smoke Loader)", "value": "d88053a8035935da9d8410967ccc470aed14f4c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295642, "uuid": "bd2b99fa-eea2-4d98-811a-be8f266a3083", "comment": "Malware payload (Smoke Loader)", "value": "2c16543087c020d426ee069f07b6e6b89ccc7277ca5d5cc5d2175dd4ec4ca9578608be2899c8d154d6938c1511af81c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295642, "uuid": "1c317f5a-01d9-40e0-8f79-3a178c32ea0a", "value": "T1D434D02A79D0C0B3C85B85754821DBB46A3EBC615769C1C773182FAF3E313E15B7A292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295642, "uuid": "423831db-119d-4e23-85b8-633674b4516e", "value": "cbb199b85bd7e99e36eb212e7f14e32a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295642, "uuid": "e356534a-f4b4-414b-b1d8-5a8d70ef3ee8", "value": "3072:8tx9brzsxNnLa4ZTWlp4vwu+UaXIDoV4h8LNpTHrIG542eFR:Czb2NnLakToWwu+UmID5h0VH+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682295642, "uuid": "b2490809-80d9-451c-8f5a-a6bb9276f200", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682295642, "uuid": "4c3ce908-024c-4afa-8208-6fd776ee58eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295642, "uuid": "43acca05-2654-4545-86f9-07e42554aaaf", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563cf401-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330211, "uuid": "250071b5-a055-4489-a389-d4ca5db226e4", "comment": "Malware payload", "value": "726c92850e30a323c6abd1bee1c7045c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330211, "uuid": "4d5a4c59-de81-4857-976e-ead67d4f171b", "comment": "Malware payload", "value": "737f6c8e1a8ea4a9064a0cfaa4ceed495481d9bb133ed5d6bfeda3a83351af9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330211, "uuid": "de9b67ef-7073-4c3a-a0fb-3b823c71fac7", "comment": "Malware payload", "value": "5f66046619bd242180ed82f90a6b9ad85f4109f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330211, "uuid": "566e9b99-8981-43ea-a84f-646ba631ae61", "comment": "Malware payload", "value": "0d8c1597167d36153297d91ae6ba5bcf98e47e910f2233978b2deff7d825704640c5358ee05f0834d606e6e96292b8b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330211, "uuid": "86aaebf9-5d66-4832-954c-f3c11c8ff875", "value": "T1A066D06F92A58E7CC20A7132D5BEB6349D3371974172C67B9B89E6E11710CB08E6F720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330211, "uuid": "702bd200-cebe-46a1-b4c8-85aa5410f2a2", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330211, "uuid": "90414fdb-9b01-4f42-b8b6-fe38f54e4e4e", "value": "98304:erWil2xGmrMHdOJArHghYyLkunmrQ9x1SKWCkkGi1J3Qvu/J:erfl2xGZ9OJA0hYyojc1SKXJeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330211, "uuid": "e2bf4608-5861-4e7a-ad0d-34ed5a1e0e68", "value": 6609784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330211, "uuid": "fab9f598-ff1f-4db4-8b65-6a30fb9093e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330211, "uuid": "ca7dd17b-321a-47eb-bbdf-6671c01a48fc", "value": "737f6c8e1a8ea4a9064a0cfaa4ceed495481d9bb133ed5d6bfeda3a83351af9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1280ad25-e2dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682367034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682367034, "uuid": "2f8edf54-d503-41d2-8912-2757416e139a", "comment": "Malware payload", "value": "6fb0456b50458109764b6719df6e5244", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682367034, "uuid": "06abfb12-bbb7-47fd-acc1-eda58b4b293f", "comment": "Malware payload", "value": "7443b3707c9db0c5ed6c8acef9d60128932c8e3f3f7bdeed1d2bba4598013f81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682367034, "uuid": "3a66becb-d38f-4b9b-a537-fec146a441f7", "comment": "Malware payload", "value": "fa77b8dc82b7525a49b2ea6f9c8e2d5d84d3bf90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682367034, "uuid": "0a545a03-67ca-4e20-b010-09005d718cd9", "comment": "Malware payload", "value": "0da01990fa8206f57e22fc1da50f79b3735df4d6b36a9aa196aa9853b2dd03cc472b374332f73553a4a6bd139000fa66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682367034, "uuid": "cc1bfbbc-d3c8-4a2d-a9f3-4b8e3a6f1be4", "value": "T1D6039519EB614EBBEDEBED3746AC0A4170CD940711E52B3A3075DA28F12A4474AD3F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682367034, "uuid": "b1446761-b61b-46ea-a714-6cb57dbe1e00", "value": "768:xF8AlhrLLQKz/AmpgNZ8m0GeZf8PJ2ezreP4r6J+eXiex4:xF55zbWLdkfaQCri4GYqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682367034, "uuid": "9aa16b8f-3d47-4018-a504-37b53ce40ac9", "value": 38960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682367034, "uuid": "cdc64bae-4fa0-497b-af31-bd58ab31404b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682367034, "uuid": "8e404d14-86d5-4173-bd23-27a7798dcfcb", "value": "6fb0456b50458109764b6719df6e5244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c7bec2-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303233, "uuid": "47d0e1fd-babd-4411-b957-807a24d3fc07", "comment": "Malware payload", "value": "f9ac6b16273556b3a57bf2c6d7e7db97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303233, "uuid": "3cb76546-61e3-42ec-81e0-eff6d84c9064", "comment": "Malware payload", "value": "74e9a296d1b1c7ec27dcca35961d3563779c48cd8163a6ec00fa19aff17a6ed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303233, "uuid": "bd462a11-94b6-4df0-9a7c-3765bc8d6615", "comment": "Malware payload", "value": "8f6942cf31c97fe821d0ccd3a5c1790d9669e95d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303233, "uuid": "9e68ad1a-f71b-4675-9aa1-4977756d7a4e", "comment": "Malware payload", "value": "66335f96f442da1f74ac9a2755112e752ea146515b71d8a4cf9f430384056d9ae81292c397552f6a22ba5dd940474bed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303233, "uuid": "43e9c920-25ef-419a-9057-aa5ef0a920d0", "value": "T13853F19B617D8B4DD2D86BB408966B46253290C3BD7FB89DB0862847D1B81BFC14B8C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303233, "uuid": "cd85251e-ed2a-41e1-8c35-bb55233469e9", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303233, "uuid": "82eaaee2-3f31-44e9-9809-0eeade0d6761", "value": "1536:4Fnw75foHUVexZjhM7/py7nYV7S8B2+3W+b:4VQ5eOev6pnjB28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303233, "uuid": "12daee0a-d6b5-4ace-902c-ff1a3e30ca3a", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303233, "uuid": "efd106fe-dddd-4542-b389-32ae82eabb6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303233, "uuid": "ac89b3b0-1b61-4de9-9ffc-d01aeda9b647", "value": "SecuriteInfo.com.HEUR.3562.4580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c103b6-e272-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Socelars)", "timestamp": 1682321733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321733, "uuid": "b001f411-930f-4979-9716-c88bc40987e9", "comment": "Malware payload (Socelars)", "value": "99f42931defe43943a0e3734c6afe870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321733, "uuid": "1496815c-ba6a-4d17-b180-9b9cf93f2453", "comment": "Malware payload (Socelars)", "value": "74e9f84b0f2ad3ccdcc39a86284ea080b0b0f27de950a458907b0a058f8f8cc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321733, "uuid": "bccf6b7a-c5cd-457c-854d-f91bf8f628c8", "comment": "Malware payload (Socelars)", "value": "3fc31673243b9a92f0c6866912a4b2e334b27fa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321733, "uuid": "6e583f54-f867-4c9a-b15d-ea043f7867dc", "comment": "Malware payload (Socelars)", "value": "502439514ced2ad0c11b1e7236f7482508df7294fde8ffecebb51d6b292f02db711925d132527357f07c384b223a92e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321733, "uuid": "95acd93e-1a74-4fd1-9deb-5670af2cead3", "value": "T1C4658D21F7C26032E8E310B745FF6ABE9D3C6A11470894D7D3C81C999B615E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321733, "uuid": "e42967fb-44e9-422f-8921-fdbedc2fe335", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321733, "uuid": "0d994208-3c22-4b6f-9d3d-6ec452eb3d26", "value": "24576:iGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRf05hjSI:xpEUIvU0N9jkpjweXt77M5xF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682321733, "uuid": "50e2b8d9-3052-4be9-9104-8af6245eb95f", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682321733, "uuid": "428a4241-ad17-4a0c-abd2-64f22bd90249", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321733, "uuid": "9a000dc8-158a-41f1-960e-a1b8f6f36a5c", "value": "99f42931defe43943a0e3734c6afe870.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98485a7a-e2ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682346643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346643, "uuid": "09fc7536-4265-40e0-97b6-3d7378631167", "comment": "Malware payload (Formbook)", "value": "64ba7b4484114967c48bea5cff6ac9bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346643, "uuid": "cb7caf62-d6a3-4c93-ab8f-0ba7d3817043", "comment": "Malware payload (Formbook)", "value": "757371fd80dda17d1844c472bead62365e29e5f902e32afad9bc0120346220d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346643, "uuid": "bd593305-7116-4533-ab97-cf8dc416d164", "comment": "Malware payload (Formbook)", "value": "65eba06d17dd6b75ae74c5cf09ae5e25e81ea0e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346643, "uuid": "819a10b2-d4b2-4433-ba95-9310f6920582", "comment": "Malware payload (Formbook)", "value": "1d1a820f5b08b7154f02c0e1faeeda855c4d6a2f2d36bc12f8c39114c7832e20fb2991a5ffe47d52718e1abd7dbbd7e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346643, "uuid": "aff16233-3016-4166-b1ec-cb9781d100de", "value": "T111E4BE2B226AD5B6D15E56B3D1E517FB0F6C2DCAFE79A0431AA8BCD431727B91F08001", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346643, "uuid": "b3895063-0be5-40a3-b62d-e54bdb912769", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346643, "uuid": "e87877ab-0e02-4f80-9bd6-b36808463cb9", "value": "12288:49oe+bBWrllPje9oSTSIEdlP9sDIZD/6K3ZZ5saOkdjB28lA5Y8:49oe+Ill0o3IyPq8NrpS0lWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346643, "uuid": "61ae1ddd-47a1-4912-86de-0c33ed57f3c8", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346643, "uuid": "a38700c9-3e64-40a8-9025-da95ee6f8d4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346643, "uuid": "958b545f-4c16-47cb-b158-7fd5709f6680", "value": "TNT EXPRESS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818e6e6e-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303226, "uuid": "a8221e94-db28-4695-b7ba-6d776a59b75f", "comment": "Malware payload", "value": "513ec73d1a018c83a59d9e3964863307", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303226, "uuid": "7fd0c1cb-324d-4bc3-9ad5-f627f61aaf0f", "comment": "Malware payload", "value": "75c6b02f67b7b62dd0ebb956918424d1c0d5ff907d571b6e950f15b2369ad672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303226, "uuid": "4d651688-2378-4da2-a1a4-7aed6e0a4c4b", "comment": "Malware payload", "value": "94bf115df2a24d511fd9e155d8c1492208480296", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303226, "uuid": "ff0b12fa-594d-403c-81f5-f88edf4ff9dd", "comment": "Malware payload", "value": "20707a0fa2b4b3e2703fde912d24e842680e9d9313dbfeca9dfd642853c0a7fa545594618e982a72107b2ce380823cab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303226, "uuid": "0bd53282-c089-42bc-9375-1967acd4aad5", "value": "T189154A22A28D1C3AF05786399C6656125F3EFB74EAFC188B0EB4F91C5F391813537299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303226, "uuid": "43821a3a-b78c-49b5-afe2-f35bb2ae2700", "value": "12288:xTkMXluV9N4bKofD40oCYM008MBkS558zEzWJpT888888888888W88888888888:R94DN4bPfD40oTaBkS558z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303226, "uuid": "0a8db99e-0a7c-471a-a95c-b800ecf67f78", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303226, "uuid": "8fbe43bb-06b0-4d7a-b010-1742371f01aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303226, "uuid": "bfc93e5e-4860-41f6-8124-44696e5ebafc", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.25126.18378", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab26acdb-e272-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682321764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321764, "uuid": "5339415b-c5a6-4038-af08-fdd842ed407f", "comment": "Malware payload", "value": "54b7b17351bec7ce18851ba0c5858c14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321764, "uuid": "a480b47e-04ab-4a76-b081-f75d110d57e3", "comment": "Malware payload", "value": "75d67781586ddf46e94d4d5f9592c32427386bb386a6f5c24c947a8d805d6711", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321764, "uuid": "fe077a2f-a6b2-4edd-bb30-99fc46407de8", "comment": "Malware payload", "value": "09ad622c15f888bf8343c03696bc8f9cbe7f597d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321764, "uuid": "a64d0d41-8eff-4959-92af-1dfa32ebfd1c", "comment": "Malware payload", "value": "3bef266d08cf7d7fca271e02f644fb18dfbc51a0ad40eb236a1ee4024e854848156b255557de8114c97ec62b94bf0b56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321764, "uuid": "11cab15f-1c34-4940-b37c-d03637b97167", "value": "T12CD523E2F83C86F9C9B74C3400DDAA71E21EEEA25094BC3749696E538FC9F91954181F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321764, "uuid": "2ed8d3c4-4d51-4096-ae8c-be8558c72deb", "value": "49152:h1mRSRHcZxYUqZVJxO9I3tQtuPJWT9hPT5YG8SJ/0ArZwhcrYo:hXRMxYUKJxO28EJuhT8VArZfrYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682321764, "uuid": "974f681e-a09c-467a-bf7c-79badc75532a", "value": 2852444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682321764, "uuid": "571702f8-81e5-4fe8-a4a2-d91ccddd00a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321764, "uuid": "9943b1af-2500-4de4-8f80-5949ad78756c", "value": "54b7b17351bec7ce18851ba0c5858c14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea94bcf-e284-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682329635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329635, "uuid": "1a6f66ed-56cd-4fbb-9e40-db09f0a0318e", "comment": "Malware payload (Mirai)", "value": "297888cd159b1eb12c2fd004edb53abf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329635, "uuid": "65cb3008-8cc3-4240-a1d2-6a9386acf4d3", "comment": "Malware payload (Mirai)", "value": "75eeca6cc4a530c29da05cd04d98351e7eb9719b608fde47b65d581bea2724ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329635, "uuid": "b2a15cc7-5408-43dc-8c0d-80b928bf320d", "comment": "Malware payload (Mirai)", "value": "f0ce8f3633c69a17b1c0a5010737d9544386fe4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329635, "uuid": "2fa134c7-48bc-42c2-a7cf-e0f1df810e7f", "comment": "Malware payload (Mirai)", "value": "7da1ba8311d497318d7d96a9f4db20bc3f3139b16de06e06ce72e8452bf24b20741ee20c481bd840742e823a35b8707e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329635, "uuid": "d75e795b-1d11-4f25-bde5-3039549d4db3", "value": "T168436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329635, "uuid": "107595c4-668d-4338-96b5-199967c79c62", "value": "1536:JeESt/basV2rcZhG6ySN7nas9qpFzWOIaEjrqMis:JeESt/basVTgS7naswp9tXESB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682329635, "uuid": "8ab71091-b22f-4dec-947e-e5c0ed8575c8", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682329635, "uuid": "172963bb-aa62-4548-a8cb-d5b5fa9ad6c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329635, "uuid": "b25198a0-e226-4dc9-a10e-eac14e1b9639", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b84256c-e2a1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682341790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341790, "uuid": "8db03b3e-df65-40df-913b-b224d3458fab", "comment": "Malware payload (Smoke Loader)", "value": "fee928db55b173c54680387c2ebd8c3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341790, "uuid": "b38d4ba5-a00c-4c81-a1fa-be3fb34fa28e", "comment": "Malware payload (Smoke Loader)", "value": "76156ba412e9b541df1d30a5937195110b212665a04366896eca41e41c153796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341790, "uuid": "c68c52e4-4ebd-45c4-ad00-7e1548a64763", "comment": "Malware payload (Smoke Loader)", "value": "d4e52f352ffb953bddd26e80d72daa277c2e0f9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341790, "uuid": "a7e1b394-2212-4d23-acd4-20537977fb6f", "comment": "Malware payload (Smoke Loader)", "value": "71c2b03e793a8f15668b89dd3f0da38c04d5f78013cbf4f829b6af177003d1a7ac815a1bd65deae1cdaa440f1357b8df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341790, "uuid": "2bd3a7c1-93e0-40ac-a104-2767bf5c452a", "value": "T1C8645C12A2D07C33E6935B328E1EC6F86A9EF5518F156BDB1659EA3F0A741F1C232305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341790, "uuid": "903ad253-225e-4298-aec8-9ce2d75adbb3", "value": "7e47f4a7d8eb8592af8d9b90f0ea149c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341790, "uuid": "87eaa0bf-31d7-4f87-9a32-cd9c42eedd29", "value": "6144:GI4XUmkTPmSQ9hzkn3XIW6fLCeDsjuY3sZH8QQnXy:GI49CmjvzE3YWXegyY3eH5QnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682341790, "uuid": "5c384ee7-75e3-4b9e-847d-110151d31306", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682341790, "uuid": "bb30d5e8-3381-4f3e-a7c9-5f3d789c3427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341790, "uuid": "8b1d3a82-3e28-41d8-95dc-b2a881889a75", "value": "76156ba412e9b541df1d30a5937195110b212665a04366896eca41e41c153796", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded1b793-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682323139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323139, "uuid": "c5f931f5-4f69-4f14-b5ed-983a0ebd3e04", "comment": "Malware payload (AgentTesla)", "value": "a87da7602223cbadd1fc56144470c472", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323139, "uuid": "75da3fea-d3a0-4178-955f-fb43eb2a2d0b", "comment": "Malware payload (AgentTesla)", "value": "76330ae8895b425037146e34a214ffd69acf4b77d46e38c8bb175e144d63740a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323139, "uuid": "a2e16093-885e-4c40-95bb-15fa20fe8543", "comment": "Malware payload (AgentTesla)", "value": "def4e8682527e60d7cbdc2cc3fb9febf3d19f7bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323139, "uuid": "d28c121e-da6d-483b-b5b5-bcf7b4aad429", "comment": "Malware payload (AgentTesla)", "value": "e04bf12e05712dbd7a392b039ca168dc9bf2dd0c5571b59ca3f47ee685242a905842be6551bbd25426ee063d710156fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323139, "uuid": "387f248d-b213-47cd-89d0-e3ce6878d870", "value": "T1ACF32A68AE855BD1C72F4C71D7A431040FB691468617E69D0EA1E8F93E7F3C3722B8A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323139, "uuid": "59022785-9a1a-4b4e-97a2-50f7908dc7e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323139, "uuid": "a8695ca9-42bb-4e42-a685-995635b34113", "value": "3072:toLOwc+/HhoIrp3GfutkYbuNPcqsEVgrX86CxnBJqT:iCF+BrxUutSPx3VcXynBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323139, "uuid": "327fc3f6-4ea9-4e4e-aea5-5ae1b0613819", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323139, "uuid": "e9000841-c439-4016-9f94-0fea8529772b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323139, "uuid": "7090363e-e392-4681-a56b-be5dd116a912", "value": "76330ae8895b425037146e34a214ffd69acf4b77d46e38c8bb175e144d63740a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0277612-e2ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682346227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346227, "uuid": "d9f1e35d-4191-4ab5-bd8b-5b1ed01ccae7", "comment": "Malware payload (Mirai)", "value": "5ee2743277ad3b599ab8d57e73aff912", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346227, "uuid": "0b610cab-ac95-4b83-847c-19e8e1d46bc9", "comment": "Malware payload (Mirai)", "value": "76410a45d7a18dd8ba3a9d114a3bd41a22fb9065631aadb38daee636f34274d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346227, "uuid": "95c96267-fd42-4f4c-b9ac-ecc4576167e2", "comment": "Malware payload (Mirai)", "value": "eebdbcea0779841cab93004891c772096ddb2b8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346227, "uuid": "30302881-26d2-4f44-bd6d-e21c6cdeaed5", "comment": "Malware payload (Mirai)", "value": "d9068698b71e22b8fccd8eb7311299c50914db64bbd139392367d5dfaa33d1db81aa55d73db4d7e377a026542a86910e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346227, "uuid": "1912056f-61ce-41fe-bc46-bf58a4e80bfe", "value": "T165531A03E643CAB7D8430AF503A7AA694721F97A4E264E46F31DBDF8BB124C83157794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346227, "uuid": "d28a192b-a677-4676-a45d-ba2c3f2332d8", "value": "1536:Xg/3Z6pKmWw22KGiCnNHKpemffv7Bx/NoMC37JnWQuE:Xg/3Z6py92KGi4CBxml3FnWQuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346227, "uuid": "a08f03b5-86ca-44a8-ae77-0792508a4c58", "value": 63362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346227, "uuid": "af1a5cb0-8a47-4ce7-90a8-6530ba52cea8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346227, "uuid": "6bac8a57-3de5-4c2c-b4da-201b89ed484d", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7549ca16-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303205, "uuid": "6cd1e1a4-d92f-45b0-a8f8-70a554c7060f", "comment": "Malware payload", "value": "3cf8a3fbceb667121d91f4ef1a66684c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303205, "uuid": "e72dbbf7-38cf-4641-81a0-ed4042c00990", "comment": "Malware payload", "value": "7665548a34de7b6089863fb9b6821af4a6e759ef5df3d074e50b9737d5971257", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303205, "uuid": "dde534fa-74cf-4448-8d99-545f0e44188a", "comment": "Malware payload", "value": "d7f78393c81ce39b7b94a403ffac0f5c7bb39783", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303205, "uuid": "e231f54f-467d-40e3-bf4a-60ed4bf108e0", "comment": "Malware payload", "value": "096260a41846b3f4f0a3e6aceaa335dab1445ecb507327460e5c78a6edc11c7bb031b91a37fcd1bf5325162af3c6bbde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303205, "uuid": "7606c027-a395-48a0-a817-c28e71662f92", "value": "T148A25440F142C17AC3A172B7E7DD076DB17B9EA8F299271BE56CD2203664A3C9635F08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303205, "uuid": "4a5daa57-bfc4-4d60-a5ed-0f4781b413be", "value": "192:klpfAbk3CTsSWygfiCTtooD2Vsra3+TFK1NasjRc4p/IM7xXFqC6wKz5nin/O4rL:kNSTlNSD2VsW3tdc9I1F7KpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303205, "uuid": "141dfd64-888d-4acf-912a-6f59a4ba04b4", "value": 23052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303205, "uuid": "e8019318-61ce-4a16-9574-083b73a040d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303205, "uuid": "9722704e-f6ea-4106-a28d-dadc7af70c9e", "value": "SecuriteInfo.com.Android.Exploit.ZergRush.B.13341.19839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfc5ea7-e28b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682332368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332368, "uuid": "39b74848-e8e6-4ce3-8df6-290f73323295", "comment": "Malware payload (Mirai)", "value": "484ea2edab324b372e1dbb81936675d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332368, "uuid": "369de0f5-68ff-4dba-a33a-6682537e1e2c", "comment": "Malware payload (Mirai)", "value": "76922dea23549f054fb2b07ae9854c38a5d9af495660f860035e7ee7359b42b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332368, "uuid": "3018bc55-c9a9-40cf-9676-45e732d93a48", "comment": "Malware payload (Mirai)", "value": "dfb4f0be7585f60d6679b66bcaa8c372efd8c3fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332368, "uuid": "a15f6dbb-ffbd-403e-8b64-180e05cc526e", "comment": "Malware payload (Mirai)", "value": "1b312a8934ec41ecf116c3c1abccb811c1c72cdcfab23d4d4138c0bd5cd1cd800a1a810102be87a2558e57b1a8f007e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332368, "uuid": "826597fb-1447-4b6b-a50e-30947f55174c", "value": "T1044308C17881A626C7D05777FA6F018E37199798E0EA33538C295FA07B8AC1F0D6774A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332368, "uuid": "43cabe9b-e1ca-4c78-8749-b7c666a7f5dc", "value": "768:N1c82KQvRwadj7csq5sebD07B8drbonjxDdSYGSq/EanRP8NUapvTLwCVy/rCxH1:Nb2NVh7ctujxynRPwU8ShW+15RL+Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682332368, "uuid": "21db4cfe-01a2-42d6-bb35-8c9e81e10e5e", "value": 56584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682332368, "uuid": "ca3f39ee-64c0-4683-a47c-3c75f3c156d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332368, "uuid": "f78cc24a-3f63-408e-b0e7-a31662e22f7b", "value": "484ea2edab324b372e1dbb81936675d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b4b02f-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330217, "uuid": "bb4f1f38-28b4-4835-9ce2-5b6f7bc2eb07", "comment": "Malware payload", "value": "51b4a873cfc7e0f712b3e5b516e7039e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330217, "uuid": "8e3bad2e-bfbe-4edc-bb5c-40b5bee50965", "comment": "Malware payload", "value": "780285087fb35911db189ba92c6c8d251a1f640b3a473e0ce7ea27f59cde492b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330217, "uuid": "73f2874e-528a-4e59-b64c-57e461af8b9c", "comment": "Malware payload", "value": "be1daf4e4ec9e4522826e6457a0f2c2efcc42f09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330217, "uuid": "57f62a87-9ed5-4d5c-91c2-9df99457d45d", "comment": "Malware payload", "value": "29c2882e145bd8672aa64aa28dbd8672f2e9a9253db050833abaa463b919cb04eacd96c9b0d9d37988e66d6c95850474", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330217, "uuid": "6f187795-b0e0-46dd-8e6c-90f136144fed", "value": "T19866D1DEA044826ECA5F07B9E4C68E72E431E1F11FBED36A5964C0E41B974A44F1FE60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330217, "uuid": "4753c6f2-a34b-4055-af11-2cde61b16f0c", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330217, "uuid": "cca95ba2-41c7-420d-a9d8-9b80bb4cc189", "value": "98304:A21PeRxnp14RpcySxOwxU01lp5dT70RdJ6APzEkks1d3ZqazpUuqg:A21WeRp5wx91xSR+qXAVNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330217, "uuid": "fef6c3bb-78cc-4ef4-89de-5c635d60384a", "value": 6676856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330217, "uuid": "a21dfd88-0684-47dc-b603-cd824d2c2161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330217, "uuid": "ac419c6c-eeed-412c-8876-115d803c4f8d", "value": "780285087fb35911db189ba92c6c8d251a1f640b3a473e0ce7ea27f59cde492b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8e7306-e2b9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682352131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352131, "uuid": "5b51483d-2e68-4c4c-9925-d16564f8e881", "comment": "Malware payload (Vidar)", "value": "5e47839bb7868d6ea77f97d8b3b5f51f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352131, "uuid": "cd062d13-4275-4afa-9d48-5a6167ef7e38", "comment": "Malware payload (Vidar)", "value": "797575606aa8f510d7d84596fcc81180354f0b65ec50ed5864ad6c18d15f3086", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352131, "uuid": "49a7fd57-66e3-41a4-b2bb-68369d4ca7a4", "comment": "Malware payload (Vidar)", "value": "eeb2b70d4d4e787468907e9d5cb36cc9f4f1bd99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352131, "uuid": "03f6feb9-dcc9-4e39-8917-27599dc96f28", "comment": "Malware payload (Vidar)", "value": "a37999d461008f7397e5129e9e27f3503027d6395217f4750a99e01cf7901242c66db3f7925b5d610fd445a5e397d63f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352131, "uuid": "b5ad86e9-31dc-4ef6-b46a-644776e37dd2", "value": "T14BA49D8256E06877E662DA328E2EC6F4771EF5134F293ADB2758963F0A701F1C236345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352131, "uuid": "70219ff8-31d1-4f3a-904f-1c9d573f1b60", "value": "c263ea9fa71edd34b56a166511864643", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352131, "uuid": "bfc0c3ce-1194-40a5-85db-a3da97986f8a", "value": "6144:SlLB1mQ1RiF2G1XZgaKikWOEaKXdK0qnUECOkG:SlL7xiF2GxZlKPEa0gUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682352131, "uuid": "3f7477d0-3ff2-4c99-83af-ef2d837f9a32", "value": 455168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682352131, "uuid": "a7070cf5-f714-40b4-9204-b1c1518f1260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352131, "uuid": "a5a768a0-4119-4d6d-bcd5-4479616332fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397bc713-e26d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (StormKitty)", "timestamp": 1682319426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319426, "uuid": "221732eb-362a-4a63-953f-a59185932540", "comment": "Malware payload (StormKitty)", "value": "f81832d1759a25d688c840ee5eee6fb5", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319426, "uuid": "a9bd60f6-ff8b-4e3f-8274-f2e9a53fccad", "comment": "Malware payload (StormKitty)", "value": "7b24e9a8334000a1e10dd9cdf66e92e46f890e5a89f77c6bd7e1957a2a97320b", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319426, "uuid": "2db23558-264f-422e-b1cf-15e89c4e9939", "comment": "Malware payload (StormKitty)", "value": "af587f9f3fbf23166f82573056aa972aef26ec29", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319426, "uuid": "0f5b981b-f63d-4298-9465-09b6b417e44b", "comment": "Malware payload (StormKitty)", "value": "f380a4eb67fe079c915a72f49edff4439bb3eb977a4eed974e59087161dd4e9c9e7928ad5bf113b361a078d8e954636a", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319426, "uuid": "6bad8e5c-b51b-4d18-b0c9-15698d2e9906", "value": "T1E945D0467BC61612C9845A35D1E7062553F2E38B23B3C68A394C47A60F533DA6F8EB8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319426, "uuid": "d6d7cbbd-96ad-4a06-aa74-247ca57b0303", "value": "3072:s748SBjtujuYWofGa2OTeyGuPMZmzsq9Y2YhuhWDNJQZ5hJ8RDMh/CQgutfxvXX4:s7MOuYCduEZ8sq9Y2RWfWMRI9Ocn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682319426, "uuid": "90ea8d83-ba00-477a-9920-2100e128ffae", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682319426, "uuid": "6616c312-6fb3-4798-be58-ff78e9c72780", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319426, "uuid": "288b6da4-ea5f-4990-8e9b-602b46a27b89", "value": "S0LICITUD DE PRESUPUESTO-24-04-23.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49b78ac-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333403, "uuid": "6fb600e4-7373-4060-b796-a32712cfb2c2", "comment": "Malware payload (Mirai)", "value": "f8de58f90806f6e8f04a34384abef753", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333403, "uuid": "0a3b9650-d9d7-43ba-bab4-91d5095fe0d1", "comment": "Malware payload (Mirai)", "value": "7c1940c1cfddcd7410c9365f46e42c3fdccb72a96b1698a379507ed7dbac3440", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333403, "uuid": "da0bfe56-954f-469a-8068-f0c9bf824afe", "comment": "Malware payload (Mirai)", "value": "4f8e07cb410c8ed07c1c7ef9dd0afe7a0ef4f447", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333403, "uuid": "88c31287-f0a5-44a4-9e84-9d1dba0d4fd4", "comment": "Malware payload (Mirai)", "value": "0a8b34f312d817a8232e92ef8a57ba36f9a3a5bda9f8c9d40ff9cb8d8232066a7bba9cd60ba3fec658485cd0d4848eb4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333403, "uuid": "5f592bcf-3744-4a1e-8203-142012d8a0d1", "value": "T197530985B8819A25C6D113BBFE1F018E3316576CE2DE73129D141F607BCB95F0E2BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333403, "uuid": "d0248234-f836-4962-a46d-936cb8604c17", "value": "1536:wdnIYTZ4nYkTAcASlquASJAFzVLl1kHQwOcL/IBikcKJKWx:iOnRUcvlqiuhLlUQcKJKWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333403, "uuid": "87797b12-8f4c-4afe-be93-4ab7b1d8d86c", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333403, "uuid": "85e57f97-daa7-455a-aa46-69160c435077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333403, "uuid": "e463ea0b-9971-4ad1-86b6-f6f184b1eb44", "value": "f8de58f90806f6e8f04a34384abef753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8408200e-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303230, "uuid": "c0885b93-6ee1-4987-9f81-c862b083c099", "comment": "Malware payload", "value": "e85cf2b35e0fde8517a609f92411c65c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303230, "uuid": "dbffc817-f2a9-4906-9f0e-4d68d733a02c", "comment": "Malware payload", "value": "7cdfc0029ce2953b5e808c9a8148d38ad0bd1393a8c38d2e2c3e5f02f28641e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303230, "uuid": "419b286b-32a9-4e2a-b53b-088e806fb726", "comment": "Malware payload", "value": "c15b4987745612837c3aa098af342256911afe68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303230, "uuid": "76a3ab89-d609-4e67-873f-502445c5d31d", "comment": "Malware payload", "value": "c987f2a768399a3423aba29c7d63c25e64fc6c125affa450324d2ab27070a9cfb3aff212bf22f24bb4eb2c44f830c552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303230, "uuid": "b6f132ee-216a-4662-9878-397047e6d5fb", "value": "T1FDE4A493E380C8BAC41A027ADC76D9305917BE6948E0451A1DBDBD2F36B7393247AD4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303230, "uuid": "98b23426-576c-4d52-b1ce-8321686b42e7", "value": "3aad84cb841fb1678d4cff62d246f5ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303230, "uuid": "319046da-139a-462d-9e27-d4268a8d46c2", "value": "12288:WQcGA9fhzUOBGTuAwTGjDKHjlHMMMMMMMMMMMMMMMMMMft888888888888W8888E:1A9fFUTTuNTGjSMMMMMMMMMMMMMMMMMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303230, "uuid": "dfb54f3e-443f-400b-8524-72bd0b9d5bde", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303230, "uuid": "7a12d249-b7a8-4ab9-9d92-2d083444a9eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303230, "uuid": "b3676179-0102-475a-a20c-3379ad2f4f44", "value": "SecuriteInfo.com.Variant.Doina.7960.11156.26937", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c445c284-e284-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682329537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329537, "uuid": "a82c2543-1f0b-4423-b6d0-8f6b562e4b53", "comment": "Malware payload (Mirai)", "value": "0364d385420eefee5571dcedab8b19cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329537, "uuid": "9b291041-d69d-4999-80c7-ae13df898980", "comment": "Malware payload (Mirai)", "value": "7cf10efd0aaaa425c46db94eaab49fc10ee218e049403d40e8f0c394a9cb0974", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329537, "uuid": "f6119a22-61bc-41ee-94be-4ac1bcd50b30", "comment": "Malware payload (Mirai)", "value": "744bd9aeb73cb41193a1550dfbc2fb6fb1c65524", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329537, "uuid": "170ee2a4-798e-4403-8732-98451f78acd5", "comment": "Malware payload (Mirai)", "value": "f20d8fbeb588ba9b3b26af0e75973c2a4e7543a7f26ee367084c04824026a89cfbe7e0bc5073bd76a43ba70158624b06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329537, "uuid": "c6f806c5-172f-4567-ab95-9dc70c53e43e", "value": "T128635BC59E43E8F6EC1D567020B3EB769676E43E1059E697D79E8636AC43B02E00338D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329537, "uuid": "f9b97846-35ae-44fb-8a41-05313180afef", "value": "1536:lQBPUJnFO3NlMTeAyKDsvtdicjwR8WFSRYJqScexLpbp32m:OBs1FO3H2yDvPxjwFmYo7mp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682329537, "uuid": "79b54745-985e-47a2-8b18-ff475a18c37c", "value": 67120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682329537, "uuid": "b82bdcc3-2724-4daf-805d-7fb6e600608c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329537, "uuid": "448a11bc-2f5f-4586-a0aa-0b30efe19852", "value": "0364d385420eefee5571dcedab8b19cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e20d7f-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333375, "uuid": "db5a32c2-0906-499d-a488-0ec7ce881937", "comment": "Malware payload (Mirai)", "value": "9067b7197d8054ba3b36421b4be894d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333375, "uuid": "100c319f-d1c2-4772-9055-e004ed33aab6", "comment": "Malware payload (Mirai)", "value": "7e331fcc93ee174b6038f71fb46de6b33dbe6190b765f82d35c1c69a604551fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333375, "uuid": "cafa4955-8378-4039-bbb7-0393792da712", "comment": "Malware payload (Mirai)", "value": "edfc4397020f833c9cec0d8d4cd5d7641f26c658", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333375, "uuid": "7bf5f92e-66a5-4e0b-9a38-0870b5e61dee", "comment": "Malware payload (Mirai)", "value": "92d453fa45885bd278fc4fe6c334b2f54d87b4f05923eac797016037b5e5725eb98fb268bd32d39fd19d4a1a83e8170e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333375, "uuid": "b4af2398-6c57-49ed-ac63-beec7c759961", "value": "T14AC2D0B93914AA20C3780D3BFF59D296676B85B8C1F43151295043BCA8474A6B4BBBCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333375, "uuid": "d507cbf0-e959-489c-a7eb-f64ed4d1f4c4", "value": "384:+JpwMYv9SuTSrG8Y5PzF4HSmnZ3FPwLLG46TzOBv3OX0yEe6/AN25vSUvDPVSZ1C:xRSa8ZS/L6rze3OXXcAE12Xs3UozYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333375, "uuid": "f19065ca-20ca-4ccb-95af-b25aeabd5e43", "value": 26292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333375, "uuid": "f3d817b6-1679-44c7-91a7-c220558db0cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333375, "uuid": "2462c5dc-b801-4e09-acdd-a19594987b72", "value": "9067b7197d8054ba3b36421b4be894d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfdcdb22-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682323141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323141, "uuid": "d664ae0f-40d5-4805-a50f-74380504736a", "comment": "Malware payload (Formbook)", "value": "983bf12ed051c8e8ea866e3cfa4b64f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323141, "uuid": "975af9be-0f01-4034-b8a2-3af246f7282a", "comment": "Malware payload (Formbook)", "value": "7e5a4a969f8e5439adceca4bc465664de6f891baf774f5d472cced75a52c5b5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323141, "uuid": "9f035915-89ee-45b8-a331-7ca36502a32c", "comment": "Malware payload (Formbook)", "value": "c626c7ee859ab96d713d5447321a734142ab86c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323141, "uuid": "4cdf4e7d-c051-45f7-834e-93f956cda24f", "comment": "Malware payload (Formbook)", "value": "5ba659cac8c0884e68eebbc806d4df37ab5ac8bdd41075c4df1cf688d426b2c78426759002fd0a7b2290232421615bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323141, "uuid": "7055bc85-bd43-466a-886f-efa54c002900", "value": "T18104AE32DA42C431F2B252B5B2BD1B7B883D0E353295A4E9A3F115E06EA19D5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323141, "uuid": "dfb763f6-99ce-4aed-aad0-ea104270e637", "value": "3072:1GcUkxSHP3Er83AYT8NGSYW67OycTpITU+ucNRPvCwlUKw:rysyAq6x6Kyc1UucNRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323141, "uuid": "badd762f-8d5c-4b8a-b0ed-a6726b660747", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323141, "uuid": "11a47c62-0efb-4ad7-8f47-b2fc1d0331ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323141, "uuid": "5a383c50-77aa-4df8-b263-2b48dad8b68e", "value": "7e5a4a969f8e5439adceca4bc465664de6f891baf774f5d472cced75a52c5b5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1b3e8d-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330223, "uuid": "e73240e4-0ba8-4c98-8c1f-1721dfe8fc07", "comment": "Malware payload", "value": "b6fc30787eecb5e2bb82d00d4d4b6237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330223, "uuid": "f6092c9b-12be-4f3d-9408-207790eebcfa", "comment": "Malware payload", "value": "7ed926820973cd3c14b783109094604369e37cc06cb08a338b856f4e5cf2684c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330223, "uuid": "1c944a58-5272-4ef0-b635-c0f9a1b90dcb", "comment": "Malware payload", "value": "cc838523125cd30d6c4f57b6ffb0617df7909620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330223, "uuid": "115ea518-8cbb-412a-8e58-d8759c33e6d6", "comment": "Malware payload", "value": "b3e38d46ab298ae68d8baa663791dec82a3df7e24da9041ef5c7a9b371755db6e5fb3cd70c0e386178542d48061d0db1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330223, "uuid": "6808076d-521f-49d4-8b56-93b0da819857", "value": "T11836D0AEA054823EC65E4779D4C68E32E132F1F11E7FD32E5A90C1E46A574A40F6FE60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330223, "uuid": "ee037759-3586-4689-8ad0-bbb7effdc99c", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330223, "uuid": "7c10a1cb-db3b-49f1-84e3-77647fb54d77", "value": "49152:p9cha5GRE45F7OcI3Tcr10bKaAC1leVb1fXdY9UFG/fLte0H6GkboEzYL+v9MXKw:3/tTcJ0bKZCTe11valfy3LduNRtyKq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330223, "uuid": "0b5c9fde-4346-44dd-a75a-ad9be4bb09fe", "value": 5130648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330223, "uuid": "2568df73-6441-4b68-a2e5-e27cfe94be32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330223, "uuid": "54e09b1c-7e03-4bee-875b-0cc438b63775", "value": "7ed926820973cd3c14b783109094604369e37cc06cb08a338b856f4e5cf2684c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b03179-e26a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682318245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318245, "uuid": "3fd8a1c1-0260-46cf-aac9-d083612fcbce", "comment": "Malware payload (Formbook)", "value": "11e4085e79cd658c56640fdb07d9a051", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318245, "uuid": "30392947-7216-41db-89d6-988f346454bc", "comment": "Malware payload (Formbook)", "value": "7ef0cb5e86cbc111ea9277f59b80e186a7d4a5a0aa4e44e0b881b420cd5ba3c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318245, "uuid": "05d0f3d5-edbc-4178-a489-f308ea0e3508", "comment": "Malware payload (Formbook)", "value": "e82ff92c81fb0334a0164f50322582d3b59ce387", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318245, "uuid": "df36cc25-07ef-41f5-863c-c594627409ef", "comment": "Malware payload (Formbook)", "value": "82363415ed7005dd91086f739466ed69d2045b02046f11eb58e2623a4fd9f672a73d32a9f2b26eef642046ddc90ef039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318245, "uuid": "af88df35-9d63-41a7-bb7e-536208650ed8", "value": "T1E994D00980F898EDD178C5B20CA5F99E76637C1A9C255E474E53F8ADE83318126B3E1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318245, "uuid": "158900ee-10ac-4c9e-9006-d7a9668a1afe", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318245, "uuid": "100a18bc-dd94-4e30-b0ba-dbc5404021cd", "value": "6144:sYa6k8IHJ52szcF+YeVetePvMqEVa4K0eLsqR7F71valmToj/5:sYO8gL2YuLMUePvMz6gCZ1tojR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682318245, "uuid": "58fde80d-b8d9-43c8-968a-f7c52ca239ab", "value": 414716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682318245, "uuid": "b4402e78-8055-42af-924f-343a22df0a26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318245, "uuid": "448c1d7f-8470-4340-bee8-254dcd6c7a11", "value": "DHL Notification_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18fd00a-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333425, "uuid": "71b99dc5-b6c3-45fa-90bf-66375c832b4c", "comment": "Malware payload (Mirai)", "value": "7c3b1b8e422d0d69d73c14ba8ffbebb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333425, "uuid": "e0aebdc5-a29f-4aff-8f0d-405a8546e3e7", "comment": "Malware payload (Mirai)", "value": "80189a936601945fa83672bc77155ebad0f699600230d0912a98525cca613f1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333425, "uuid": "53192b48-189e-4ec0-986d-d5d84436f28e", "comment": "Malware payload (Mirai)", "value": "254d98ae1c6e4c5697020959fabfbb89ecf5296a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333425, "uuid": "82d207e8-d4b5-4e03-b7fe-86c8541ff9d3", "comment": "Malware payload (Mirai)", "value": "5a61fd2ad3597b296db8595ef424d45150791e30dd40e6f6896665150f8884106d38a7c9d012aee4c6ed392eaa121450", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333425, "uuid": "2ae296c6-47bf-419f-a683-a1cc55ac355f", "value": "T108C2F150D06C2D8AFDAA6DFABCB8D2D87F0307DD1F66D7A1B2285353C2826181D05DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333425, "uuid": "20700671-5174-4bf1-bd49-448510460cd1", "value": "384:9ibIHOqgeXBHxmRl1fQxzDn4SFUVlBxy5gXQ+D8mdrUT7Ni7hM4uVcqgw05VxJ7:wUbgeS1f8Dnz++uXQTsU4q4uVcqgw095", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333425, "uuid": "fece4df0-810e-4d5c-b7ee-37b4c3799332", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333425, "uuid": "ac35b44e-a799-4e30-aed6-4f8b738f1040", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333425, "uuid": "1ca1a26f-4401-429d-aca3-f2e82182dc2e", "value": "7c3b1b8e422d0d69d73c14ba8ffbebb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a59d3c4-e29c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682339748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339748, "uuid": "7451a7e2-c52d-4125-a056-e69d8c76b505", "comment": "Malware payload (AgentTesla)", "value": "1332ed07e43aeda0344556ef035d1f7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339748, "uuid": "fd541bec-8039-49f9-ba03-a5ca8518c57c", "comment": "Malware payload (AgentTesla)", "value": "80765935010325c3751344e7e28dca3cf6f5661561bbdac350de88ef68e97a47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339748, "uuid": "d39e07a1-107f-48da-bf47-3e029f248562", "comment": "Malware payload (AgentTesla)", "value": "2d35d2929515ae74326a1cd1184d8cb60008de07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339748, "uuid": "216c0a9c-127e-4189-8854-7941b9fc6135", "comment": "Malware payload (AgentTesla)", "value": "8405da9365bafd699f1fc3c09934b3c953ee53fa8d21877e3faa5fe04a3cd0af24769f2116ee2fe8a86b24dde1d9bb2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339748, "uuid": "06224a21-393c-4bb8-941c-6ec213c07506", "value": "T105C46B2D99EE49FBD135F2B6CFB98821F563C5637252893965EB02444602EC336C42BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339748, "uuid": "65ad389c-fab5-41e7-a439-e099eddd3d63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339748, "uuid": "fdd29f04-611f-4e80-8909-90b46dc933e9", "value": "12288:iYpW2iNuGXT6+Rn8G9cNhg9aIjYajIigPnjq:G1wwDR8xLgMIjYAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682339748, "uuid": "967943fe-8403-4c6d-9979-ca7aab2b4a76", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682339748, "uuid": "8d6fc550-c198-4209-bc64-41ca4c8be50b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339748, "uuid": "d94d37f0-1bc8-42ea-9280-ea66525be3ba", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9add3e9-e26f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682320607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320607, "uuid": "e0debe10-9c6a-4c5d-b387-9bf68c00ec48", "comment": "Malware payload (Mirai)", "value": "6370e1d4b76d53524265e88b6745d050", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320607, "uuid": "c8611c60-0a98-44a3-8096-1d2bd6c0138a", "comment": "Malware payload (Mirai)", "value": "814878b6ab9f5cbd287f39da230b505f76ec9eeb5565c4424e8f466d653faa92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320607, "uuid": "65e460c7-9e3c-4ba2-9a6c-43556e6ac1d7", "comment": "Malware payload (Mirai)", "value": "01949044b831ffdeb6340772fe4b0354f139e8fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320607, "uuid": "727a180c-075e-47b1-a553-bdf679ffaac8", "comment": "Malware payload (Mirai)", "value": "d420a7a3c109a53c95d9a0fbca6f558769c3eab5c41a9b62ede1bf6de370457f74f0b31fa00e601c6d392db0fbb05f1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320607, "uuid": "14310d9f-d9b2-44a0-a45f-b4fd3a1d56e7", "value": "T12E334B21B97A2E17C0D4B5BA62F38324B2F6164E25E8C72E3D720F4EFF14A4065536B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320607, "uuid": "c0307f1c-c5d6-4db8-af96-4866a7e84be1", "value": "768:W0oUFNRq9OOr66rXy9l+bxGJU3ZOcJsF27favPuO+ZkXwCcMu:W0rFNRSzr66rXIl+bIJUJOcrUcZZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682320607, "uuid": "f0000aa4-c054-4125-a3cb-5ae92d90ac83", "value": 53348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682320607, "uuid": "1109962c-4160-4ce5-b44a-0ba8f8bb9659", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320607, "uuid": "031baf48-1cf3-4ee1-b1f7-6f56e23758c7", "value": "6370e1d4b76d53524265e88b6745d050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d22f6de-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303245, "uuid": "2616d01e-65cd-4878-85bc-69c2c0ce5019", "comment": "Malware payload", "value": "9c0c6f20b39d14b72d1f2655f553564f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303245, "uuid": "3f9d7f59-19d5-4019-b711-ba5f48bc7218", "comment": "Malware payload", "value": "82efbd1bee6a6eaf97d344b803f6d1509007535dcc5bd0809bd5a62216a29146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303245, "uuid": "3e1b49c3-17f9-46f2-9a0e-916caa880b87", "comment": "Malware payload", "value": "2ad5264176024b5fd3b623f85648813ddf5c2775", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303245, "uuid": "66a11f2c-bf33-424d-a8fd-7d46475ee130", "comment": "Malware payload", "value": "5e6da5690e0ec4d68178364b515864b51687e4f919bf800e5b7bc4722bb3bb2e6af990eaae09fde60e58faffae618e49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303245, "uuid": "3ee3bae1-bc37-4d9c-9b96-76af5fe0a8d3", "value": "T1AA83F1B3E7B4E2E6EA8C8A3210869CF99728D821E2541F7307558D0EDF14BE5EE5944C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303245, "uuid": "310c76cc-d100-4602-9891-8cc67eac25af", "value": "09d0478591d4f788cb3e5ea416c25237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303245, "uuid": "34801863-e18b-4368-9d8f-ffcfc03c2fd9", "value": "1536:mhWXT6DpTaqgY5+YEligZ5VQnDUCeej/kRT/PBo0Cf46:mhU+DpT6Ysk4rWDUCeejMRT/JVCf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303245, "uuid": "9eebd12a-1126-4d49-9786-eaf27d0bb15c", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303245, "uuid": "27a2c3be-8164-4ec5-9513-aa0d28c72ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303245, "uuid": "c58b764d-9d22-4c43-8790-91e14a914f6b", "value": "SecuriteInfo.com.PUA.Tool.PassSteel.18.18980.9496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435e5fd7-e2ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682346071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346071, "uuid": "9f8c6923-1c66-4ff0-b4f9-62220bb8b3e9", "comment": "Malware payload", "value": "9050ac019b4c8dddbc5e250bb87cf9f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346071, "uuid": "c8229579-84ba-42b2-a051-806118b94a71", "comment": "Malware payload", "value": "83d225323c8783c84d70aee1da5b507dde1e717ab3233f784fbb1b749dba11b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346071, "uuid": "b2865b44-9843-4b61-9d47-5ead8566427f", "comment": "Malware payload", "value": "241f50bf6100bd84a14bd927a28bba5bc7df30f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346071, "uuid": "3f27f1e9-341f-45b8-b24e-efb13991cbde", "comment": "Malware payload", "value": "e9e8df00b872318eac0792383a733f10b3dddcb423ab43c748c06ae9d28f4d99ea652f16fc44726f283ab13a1c33fab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346071, "uuid": "4de8aa67-d544-4a55-9ce2-6418c4effbee", "value": "T102A42361B76BD82AFB0E083542A5DF7D8A6ABD02F489834301B93F5F7D363905D1DA09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346071, "uuid": "da44b1ed-faef-4257-bbbe-4faf3ed52b40", "value": "91c9c82d5da6c673b4454be0c166d822", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346071, "uuid": "4ca08181-5cbc-4bff-aa95-a94213f88fd7", "value": "12288:HNrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVjSOsJ/1:HthTiP+ffCfB5Lf0F7Z1EDsV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346071, "uuid": "aac9d4ae-f06c-4f08-b153-a504b6c149b5", "value": 485728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346071, "uuid": "02e52061-5a0f-48ba-87e8-8e0c6f88247f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346071, "uuid": "e9b41987-9ede-43c8-b4dd-333c6c2de849", "value": "9050ac019b4c8dddbc5e250bb87cf9f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb4e211-e297-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682337551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337551, "uuid": "32cc18b3-386c-47f1-a996-7a71f4afec63", "comment": "Malware payload (AgentTesla)", "value": "3d82f6e136af73fb8f7acf892e39a545", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337551, "uuid": "d9c69e83-bfba-49f3-ba11-1912d2c38b4a", "comment": "Malware payload (AgentTesla)", "value": "84aa1661a30809c63918d49c6076ea8cf486a34826ea35c5a8b498bb1f1e83f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337551, "uuid": "9c1cb071-d636-4883-b86c-982136598684", "comment": "Malware payload (AgentTesla)", "value": "733d82f0da8289a54a45f9296a930e8a0b6b22bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337551, "uuid": "4bc439bf-8213-4234-bb19-51f2c4808005", "comment": "Malware payload (AgentTesla)", "value": "0bbdd0ffd912dd8e97cf84a8bdee02eca7abf8b033972e306a40e0c8d2c6d0814a2f5df0cb1daaf256eeb4e83a906979", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337551, "uuid": "4d6f4b58-d5b6-44b6-9efc-6668b70f7c0b", "value": "T13964D01A7AC75511CC582B71E0C3152413B3FB8B2673D74A368E16994F933E62E8EB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337551, "uuid": "db3dd0b1-03a0-453d-a75d-75b819987482", "value": "6144:aGZ+HHIAwbGPMWcxjR/i623hW9IOyHTIn4:9Qo5Q4lR/UhpfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682337551, "uuid": "56a8240e-bbb7-4460-a24f-c08a7e18b78c", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682337551, "uuid": "c7bf7805-8c85-48bb-a6b4-90aa921001d8", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337551, "uuid": "03f725e6-0b62-42d2-a1ee-e985988613f7", "value": "Purchase Order.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5f5542-e26d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682319405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319405, "uuid": "67b562f3-7379-4b95-9dee-1cc438ef4124", "comment": "Malware payload (Loki)", "value": "886fb075a57ffeae648a4a65ccb2fceb", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319405, "uuid": "65b9f8ec-f16f-4095-97b5-b4ea92e93ed8", "comment": "Malware payload (Loki)", "value": "84b7eab7fd87af3ab68f8eea5249bb206855ce049000faf7a6c0d2f4aa1c638e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319405, "uuid": "d794e7a2-60c1-4368-bc68-5769059ad371", "comment": "Malware payload (Loki)", "value": "b3829493669df58caeee7ea11d16a98e9cf96600", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319405, "uuid": "8e632766-fcbd-4889-9397-b2d78110cd28", "comment": "Malware payload (Loki)", "value": "c4f21fd2856021ff3ae57bf01fdbfbbf34834a3de48a894afe2c136d49c221542bb4843d215a50d49be54a58f1d5dab2", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319405, "uuid": "b24c7946-d798-4039-83a8-e4c762747b32", "value": "T1B7041376C47510D57CECA2F44B6EDBE6858C7C22EEA033247E4212BFA5484877BAED11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319405, "uuid": "04564565-6f8c-4e8d-8b01-744363d0b31d", "value": "3072:bpOz8IaLBWFuLPkd0loKXTp5do4N8eQJcnEhkLpGC5Q5cGZ351bY7V:bpU8PLMFSPo0lo4pl8eQKnEhnpr1fbqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682319405, "uuid": "9d139f76-7f6b-44d3-8bb1-9839b3cdc6bd", "value": 178367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682319405, "uuid": "cc2a0043-51e4-40d7-be28-849f1fb040b1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319405, "uuid": "9a005d7c-3f8c-499d-90aa-7a106a79c754", "value": "-Certificate of analysis INV.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791fc9e4-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303212, "uuid": "b969505a-a490-4f5a-93e9-f28e4a737b3c", "comment": "Malware payload", "value": "8bdf07af123a3fdc56ef5b1547fdf45a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303212, "uuid": "de4d4776-75f6-4f30-9e52-fba966b31f5d", "comment": "Malware payload", "value": "85e407b3c432e202bbb8dee41028da84b1775a36a1b77d3610823ac3caeda848", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303212, "uuid": "8046ce74-c112-4352-9c65-384767a78d69", "comment": "Malware payload", "value": "49479904f0fc891189eab47d883c0a2b83766a1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303212, "uuid": "15ec8479-2492-4ee9-9164-09b228d223e4", "comment": "Malware payload", "value": "bd57c9d1636ca9b781875a6972eb598e6200ee7b29b6e0ece77c435038a9c6be5cfb81cdabc98adcadc1e74dfba8110a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303212, "uuid": "cb9b9db2-42eb-481e-baaa-abe81ae06608", "value": "T1A7928D82C6788CC4F1A8613601AACD2491E7A5E3455D570B35CFBA2FAE725A3843BB34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303212, "uuid": "f52ea877-20c2-4ac2-9767-f087d1dfc343", "value": "74e601509126088c48b47d1b43a6e894", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303212, "uuid": "41251664-720d-43a1-816c-5595cb5470de", "value": "384:mpMMKDlzd4SQtPUbDgc5IbxiHzeg9daSQbPdXB:medDlJ4Nt8Xgc5Wxc9dmbFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303212, "uuid": "732ca9a6-1716-4f04-bc13-db5d9c23f221", "value": 20076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303212, "uuid": "adaee5d2-f49c-4708-b931-776463ae7fcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303212, "uuid": "01da44f1-295c-4dc7-9db0-7dd4512a8fb3", "value": "SecuriteInfo.com.PossibleThreat.21424.28996", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7bc36db-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682323181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323181, "uuid": "51a049e8-7322-4795-84ff-8de13123ffd3", "comment": "Malware payload", "value": "4c913c3ad1bdcd3b73c1a00f420333a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323181, "uuid": "7f75fdf8-9ed0-4a3f-bb95-1d0bbefc5d62", "comment": "Malware payload", "value": "86ad5c7ca58c6f796cfb64a977f1e31ab1e318dc4efbb505b3ac8b5e1d90775e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323181, "uuid": "8ce43fc0-0d77-4194-b3fa-ebdbe3035af9", "comment": "Malware payload", "value": "6df149f36a3c18447aba2525ea23641794c0be6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323181, "uuid": "ad0b9625-566a-4ef8-8072-51871711de8a", "comment": "Malware payload", "value": "7403c8a6e879af1c42775a04f7bfdb751aeaf04a6d1ebab5167dca1766d3950157377d13736b2221cbb1c6537b039dc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323181, "uuid": "867f44c0-dcf0-42ab-a4f4-c7cdc9816aa4", "value": "T1D5D4D0F130276393CB6AFCF0136D61711FF1C2B7E124D9ADBD0E64696A607C81A582DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323181, "uuid": "44df4cfc-7274-4f1a-8498-3c23d0f37daa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323181, "uuid": "2319c8d4-b42f-45ca-be96-7fe817df4f1a", "value": "12288:6VTmclFiW2KuyNgi8gmDbnRnmwOAw8W9MW0edSfR:6V39EgmDbtVOaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323181, "uuid": "5f4e3f79-e4fa-4fd0-93f8-3410c54ca341", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323181, "uuid": "1c02d54d-cf46-46b6-9eef-0b223cfe265e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323181, "uuid": "31514d69-e19f-4421-af77-0eed603be65d", "value": "Payment Copy______________________________________________pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4784e2-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303214, "uuid": "1fccd5f1-4bea-49bd-8fd7-8f539ae41818", "comment": "Malware payload", "value": "b420bf2dc387d9eb22c96b42a86eb875", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303214, "uuid": "61b946f5-fafa-4b28-a5bd-0b9f1ae4053e", "comment": "Malware payload", "value": "870dd0ba12ae7aefcd37be942265d8a906176394db5414d92582351897065e98", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303214, "uuid": "a3b0234e-4c62-420f-9afd-1b9503e9566f", "comment": "Malware payload", "value": "098e3c6a901bb03406e2b64e95f702ace06b4f19", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303214, "uuid": "6a26de62-8bb2-4213-b083-272d361e7d83", "comment": "Malware payload", "value": "0b8734a274dd49d6e6fde64a94509ce588e396f522d80e1a76552dfb6359b74193cec5bc0ffc23dc683554bf7343a69d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303214, "uuid": "90d0d4dd-e961-4352-ade6-d4bc19b6687f", "value": "T1BC13F145E8C9C749E161023A6AEFBF431804771CEA679BD5A6B420FB3E84B00ED57731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303214, "uuid": "66ae2357-9f0f-4990-8834-6236e2377a74", "value": "0f0cdc227e9c0eaa7cf12af0bd29dfe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303214, "uuid": "d10d0dfd-3771-48bf-846b-83edd362ce30", "value": "768:NsXlOuiZoPpQ6YFiVbDDFduQx1MD92biyrob8hoTBfLlMjosjcZdF5onbcuyD7U5:Nn3USKVTFd/uSiyrogCBfWjos+dF2no8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303214, "uuid": "93c454f8-3e10-4800-b0fc-8061dacb04e2", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303214, "uuid": "6559bb5c-5f3a-4605-b1bb-95cd36d30b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303214, "uuid": "9ec9260c-c926-4932-81bd-5ab34e8181ee", "value": "SecuriteInfo.com.Trojan.Siggen3.51802.27860.20457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c00d4e-e29f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682341008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341008, "uuid": "88a044b4-9e95-4c2f-9db0-88d8fa20f584", "comment": "Malware payload (RedLineStealer)", "value": "42e6aaf9558d6f99527f00e8f9a4d805", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341008, "uuid": "d1a0ff69-186e-4bcc-875d-955343693c41", "comment": "Malware payload (RedLineStealer)", "value": "8827cd69b8afef5a7866a2508a8b632001ef1384bba2948f3b173a9243004e43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341008, "uuid": "697a8c76-7ae4-488e-928e-d37f5b918b94", "comment": "Malware payload (RedLineStealer)", "value": "d2854041965fa6e2acbd0d7cd8adb89fb1dffb29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341008, "uuid": "1d1ef746-9a0c-4fc9-976c-155e5a2b8f57", "comment": "Malware payload (RedLineStealer)", "value": "9cd818c251d3cc059aced5b42c64af34a1bf4e7e3939c3dfb476714d4fd0f56d24a31a88c51c95de8de4c3689e771ae7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341008, "uuid": "acc0776d-874d-407a-af68-540a5bc6e83b", "value": "T172F41202E9DE5132EEB117B088FA51930A3ABCA66F79C7D71391144E5C73A84B531B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341008, "uuid": "1e3c7f06-19ac-41b9-873c-af58195b168c", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341008, "uuid": "98c3d119-a473-4075-8ae5-8c3db275db0b", "value": "12288:sy90RgQyjIsPPWTgEXc7Lh5PNbImqHragMQdiUWwztF3elWhf/ICi:syIGIgqliNbI5HOEd5X3el4ri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682341008, "uuid": "b7abe15a-01ac-4483-ad0a-1749fc9bc697", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682341008, "uuid": "20864401-d8c1-4394-a44d-5ea069395c9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341008, "uuid": "7886619b-0ab7-4938-be82-b8bb1a9f8010", "value": "42e6aaf9558d6f99527f00e8f9a4d805", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5383ae94-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682346957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346957, "uuid": "c732bb78-c895-4308-8d77-b17e3d5782d4", "comment": "Malware payload (AgentTesla)", "value": "4800ebd004e4134b0fe7aac791f66ced", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346957, "uuid": "8988218e-bb83-4227-937a-f11f3e1123e5", "comment": "Malware payload (AgentTesla)", "value": "88c57d68e2ca4a359aaf8a1d6225ce440657f02c27f2e87f61cf72d93b4ae956", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346957, "uuid": "f58e4e8e-f346-4944-b6c2-2de406a0e82b", "comment": "Malware payload (AgentTesla)", "value": "909492de26131649fdcdc41bbdf81addd1c0e786", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346957, "uuid": "ad3e7277-676f-41c5-889b-3028656402e6", "comment": "Malware payload (AgentTesla)", "value": "5e88dbb0f524117a103fc1799b5ce9e05f6acd32669ff08b94f7d9178bca03bfc2ea0e5b42e02796f17fbe242a64f607", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346957, "uuid": "9a910525-0dca-483a-b45e-09684ede51f8", "value": "T125E4BE2B622AD5B6E15E66B3D0D517FB0F6C2ECAFD79A0430BA87CD431727B90B48411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346957, "uuid": "fb0af6da-09b6-4ad7-8b74-6d8919ee71a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346957, "uuid": "80633075-5cc0-4dfe-80dd-77e50902902e", "value": "12288:HKHEjY+LaE5czMZm81UuhWbnk1nLn9mWbavvSy2p3NIYxVhOO/uLqy:H7P5PWZw59wvvSy2dv7h92Lqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346957, "uuid": "0764f1fc-ea71-4b28-9a17-1e6c65f68d0d", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346957, "uuid": "4ebecf94-9508-4b3b-9844-eb1bbdfcb6fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346957, "uuid": "832a59b4-c8e3-4f37-b56a-5b2a11a9f373", "value": "4800ebd004e4134b0fe7aac791f66ced.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910da811-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303252, "uuid": "4398d91e-c24d-487d-8ef0-fad1cdba8594", "comment": "Malware payload", "value": "407c5a51a389c25ec5574c93548ecd7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303252, "uuid": "8fc1c128-dd58-4582-928f-ed2810e8a762", "comment": "Malware payload", "value": "894a939e3ade31cd8e5482f0106205998781e7a29d86a447e3359d2944fa2470", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303252, "uuid": "e4198a6a-e678-4b5f-a630-0d58a07ea4b3", "comment": "Malware payload", "value": "548efdd970b3e1090c704f11c701792337d0171e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303252, "uuid": "fd04d5e4-c367-4c2d-8926-2dde2be338ea", "comment": "Malware payload", "value": "1e6de27ab1e42ee4c5bbe60f598141d2b98faadabbdb7b0852c0aaee2b4eb9e7e7c9c4c1fc149c9bf018e32bbaeefb99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303252, "uuid": "687f0f69-102c-4f87-8c2f-f232f4cec46d", "value": "T18B569D22F7D18936D1661738CC2AE6957735BF442E296647B7F83F0C8E7A281BC081E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303252, "uuid": "ddd098fa-0d4e-4715-8804-2bdb2952515d", "value": "6144:OSaCJn84NKDrj4eXMG4kGVrdjhFeMlQRTgdaBV8jjjr:OE84NKZ4jfVQRTgd06jjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303252, "uuid": "257025fc-8fcd-4e95-91ab-6aa77215bf5a", "value": 6430720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303252, "uuid": "821bca27-cfd0-46e9-8b53-003327424c9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303252, "uuid": "69e32d34-ddbc-4589-b48b-2dcb93cde227", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.425.15472", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a23926a-e298-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682337868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337868, "uuid": "df0b2f41-e06e-4b52-93df-0f6740bbcc9a", "comment": "Malware payload (RedLineStealer)", "value": "1fa5ae9735c44e4eff162d8a3d182851", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337868, "uuid": "5cef33e8-64e3-44ed-a266-f65c9ddf39bd", "comment": "Malware payload (RedLineStealer)", "value": "897963340d19ca50a3cbce298fce834cb277b8c5d0d4096896ff4e6202b24754", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337868, "uuid": "dc926213-527c-4871-99ac-b98f64bb3f17", "comment": "Malware payload (RedLineStealer)", "value": "0ff5c870922487536202420400ae1f88aebed590", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337868, "uuid": "408c1c5b-9c74-4ea5-9993-127d4dcaab1b", "comment": "Malware payload (RedLineStealer)", "value": "763935b471cfe43d52d986ec9a28e862cfd56b11eeb45a22e7d8ceb6b8b68f0b45e292e6c5cc3a21c70ce0d314a4598d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337868, "uuid": "92eb1e67-59ee-4415-b262-b05cf3881917", "value": "T155F423AB57D94033C9B207B019FA53D30B36BD615B78AB9B375469890C727C0A63633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337868, "uuid": "67c73017-ace0-41b8-ab03-32fadb7aeb13", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337868, "uuid": "c36532c5-a96a-4ed7-a437-643711f3b630", "value": "12288:gy90hkUYOalm4GEuM2/78yskxtX5LdqGA9Z9HTm5xd8EzWX6VGyn9XaTF:gyokUTe88uhE7mrmEyCx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682337868, "uuid": "3bcc12d8-f519-4d0a-b85f-507f8703c26b", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682337868, "uuid": "d8b77b41-073b-46b9-84e8-0f688a66f7f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337868, "uuid": "bb120904-b358-484d-9ee7-122aaa0bd7db", "value": "1fa5ae9735c44e4eff162d8a3d182851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f8b2e5-e2dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682367044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682367044, "uuid": "0fe2a376-77d8-49ea-81b9-b5cf2ff4b2d7", "comment": "Malware payload (Mirai)", "value": "5d719b3c1c4ed7b90826ea5fa3115c34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682367044, "uuid": "26aa3b77-82ec-4669-beb6-77e8c7b47169", "comment": "Malware payload (Mirai)", "value": "89c6d24f109d5c7aa72a125fd6dd8f287e35822892572f16215a0197f139172d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682367044, "uuid": "999b0b0e-2991-4fb1-b079-156f63b89e04", "comment": "Malware payload (Mirai)", "value": "8104cf32c48a1dd72d10832bb4f4daf4f64e6f92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682367044, "uuid": "8715d4f9-12fa-4350-9a1c-ee79364db76d", "comment": "Malware payload (Mirai)", "value": "5bc36540ead7f68f1fcedbddcf63898274dbfd05acf252a8cf3f3104dd62f75c68d5bbe2609cd25ada4a04f587eccd5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682367044, "uuid": "d274f660-d40e-4844-9e5e-5cf37086a945", "value": "T146330695BC819A13C6D423BBFA2E418D332563F8E2DE7207DD112F20778A81F0EA7655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682367044, "uuid": "ff122437-b8be-4f1e-8f4e-3edabffc91fb", "value": "1536:CF6ubx6gWBAI/986lQ9Wt5Wey+0EvbFTPzF:CF6u3q8mQobvdbFPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682367044, "uuid": "7be7486b-c3f2-48c3-b472-b3140563fd9c", "value": 55072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682367044, "uuid": "8511fb42-4859-4dee-afb2-225d5f446497", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682367044, "uuid": "3f9069ce-d6fc-45c6-8c50-9c89ffe311ed", "value": "5d719b3c1c4ed7b90826ea5fa3115c34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a57f1d-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682346932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346932, "uuid": "f0ddda1b-f613-44f8-b750-7e63e1ff9054", "comment": "Malware payload (Formbook)", "value": "bcae62255fcd6391b3ea099ce345209e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346932, "uuid": "c0bdfd22-fb5a-4a5b-bec5-1656d9ad88bc", "comment": "Malware payload (Formbook)", "value": "8a1f57853b44e3702f2758a4ad46225af7fa0a847ee22b0a9f190be5c062869b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346932, "uuid": "697bc27c-69c0-4862-9e49-97edc01f03bf", "comment": "Malware payload (Formbook)", "value": "a52d0f6ec60908b056727c9af9ceec563f90de35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346932, "uuid": "6febe948-883f-4973-808f-8f5837538dcf", "comment": "Malware payload (Formbook)", "value": "4c657aad8e8de448d9c459aeb0de994a87985b7b84fef5a0e4d5343b0664c4fb047c0b138a9149ccb8fb0281040a32b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346932, "uuid": "01066429-037e-4b55-b94a-249a7b85ecab", "value": "T11CF4E120F20E2CA6E54BA5F2491973172A19B3CA7E3C65946B7DB5E121B33CF1B85C07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346932, "uuid": "bf5f8170-4d60-4bd6-9d51-91b8dc24ad0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346932, "uuid": "8e95e521-150d-4ffb-a94c-c0d504679446", "value": "12288:wjgjjLkCS3b5GDo5w/8u13IwR1Cf6Vfj+TktHNjmKkjDv:wjgjjLkCSL5H5w/VYSVfiYrzkXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346932, "uuid": "880380f7-aaa6-43e1-a87e-dcba4b35e866", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346932, "uuid": "fcee4000-6490-4db2-8c77-71e27d9196b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346932, "uuid": "a35af77f-5c56-4f5a-9dc1-db75c8bff808", "value": "bcae62255fcd6391b3ea099ce345209e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed86b7e9-e27a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Pony)", "timestamp": 1682325311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682325311, "uuid": "73b22e85-a434-4fc0-ac01-24a3c35f4f7c", "comment": "Malware payload (Pony)", "value": "2d8f60c9459f321d765ce1e50e49f41a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682325311, "uuid": "44b0e6a7-5ff7-4ff8-8d42-d6f50c634ccb", "comment": "Malware payload (Pony)", "value": "8a279783229e688a2324c224904473431cc5cab7e6b8538ac8256877cfd58384", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682325311, "uuid": "7d5bca8d-8134-47c0-b5de-ac7259405930", "comment": "Malware payload (Pony)", "value": "15797084c07f8ce0ef427fd868a81ab95b10f549", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682325311, "uuid": "eab5a53d-b6a2-4a31-af13-fcdb2c9c6bb1", "comment": "Malware payload (Pony)", "value": "6a725c4da7482ec85635a5dabcf10edb25e313ddb1d5ae4b9628c422e73539ce71db91ea99bfa2224c953816d719ef7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682325311, "uuid": "dcf601a3-49a1-47aa-910c-4b2e6d23f2fd", "value": "T11EA4E062B242E6A0C8180D3515079B814EB3AD142EA2EA977B94F73FCF7B3D17A01757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682325311, "uuid": "bb6c822f-4c89-4661-aba4-4469f6154452", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682325311, "uuid": "fbb09991-7176-4f6b-a8b6-20038f954380", "value": "12288:jHZKdRVIZcXwxHr7ypW4eSs1k2s5YqK7:FumcXg7aeSsQY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682325311, "uuid": "d4c77bcd-05f1-4e0f-83a1-5a79f40df5fc", "value": 477696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682325311, "uuid": "6e91fcd5-5141-4fc2-91fb-417c399551b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682325311, "uuid": "2d20a06e-a766-4b33-8560-51a430aacaf7", "value": "8A279783229E688A2324C224904473431CC5CAB7E6B85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66a316a-e236-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1682296040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296040, "uuid": "770d6d0b-f1df-4de5-b264-8f7e4e503e19", "comment": "Malware payload (Rhadamanthys)", "value": "b19a0ee412a0683165fe52bf435c9f51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296040, "uuid": "954325ab-75ef-4698-8f82-797e575372cb", "comment": "Malware payload (Rhadamanthys)", "value": "8a4cf3e172b8815dd6ff4fadad27abbb4b82b8feeec99a68e6ea7f166cdace04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296040, "uuid": "7b22d662-10de-41e6-990e-e7bc7cbbb3a1", "comment": "Malware payload (Rhadamanthys)", "value": "9516c8052844ad96b09ab902fd7183ca260f1d65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682296040, "uuid": "eac23ca5-26eb-45b4-b403-3756e58d4cbc", "comment": "Malware payload (Rhadamanthys)", "value": "1cb2dde3eb754619d2364484fe8206c65d25d1d271711a690d3df9ac3add93e457a2d0f8200ae506f6d7a6378b0f4033", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296040, "uuid": "5f68aa4a-d6b2-4aee-83cd-8014cd1775f8", "value": "T16554E112B9D0C873C44681358C14DABC6A7EB891975686CB33983FBF2E713C11DBA65B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296040, "uuid": "0e993abb-9c52-4b78-b90b-59117ed00afb", "value": "642f639d014c52fc4358f30dfb7c046f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296040, "uuid": "c5027218-15e6-450a-a9b1-141e2171b019", "value": "6144:PYAylX30SogG40sJfQ/g0pZ56kCiAqHl16gJ:uni40sJeg0ckCiAqHHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682296040, "uuid": "c066536d-eb34-4653-84c8-6df84eabd3ed", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682296040, "uuid": "7e0ccc01-763a-4989-9249-5e1230d478f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682296040, "uuid": "fc175cf0-2dc1-4482-ac02-d25407c8abe7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e58d2a2-e24f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkTortilla)", "timestamp": 1682306468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682306468, "uuid": "6ff12f41-7826-4925-a74b-a92c7b0d5351", "comment": "Malware payload (DarkTortilla)", "value": "1d82f9e6e4d17095ad3b65ead5dcaa54", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682306468, "uuid": "4e95a176-6b38-4524-941f-3123f6b2be19", "comment": "Malware payload (DarkTortilla)", "value": "8c10ac302b78ad839cb8bdb006778d6e27a03220f64f2e88aa9a6eae4f878c14", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682306468, "uuid": "5faacb1d-f9bd-4409-a5e8-91d036fb59c0", "comment": "Malware payload (DarkTortilla)", "value": "4301fbfbbd8cf71c6765c9c13688fd0188331baa", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682306468, "uuid": "4fc49be7-49f5-4632-8000-9471f4206819", "comment": "Malware payload (DarkTortilla)", "value": "5d5de61ac1bb45109dbb88cc44f5e4bd4b32c774f967795e45514e8c3c966a46a0f3a60e90880ad5ddcb5bca25c6866a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682306468, "uuid": "7cd97cae-83c7-4cff-ad9b-a6034f08cec1", "value": "T1F8B2AD566B8C4C62F256E87B829EE10E08FCF63630C215C4BD9DD2743B7E50E0A6B1B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682306468, "uuid": "a9a975de-1dfb-4485-bfda-18b020d687e8", "value": "384:DagLMo3jNZLSXsIis6pHMReUeootky6RmbwK82tCyiFz7dzWXs1hz34YW2H0xi74:WShNZLSXJis6pHMUUNnykmbNrt/aiXso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682306468, "uuid": "4fd619c0-806e-4c1c-8323-bce49b5e36df", "value": 23943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682306468, "uuid": "4958ea2a-dff9-428a-9ad5-e68ff38140c0", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682306468, "uuid": "02dfdafd-3dad-43b6-93b4-8f380b797961", "value": "1d82f9e6e4d17095ad3b65ead5dcaa54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8a353a-e291-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1682335213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682335213, "uuid": "73723f10-645d-4d84-9154-e3c281963e4e", "comment": "Malware payload (RecordBreaker)", "value": "2cbb05ee019452a74ee7e5ad089d60c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682335213, "uuid": "755d194a-52ea-47f2-b63d-34e8ff476222", "comment": "Malware payload (RecordBreaker)", "value": "8c65f9aca7c3e875f1762af6da5e8d2ec45a618ca0af481509ee7ccb8fa75f4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682335213, "uuid": "6c4395dd-cc13-48f0-abad-a592060c85b2", "comment": "Malware payload (RecordBreaker)", "value": "a648106c3eb3f8da4e4e01f92d9585c6eaa212b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682335213, "uuid": "fb06781b-00c4-4198-bfc2-aaef1885f4c3", "comment": "Malware payload (RecordBreaker)", "value": "0a86468d4df547f90ba99096ea06921679d77e510e5b5447b8d38099cce0ba391acfaf8d556cc79cedc9628d949a0084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682335213, "uuid": "2fcc7a12-03b7-42a5-94ac-8de61e03506f", "value": "T1C0746C1262D06833E6235A724E6EC7F46AAEF4514F157BDB1759FA3F0A346E1C13230A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682335213, "uuid": "509bde6b-46c4-4a55-afc1-22dc29222578", "value": "a1179765140463c0bdef01fcc8c985fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682335213, "uuid": "42ff95c2-ac77-40ca-87c7-e3d7907588a2", "value": "6144:x+FIhfFoOVc7U9mscvqSAzDQAUTipIP0HGenzy:x+FsfFBVc4mscvTAoMIMHGenz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682335213, "uuid": "d8fe5304-4b06-4052-b4ff-de719d2a49bc", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682335213, "uuid": "01c0b23e-da42-4cd2-8e55-c4dece46e2d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682335213, "uuid": "c98b25c7-8ff6-4f83-9112-860d48b32148", "value": "2cbb05ee019452a74ee7e5ad089d60c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a715d1b-e2a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682343613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343613, "uuid": "73d14ef0-5440-4fca-bd8b-68e65ae2e544", "comment": "Malware payload (Amadey)", "value": "935debcc127384a7ddc1c3f5d67e6f90", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343613, "uuid": "d21e7ff0-4a2d-4c16-9c93-82653d1c5d66", "comment": "Malware payload (Amadey)", "value": "8deeeb340493cffc685406a9ac5d7207d27d9f19b8dca7450fcdb96fe74a4a48", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343613, "uuid": "86176e47-fa09-4482-9ba8-1b7f516615af", "comment": "Malware payload (Amadey)", "value": "4aae06390e918846ea521afb251a12396459e786", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343613, "uuid": "d9e51892-204b-459a-a415-b215e3c0729b", "comment": "Malware payload (Amadey)", "value": "4d4fcf2cefd2b30aefe278f53ee793d1b3cfd5e35764df4b73e10a646e06dcdc8b5e94e5beaf6463425fc25ec6440305", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343613, "uuid": "5ee8fe87-08a6-4d84-93bf-2034f52046af", "value": "T1CF746C1362D06C73E5635A318E1EC6F42AAEF1604F557BDB2759EA3F0A782E1C272305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343613, "uuid": "dc3683c6-694f-4261-b525-e157f7068059", "value": "6a8dd0359e3425dd330b8f8519bc89c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343613, "uuid": "08a2998e-4a37-4454-8b2a-a0bf18f64ee6", "value": "6144:WUP0VLvCQ/wVRW4L5vLuRHB9A7dR7tnfy:WUP6LvCQ/4RW4LdLsy7z5nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682343613, "uuid": "3bdbe8e7-b909-4196-8bcd-56661a2ad728", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682343613, "uuid": "4ae6f361-7544-4a97-8302-00552d1253a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343613, "uuid": "355ea953-942e-418d-9c4c-1b6404002e25", "value": "935debcc127384a7ddc1c3f5d67e6f90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c68bd0-e2fa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682379920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682379920, "uuid": "f1a1a08a-d76a-4dd8-ab7f-5e62f71cada6", "comment": "Malware payload (RedLineStealer)", "value": "02a95b4835016a5f0cb57e1429569bfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682379920, "uuid": "ed6eb81b-5784-44ff-b711-015d161a3462", "comment": "Malware payload (RedLineStealer)", "value": "8e1fde8738b3f83e7e01465a26d198229055664810dcc2342ed53771d6898b9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682379920, "uuid": "05ce3128-dd03-4575-aac6-351d2dd04b9c", "comment": "Malware payload (RedLineStealer)", "value": "a6cc2171275faafa07b71ed1f05d69e459de4ec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682379920, "uuid": "a8a511cd-3e61-4e63-af6e-d334bf7b5f93", "comment": "Malware payload (RedLineStealer)", "value": "4f12f2d1f6eddd320d844986d3cdeb1c9679ffd7093fbb0dd22ce5be511920f0020257e36598eee4fdbaa3f333819b10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682379920, "uuid": "bf7c89ed-a585-4375-afc5-16d67ab3ca65", "value": "T125F42313B2DC5033ED7423B454FA028B0A36BD226BB592DF2381D9DA98B25C5A53573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682379920, "uuid": "2bccf467-5173-40ce-a8a6-230299744717", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682379920, "uuid": "174bcb99-20cb-4f3a-9b45-e0a1aa129f66", "value": "12288:vy90AYpyJiVwF2vW1Gutmz6bGJM1NcU7NYpuDED2Rbe4wVTa4DF:vyAyN2vGbmwATU7NK0ocbeZVmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682379920, "uuid": "f1b3b857-d177-400c-b880-1c5c23a033ac", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682379920, "uuid": "3e57eb28-a4af-4297-a81e-8ee20d4b089e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682379920, "uuid": "b0491115-5484-4cc4-ac97-cc03be77f4ba", "value": "02a95b4835016a5f0cb57e1429569bfa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26972212-e291-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682334856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682334856, "uuid": "94a1f93d-1040-4272-ab65-2b81af194741", "comment": "Malware payload (RedLineStealer)", "value": "2f09ed2bcf62c7720c18d8eb7daa73ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682334856, "uuid": "f5d970de-d755-4f56-bc2c-5b1f8630bee3", "comment": "Malware payload (RedLineStealer)", "value": "8f049de0dfd9cd721e8407fd80b05e4c7660ec14f039fb38822ca4c7e1cd12fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682334856, "uuid": "c597c825-9c2a-47c6-84a1-1a6898500799", "comment": "Malware payload (RedLineStealer)", "value": "f3771a73dd6b1221747e57e38521f6ef7b15cf84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682334856, "uuid": "9ba9bdc2-d35d-4159-b1a3-dbdfb998e493", "comment": "Malware payload (RedLineStealer)", "value": "ee7735c33910f9d57a1257f75ee5b00225021cbced8210dcd2deea1cf62b08d87f45b1d87634993680877e85914caf57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682334856, "uuid": "cde9fedb-b9f6-41dd-908f-2a6467388501", "value": "T1D5F41253A2E88437CDB0537005FE13831675BC62AF79D7EB26559A590CF22C4AA3237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682334856, "uuid": "ec511c11-0b1e-4954-8f0a-fcf5684535bf", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682334856, "uuid": "f2014dc6-c4ad-494d-82c0-6303de1eea90", "value": "12288:Ny90EyuJvz5i/WT0wFDOxtpdt/ChJM7XpMWTtxdJ+AWd6V69g9SzFmD6l6:NyfyuJti/XEo9tsMX2WTf/+NCl+mD60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682334856, "uuid": "724a3e20-76f6-4b85-aa48-a0bec163f053", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682334856, "uuid": "bce3c8db-a7d6-4137-903b-56fbb46971ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682334856, "uuid": "0218892b-903b-424d-9344-3d77c0b94f3c", "value": "2f09ed2bcf62c7720c18d8eb7daa73ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09982b1-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682323142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323142, "uuid": "ca028a18-e640-4173-9c9c-ef88b951b52d", "comment": "Malware payload (Formbook)", "value": "30908c1aa186a81170d42a86cf4ccd82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323142, "uuid": "8a5f52da-f3e1-4348-bcb3-92332dde3c84", "comment": "Malware payload (Formbook)", "value": "90752598d9a879991b5371a2dbb59ae7b62caa83f443b088d45da7f2af960969", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323142, "uuid": "bcd3b0f5-094f-4765-86bd-a0f1fc15f648", "comment": "Malware payload (Formbook)", "value": "9a6c7027f63513b72906bfa463bd3415d71de23a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323142, "uuid": "8972ed2f-a36c-4bfc-bc1d-aec24059c65e", "comment": "Malware payload (Formbook)", "value": "00f5b2d6d63b9ca6a096996af88fc3b880f757ebd431fc27a9b4146782bc88bc96779f30972c78d7fabc677b88d41990", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323142, "uuid": "625bc380-f72f-4c1e-b1fc-be9b70c5f6d0", "value": "T12904AE32DA42C431F2B252B5B2BD1B7B883D0E353295A4E9A3F115E06EA19D5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323142, "uuid": "06fff89e-00b5-4691-88c7-c011c74498d1", "value": "3072:MGcUkxSHP3Er83AYT8NGSYW67OycEpITU+ucNRPvCwlUKw:MysyAq6x6KycuUucNRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323142, "uuid": "f2394df1-6561-44de-92de-b8bbda7922cd", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323142, "uuid": "a710a862-3c48-403c-9c3f-fb132f75cf3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323142, "uuid": "91164f76-b5d9-4d6e-8f6c-6b3577cd20cd", "value": "90752598d9a879991b5371a2dbb59ae7b62caa83f443b088d45da7f2af960969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd5278b-e26a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682318465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318465, "uuid": "53c4f117-dd7a-4247-a5de-4c7ce6fc4c24", "comment": "Malware payload (Formbook)", "value": "9d09b6e9bf068e83c78afe33f9857c7b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318465, "uuid": "00f1d9e6-def7-4817-9f19-39cad9df9274", "comment": "Malware payload (Formbook)", "value": "90c7a131f11a2e5450a63faac63226a405fe42398f13db2e1b352a3eeba4ad2b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318465, "uuid": "50cf5ff2-727c-402c-a59c-abbbcc4f509c", "comment": "Malware payload (Formbook)", "value": "ad5661ad76c507cc12a402149734ea0648bfcca2", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318465, "uuid": "5ac2cdc4-7152-4338-9d6e-6015eade40ed", "comment": "Malware payload (Formbook)", "value": "09d2e080d445cec7c7db5918cacf4dc142be09a90187be698635266ef1d36f03f26061030e90aedecab2a0054b8fba1b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318465, "uuid": "b55a89e1-2b10-4eb7-89d8-527d8806264a", "value": "T177D2065DE74B02A48F065377A31B5E4942BDB66EF30561B230AC937433EAC3D81666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318465, "uuid": "d8126446-adbb-4c7c-afdf-186a59c5319f", "value": "768:awAbZSMn/Ujehmm30m6OgP8EjzVOOio5F:awAlDiwlxnDEjzriA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682318465, "uuid": "9d79ac5c-cc05-4413-abf0-1a26a7a4b79d", "value": 29391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682318465, "uuid": "7f04fc81-0312-4fa4-b618-075e62f81374", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318465, "uuid": "65d2c91e-d02b-43c6-b8b0-a3382db79c48", "value": "RFQXPO74635.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f72e36-e284-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682329520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329520, "uuid": "f915eac3-6a95-4aaf-a106-f00222262a89", "comment": "Malware payload (Mirai)", "value": "de6525244404feac579a1b160110b870", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329520, "uuid": "bedbfe8c-fa7b-4224-a04d-72f1db3808fa", "comment": "Malware payload (Mirai)", "value": "91553e1054b9c7188d3998093e6b8d5c55c6168f87410474fa1d513eb02f0ae3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329520, "uuid": "0a2224ec-a00d-4766-afb2-3baf060595a4", "comment": "Malware payload (Mirai)", "value": "8efd84432dac1261354708d3f74f2194876c8673", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329520, "uuid": "ac170abb-5329-46e2-9a30-98a2d18fb915", "comment": "Malware payload (Mirai)", "value": "cfbd830b8c8c5a829cf362cdcbcb793c1012c4106ff18decc39192de5a92e4cb7e1abb8314b8fe639932eb369faca328", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329520, "uuid": "896e1558-486b-4a1d-b906-731828f70d01", "value": "T1C3E34B46FA818E13C4D527BABA9F42493323A764D3DB33068D185FB43F86B9E0E63515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329520, "uuid": "1741b131-86d5-4946-a424-7313103feaa5", "value": "3072:YrlgYj2ZDVzW9NdgyguJbMdvO5s70Uh+Lb62EEM/9eqhT:YrlPj2Zhi3CJuJbMdvO5S0rLb623M/9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682329520, "uuid": "84be08e9-5659-4c47-9650-d28b9cb4e16b", "value": 148951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682329520, "uuid": "5c6b5c6e-2c37-4e5a-95a8-dc5dffab538f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329520, "uuid": "56acaa0c-3fac-48dd-923c-c89b5857eb0c", "value": "de6525244404feac579a1b160110b870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72568773-e2ca-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682359464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682359464, "uuid": "07479bb3-b86c-4c32-89c1-be0220b8ab81", "comment": "Malware payload", "value": "ef4167fa576c497ae8d67f21426cc907", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682359464, "uuid": "69b71c42-2cac-4dac-9e34-e26440d19bb5", "comment": "Malware payload", "value": "921b4f6811d98c61b29a90639c2cf9dde8194bbf0c4ffac7eab55a2fc598bdcd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682359464, "uuid": "64674187-6c45-491b-b612-31d7715e479c", "comment": "Malware payload", "value": "8c2fcf767b315632616717cbce801bccb3958f7b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682359464, "uuid": "e2751986-4bae-44d4-a574-59913985e3bb", "comment": "Malware payload", "value": "61ff38ff61cc600ad3ce4a1d72a022bee34a52be0bc5118d6b47d780905325be2f3518e9473d424c14407c2bd27c04a3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682359464, "uuid": "1428279c-00af-4248-90f1-f9ddf05bd45c", "value": "T1B134ADBC64E785D4F54F988035FCBFA1017237F3AAC91E64132866448BE9EA92F4458F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682359464, "uuid": "08d2cb4b-4c5b-4442-ab48-42fb488ae805", "value": "6144:gk0t0ZnKWQIixAxI0M6yPQ7FuiIpUCLR7mzCl6Vhp315D3Ap+:gk0t0ZOxAxI0MfPQ7FuiIpUCLR7mzClw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682359464, "uuid": "7bd4c20e-12f0-423b-bed6-6ea235866a37", "value": 231996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682359464, "uuid": "b0b52d1b-a1cf-4ef3-b6b4-dcb6d3982653", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682359464, "uuid": "63d00d57-65f4-45d0-8e69-ae01ecd72cb9", "value": "n.PNG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62511d21-e2b9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682352136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352136, "uuid": "410c09d5-7028-4cb1-810b-e2eaac9c4abc", "comment": "Malware payload (Formbook)", "value": "fe889bf209a5e139d07c128c6d0ba877", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352136, "uuid": "2b6894b8-c9c4-4834-aa23-a1af01c5a914", "comment": "Malware payload (Formbook)", "value": "9242b1d497cf232d201183851b93b19046929e39e5e512b87ea42f616d0784a4", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352136, "uuid": "e6b4ff01-4f97-4fcb-a943-ab691fd93109", "comment": "Malware payload (Formbook)", "value": "0946646c6c1e28d9c5e48636be2c9be24866ba41", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352136, "uuid": "d5a7fa67-4651-4d42-adc3-07a31b6b27e4", "comment": "Malware payload (Formbook)", "value": "bb6219909e2eec9280c075a17a02bc11c412db08a9e96ac4d9ae74db5ba43295082f0f70317ae23136d5a76a37c7c903", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352136, "uuid": "46b50b84-dd2a-4ad0-8684-f7d074a763f9", "value": "T199A4D57C6467B503CA98973D202A897306E6EF4C79B3C70D3BE1B4699FB36805AB4315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352136, "uuid": "85e130d6-9396-47cd-8877-bde4e0f124ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352136, "uuid": "661e71fe-9197-4713-babf-d5f8370e1de7", "value": "1536:2qDlPCJE7I2SCQv4M/2O1DV9SA9Nayp6kZJ4PnXnaQQvMMMMMM1MMMMMIG:1S39iuYXn1Q7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682352136, "uuid": "24864177-dd0e-4c7a-b941-93c96ea2e920", "value": 463360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682352136, "uuid": "fa737a5b-d465-4f8e-b759-2838aa5ac7fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352136, "uuid": "a4f76396-2626-4290-be74-cb473aef2cc9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8c6f5b-e234-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682295196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295196, "uuid": "1cff8360-7a93-43d1-8bce-46a65a299528", "comment": "Malware payload (RedLineStealer)", "value": "af030c171c81ef7cac612bfe24c9267b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295196, "uuid": "bf7e7cff-ea6c-47ea-909a-1fc879fddc57", "comment": "Malware payload (RedLineStealer)", "value": "924aea018048b51857f00fc7f5093239261f5ed4721328af9b2ffe08c36f679d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295196, "uuid": "39bef24e-5370-4d80-a006-0b1190d045e3", "comment": "Malware payload (RedLineStealer)", "value": "7b685524b47db72fc9cb5278dae34aed9c05eedb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295196, "uuid": "fcbc47ef-8a07-4466-b67d-7a0f2893b100", "comment": "Malware payload (RedLineStealer)", "value": "c49e7e0ba852afdbd04cdb5029e993311786fc29730d648d585c0610e64d8e0faa97e9f16729f787798d712569fb97ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295196, "uuid": "ccb91b14-ce15-49b0-92a1-ab603935d1e7", "value": "T17A152242EAED8132ECB503B008FF22C31B397C51697183A77B555A4A8CB35D4E6763A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295196, "uuid": "9c5801bb-9865-4c06-8c2a-afce6ff615d8", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295196, "uuid": "94ebea20-2e90-443c-9677-78896a61bd66", "value": "24576:byqnJoAVpID255CVTR7ZIIhLT5FxtE4C:Oq2A5SdIIhzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682295196, "uuid": "8816b4dc-5bd3-435c-802d-d80c5e4f3b6a", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682295196, "uuid": "18977dfb-9583-487d-9876-2e9080b710f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295196, "uuid": "76da63a1-07ec-459f-a4cf-b5126e09378d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652dcb6b-e236-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1682295877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295877, "uuid": "6ead76f4-0bbd-4287-9861-eafba75727c0", "comment": "Malware payload (Stop)", "value": "f57e7fccf0bcd56b6497a67654a00b6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295877, "uuid": "d54e400a-013b-4c5a-8fd7-6944361e7f47", "comment": "Malware payload (Stop)", "value": "92f300949b64286a0bd75f516473705cbadf67ddcae87c9b27f025f657a8442c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295877, "uuid": "f928579b-acb9-4e22-bd6b-52935afb7958", "comment": "Malware payload (Stop)", "value": "3fa7b4b8ee11c0cd9dbad6f20581315d68b57a9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295877, "uuid": "fbaaf67f-d93f-4a79-a48d-1bd9c16c7c76", "comment": "Malware payload (Stop)", "value": "8812aae158db76d61df9adc621831a68f88a7727bd0565878b91302968802e32db61a4d861153e5184e33f0ae021d0f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295877, "uuid": "6a32765b-1892-41ba-8c85-1fad142153a4", "value": "T1ECF41210BAD1C873D20F44355C64D6B85DABFC61E7818ADB3B692FAB2D702D08F39256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295877, "uuid": "36ee8be5-dfa6-45bf-9292-c1f7b941872c", "value": "642f639d014c52fc4358f30dfb7c046f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295877, "uuid": "f74e4de4-e390-492e-a1f1-40f94d13c163", "value": "12288:Atg5af6cDh/ywouUImddiAFPSicN4xKT8QbmrddcjmQdJ1:Mg5I6qhJ14dicPS6YT8QqZc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682295877, "uuid": "9edd4526-5753-47d5-96c0-87942a8d7df1", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682295877, "uuid": "18933874-4d89-48a7-90e8-86f6d7ea95d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295877, "uuid": "10a7de36-273f-4025-ae78-968eb2fe5f43", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b9632c-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303213, "uuid": "d36c9385-3a2e-4fc5-93cf-c60b30b9b242", "comment": "Malware payload", "value": "5eef45df41e9aa5ad254bc6a6a796260", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303213, "uuid": "c871c11c-0c3a-4653-97ac-1e3fd7fb789e", "comment": "Malware payload", "value": "932fa3bd6ad572e9fa712f3f9be285d91c1b7dfeea0f2a62fe6a573a73c03e49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303213, "uuid": "7731ba2d-8056-48be-9a5f-d15140748454", "comment": "Malware payload", "value": "b54739a599977c6c16325d5d04d5dc4d76911c11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303213, "uuid": "ab0d379a-8340-4053-bfe4-4be510ae5350", "comment": "Malware payload", "value": "b83b7f813a9c7632af6569fcdaca792b9dc6ea9f11aa47e5ea217f23888200432d13e50a1571c0459f5c79fea9360893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303213, "uuid": "2e410023-260c-4b90-a3d8-0a3bf195ec5a", "value": "T13DF312C7CC478CE2E1C8717C08AF2715567BE4B926768F878600ADBD7C26216EF256B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303213, "uuid": "26f0c383-fe14-485f-87c2-ffb96bf6fab1", "value": "feb54e6746c98ae442a64a798410da35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303213, "uuid": "0d31087b-8eee-4fca-b15b-86160ccce375", "value": "3072:zeND50XT05/NkMx0ILG0y8EyVzLom8hHtSZQ/j1:zeBqXT0xOILG0y8hihHtQQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303213, "uuid": "8d6bd68e-987c-4092-9412-3eae55fd8793", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303213, "uuid": "7a59bc37-0fe5-473b-aea2-9342526dd88f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303213, "uuid": "a91e6c62-2baa-4176-bf1d-822bc55ce5f8", "value": "SecuriteInfo.com.Trojan.Wacatac.5302.32661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b788c9f8-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333381, "uuid": "af3fb7eb-4059-4d07-8315-7fc5956e732a", "comment": "Malware payload (Mirai)", "value": "b99177545d94d4fb5ca7f0252ef3ed75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333381, "uuid": "bed9b701-c56d-4352-8974-9523c34bfa63", "comment": "Malware payload (Mirai)", "value": "950815528ccc41f25a822459b3952ff00075dd7508a3e4a75112d9a1d7ec497b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333381, "uuid": "255b8b30-2a43-45a1-af3d-b3eb8ffbdc0f", "comment": "Malware payload (Mirai)", "value": "508cc72c15453978364bd5b53beaa886dcfb4d7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333381, "uuid": "1f1e5d30-7c58-426e-b04b-a51ff5a77e9d", "comment": "Malware payload (Mirai)", "value": "0943c080b50a649fcc6b8684e4019e67790aa73c414d3bfddf1fd918e1eba07fdfe65195451a4e4fca6774c3820421ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333381, "uuid": "762f5b7b-640b-4497-bb04-0ac89d87a429", "value": "T1FF438C37E96E1E74C08641B074748EB56F23B5C883972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333381, "uuid": "a437a990-04d1-45af-abb4-76bbd5662ee9", "value": "1536:1aa0brW/Od9hlCRfK5pKoXA6Ep/DCMt2+WW:1v0brWGd9XB5Qoyp/DE+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333381, "uuid": "16c66a1a-a79b-4acc-8560-f6beb5e97e52", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333381, "uuid": "af9ce0e0-487d-4ae1-b1e5-79404cb0ab25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333381, "uuid": "dd9f4c6b-eee1-4803-b300-0ca2c9622807", "value": "b99177545d94d4fb5ca7f0252ef3ed75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cbe82d8-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303218, "uuid": "d057c0e4-d7ad-4049-bb50-1e7ff09b0e86", "comment": "Malware payload", "value": "5158be330352d1fc53cd07e0d0c1bd2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303218, "uuid": "f1267933-4625-42e0-9478-2152e64cdf0d", "comment": "Malware payload", "value": "958e49117b3bbfa7e809ea7aa01705515fd461e3f48d4a08d3e8d05c63010d83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303218, "uuid": "b1b5d744-bc36-49a7-af4b-b12d0b92a218", "comment": "Malware payload", "value": "dcb4590fc48fab95275ef211efaee4eb97e868a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303218, "uuid": "2dd1d859-41f5-449c-b08f-88d9a778c68a", "comment": "Malware payload", "value": "d4c59dc8f33f539dfa459bbe22b8c2f13445e550ee76e995fb9ab82d32eb38a1dc2b6be086b0d4355c8b8998b6632d37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303218, "uuid": "451d8ae8-d0a7-4de8-8280-bebce25f4979", "value": "T121B42813A280853BD45106BC78A7D310542E6AE139F17C06AEF62F4F6E77E89187D6F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303218, "uuid": "9ba5b125-252c-4e8a-82fe-0c87f4f428d9", "value": "b3b9693bad807132294dcb2fa9d053ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303218, "uuid": "48d2e7ea-08c0-4b8a-9446-c2f56bd6adae", "value": "12288:EXvlMA9B8DI5DzFTT3hmXg4BWNpycMibGUnJi:+vuVc5DpTTRRMWNcOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303218, "uuid": "a630d226-a6b8-4d72-92fd-29804cc4f99b", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303218, "uuid": "1c2f86ec-e7b1-46e3-bb29-dcfa269ba9c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303218, "uuid": "09ff37e7-8624-4395-a40d-080c97833481", "value": "SecuriteInfo.com.Trojan.TR.Crypt.CFI.Gen.2820.1206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c09d3b4-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333335, "uuid": "b27efc3e-0bcb-4f42-8245-05d74521d4e4", "comment": "Malware payload (Mirai)", "value": "573d65458c2a2f27971da22815fc2800", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333335, "uuid": "d762f71b-dad8-4221-9346-0cb65e74288c", "comment": "Malware payload (Mirai)", "value": "9650b7b58b1338ce159a91dc21bc31d79ceca190b07adddbc5795ac8b9cb6209", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333335, "uuid": "a396adcd-7ddf-4b99-9850-2050b6e11cb6", "comment": "Malware payload (Mirai)", "value": "7645e13a02b10e0505806d37f11e7ba9b842c549", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333335, "uuid": "5c8b8495-cd34-4da6-bb92-3c954eeb9fd6", "comment": "Malware payload (Mirai)", "value": "5f5bb0412b4dcea256fa31488720ab3963c1e91d67dcbbffed3f1034297cb8d918ea22efd7ccbb80e1c09f8e063ff53c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333335, "uuid": "1286c26d-e7ee-4eb6-b74f-dbfaad1c33ad", "value": "T1FE534B02B31C0E07D1A31AB0253F5BD197BBEAD022E4F684751F979A96B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333335, "uuid": "74c34f18-3c1a-4850-845e-b1e3e58e11dc", "value": "768:qkaZjEoakZNRGHRnDmX7Xm+t/UGx8+BCpEMnU/p9WirYvq1xcNor6FV+tMiwW9IS:MvolWm+pFBgdAWiUC1xcNae++bW9PF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333335, "uuid": "1ef13919-8299-4c72-92ee-42a51063b778", "value": 62988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333335, "uuid": "50bb8f47-8424-4b79-9b7c-995edece7aee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333335, "uuid": "5a50a715-7514-4d60-8b9f-a97f8e01ec4a", "value": "573d65458c2a2f27971da22815fc2800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624fe32a-e27d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (VectorStealer)", "timestamp": 1682326366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682326366, "uuid": "7a984f0a-4934-42b1-8f6f-2e43eea80e8c", "comment": "Malware payload (VectorStealer)", "value": "764a966e81e54e7298a4dd3a16be64a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682326366, "uuid": "6d4a9359-f71c-47be-a331-8b68852ef8d7", "comment": "Malware payload (VectorStealer)", "value": "96b9a8955e44c6e6adcab1509acb666d5915f20b9bc00a420046c31a1516f34c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682326366, "uuid": "6c375851-1b0f-4997-8ae7-5aa16b9d23af", "comment": "Malware payload (VectorStealer)", "value": "901c5fff8bc0a73d196665bdc166932f0e23557e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682326366, "uuid": "faba0b3c-a7d1-488b-9fcc-1bac8b49c3d8", "comment": "Malware payload (VectorStealer)", "value": "11283a2774f9116ad335f80651b54068559cd1d39b5f4d686b165cba1c00ef3668312909ad184a20035d46b0d78e2ab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682326366, "uuid": "19ef32ba-583e-4d87-8271-9a264f94c3ab", "value": "T1F055235531518E2BE88F1B30ED3E35FB6AB912E498F546DFE70B458838692021E4FBC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682326366, "uuid": "0d555304-6c6b-4775-baa0-7ac3b8ba8be4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682326366, "uuid": "92538c05-ca6a-4586-939e-b29d08cb2363", "value": "24576:ZYDu24u2fFhU+zLcnt1cl2coDTfNbLSpz2ts5qKIA4xG/zvZL3CMpAx5nE2:miu2s+6ccbJbsz2ts5eAMG7vxyh5E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682326366, "uuid": "907f5903-5fcf-46d5-b550-dcd6d1c9ca3f", "value": 1333787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682326366, "uuid": "2884b2a7-5a30-4f9a-b8b9-8cf29dfa4560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682326366, "uuid": "f5872eb0-4c5e-49d6-baec-28f54ac4b971", "value": "PURCHASE ORDER.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aceacff2-e284-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682329498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329498, "uuid": "adb3676c-7a32-44e9-a529-67eed9595369", "comment": "Malware payload (Mirai)", "value": "b56f557bdb999d07bce45327f120a3f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329498, "uuid": "8f12e6dd-4087-4425-9f4f-dfb15f250cfb", "comment": "Malware payload (Mirai)", "value": "975a2c88e671e48c576ed9a91fcb7185f7c612856223c3ddd4e06f716e5d4ee5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329498, "uuid": "c6c3440f-8b66-4e1a-8ec8-b371fec7da00", "comment": "Malware payload (Mirai)", "value": "44980db169149f3f154002594836f6e498c87ec0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329498, "uuid": "3dd82e6b-18a9-432a-857c-04c4b6d60bf5", "comment": "Malware payload (Mirai)", "value": "99bd4fbf33fe0135cefb0cac00d14968662832ff936c1f0032d3836d54444106ee2ab42bf0775a049eec0e31b92492e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329498, "uuid": "9f5c82a1-4031-4ea0-a07a-a5f626cc7210", "value": "T172C39E97BA4B20A0D86346F807C74F9D2E6731119F2B99E7AC0D663B9D7D1CB0906361", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329498, "uuid": "398de408-09a1-4932-b7f1-09cdeb0e1fe3", "value": "1536:sgJ79Chd4CwrAcxY8XQgIIDrDSP4SHS8DMJWQ6+rvOQgTk55p33D/LWO:sgJ7AQd3DggjDfMFdDG6+rvOQg4Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682329498, "uuid": "53106609-93c6-492b-9803-70ae11d30c39", "value": 124180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682329498, "uuid": "16214e29-0b25-4986-bc12-f832f70a987f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329498, "uuid": "123bec4c-67bd-4946-9a72-6b965e305ecb", "value": "b56f557bdb999d07bce45327f120a3f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72401a89-e2d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682362900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682362900, "uuid": "e1b642b9-b4e4-4d37-b2e8-cdefdb911587", "comment": "Malware payload (AgentTesla)", "value": "1427ee2624b95ea878eab35aca6372a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682362900, "uuid": "315bc0cf-86aa-4131-9f03-73fd89186d55", "comment": "Malware payload (AgentTesla)", "value": "975a4edb455e49e0769581323d9c025ba11655cc6d03b35da91029705e2a0618", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682362900, "uuid": "237190e6-f0a9-4cea-ab7c-8b7f5638abb8", "comment": "Malware payload (AgentTesla)", "value": "8e8e6ec792a8f39b0a2c4cfa29c5947a57d106aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682362900, "uuid": "0d4696a0-1166-49f3-97d4-37f8faebb59e", "comment": "Malware payload (AgentTesla)", "value": "e419b50c3e8c142fe725d6c4658ccd70949b7934b49cf04802384f8f7941f3a64a494809e3efc8c783904209ffceb16b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682362900, "uuid": "05223273-a643-41a8-bca5-9b73a44ec873", "value": "T13734716326FD62F3E1A91B781453065A0F20BF76B933DA4E6AB479F06B31F800523D59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682362900, "uuid": "67f022d9-e881-4bac-899c-1997dd70dcb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682362900, "uuid": "0d5db775-dabb-4f20-a446-017b2c0c697e", "value": "1536:Yf7pu/Y1IxaVWtfUlGq0HXoWPAHjhSxkxLokLwnQkttBeWWWD9v:Y1uw1IWcq0H4W4DhSx8zLwn5tt3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682362900, "uuid": "76371aa2-1182-4f28-946e-7474906cc415", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682362900, "uuid": "6ecb789e-1540-490c-98f0-4b8bf022bf0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682362900, "uuid": "59e492ab-03a0-4112-81a7-c7206d250119", "value": "ALPI TRADING_PRODUCTS LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb21bfc3-e2d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682363452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363452, "uuid": "d5a4fcaf-82d2-4a3e-b416-bf2ed33a3d23", "comment": "Malware payload (Amadey)", "value": "114e620045e15ec110a480c8bdeeb5b7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363452, "uuid": "1b7e2f3d-05e2-4c20-af90-329b70a52304", "comment": "Malware payload (Amadey)", "value": "97dd067fa20888ce925330e4b823023d41904287c450a6f8a9aa53b8a4f4a441", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363452, "uuid": "1988fbde-d172-4433-8681-d67ebd0ec212", "comment": "Malware payload (Amadey)", "value": "a0ef708090737048bdb9dd2b7df1a9909342b377", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363452, "uuid": "901e3aaf-5edb-4a85-83e3-ae56823a82af", "comment": "Malware payload (Amadey)", "value": "5780a3665eb0fd134b296d473719b797852a3c469eaf8b3a2d152622e6e4b8081f9f51231a91f57004c095034246af47", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682363452, "uuid": "0f4ea050-739f-4811-9919-634b5385ab15", "value": "T1F155019351E03837E6678B328E2EC6B42B1EB1534F1666DF27589A3F1A701F1C632785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682363452, "uuid": "b61c1a95-b22b-4975-92df-df80e994f785", "value": "7b4896352eacf26f78ef6e8da79677ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682363452, "uuid": "a3d12a72-c30d-42ed-b7e9-54c667de2d1f", "value": "24576:Vj3DX6L44JAoqyf2Bh1F/tSs8mL2U7wucjiw017bw1xq9poyMmem:Vj76L+oqyf2Bl/ksdr754iw017bmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682363452, "uuid": "4f447cd7-37ea-40a2-a866-0b391f28e39b", "value": 1291776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682363452, "uuid": "9ee3beaf-965e-43ec-b542-a05ad55a5d49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682363452, "uuid": "58ad264c-5d83-4b35-921b-34923729ef0d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3cdff3-e2ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1682346816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346816, "uuid": "cae9854e-0323-4b38-bfc9-794527c1f048", "comment": "Malware payload (Fabookie)", "value": "b1a9b9c119b15ff10463fb24ce083d00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346816, "uuid": "975bcd82-c693-430f-a935-652a662637b2", "comment": "Malware payload (Fabookie)", "value": "97f12b24e5ae9141902e74706e7b1715a40e172bfd1eafab7271fb584b3b9796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346816, "uuid": "86c26ead-aaa8-457b-a464-8641fad2a00a", "comment": "Malware payload (Fabookie)", "value": "26d393625e7f649717b6e6593bdf37a3a2aecae0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346816, "uuid": "fbd24084-93cf-4e58-8848-df00364538e8", "comment": "Malware payload (Fabookie)", "value": "2f98bb962ffd5ac00e26d59751daab56854321a8a1e20ed359db3d97cf4e2a5ef5bd13afac3e22c683085511fb81090c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346816, "uuid": "225e10e7-77f7-47b1-b228-e92e53e1c8a9", "value": "T142F49E01B6A499B5D079C235CD53CBB69A703C605F108ADB7364FB1E2E333E2953AB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346816, "uuid": "c7ec9a84-132b-46ea-a92c-fb4e7af1a49b", "value": "54a4a8876d1423c6fa95d6828708dd32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346816, "uuid": "37827c9d-b8d2-4428-b325-83b2f48c82fc", "value": "12288:CwtKLXYdOWi1IqB+leXEZCcD8pellpco/zENOeQiV1u:X+CW+lFrApeCoAYeXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346816, "uuid": "58f37c82-1313-4c6f-a6d9-05cf39d98acd", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346816, "uuid": "c8bdd0b3-554f-4982-9650-df86043336d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346816, "uuid": "ecd82aa4-ce70-45a3-a147-c24350414648", "value": "b1a9b9c119b15ff10463fb24ce083d00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836bceab-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303229, "uuid": "83689900-97ce-4bf0-937a-3b373077f4cc", "comment": "Malware payload", "value": "85638ca645a0eb2c7a72207fe216c3fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303229, "uuid": "a4f8c046-d2c8-4de3-b589-f182b7721bbb", "comment": "Malware payload", "value": "983c70a915beeb1339cfd992a7c893039e84bfd77ceb5f18b75171bde4207981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303229, "uuid": "9cec8513-a4f8-4d88-b171-a3c344dbddca", "comment": "Malware payload", "value": "e3c539bab1287598aef9918651afdd729800154e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303229, "uuid": "efedffad-5bd4-4c87-b878-ab6f9cac9aff", "comment": "Malware payload", "value": "222a2f4efd50e534952efaae957c33696b876dd475a06b5002f58b5718d1a1a0ce98efb8f3a2cf9e72db88addee7155c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303229, "uuid": "130aaccb-c3db-4206-b57c-15b3a152c716", "value": "T1E7929E82C6348CC0F1B8213610AACD2451E6E593565D6B473ACFBA7EAF32563953BB30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303229, "uuid": "b055fcae-c83d-4641-9369-fbf11d9c48ea", "value": "74e601509126088c48b47d1b43a6e894", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303229, "uuid": "9896d293-6e5d-4a06-802c-72d899652346", "value": "384:mpMMKDlzd4SQtPUbDgc5IbxiHzeg9daSeVGm:medDlJ4Nt8Xgc5Wxc9dOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303229, "uuid": "3edb6eb6-45f3-4226-ba5b-2116bb8f061c", "value": 20052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303229, "uuid": "db11d5b8-0b11-49f9-9bd5-3be783d829e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303229, "uuid": "5bb421d4-128a-446d-83ec-11b657ad5e89", "value": "SecuriteInfo.com.W32.Malware_fam.NB.6129.23310", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd49d39c-e272-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682321794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321794, "uuid": "2ef20e8e-c34a-40bc-b53a-1ffe28354793", "comment": "Malware payload (Loki)", "value": "1fdedcf2052d643532ea9345fffe565f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321794, "uuid": "4f19228f-8796-4ff5-a118-7f65834420f3", "comment": "Malware payload (Loki)", "value": "99785489b3e1cee3004a5f4fd2421ddfa773bfd1d023cbbd2f307f2846bbb318", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321794, "uuid": "74922509-6cff-4efe-89eb-b8e2acfea56a", "comment": "Malware payload (Loki)", "value": "4bdf6e42925bc7640bcb9f1acbfe6d07e4ab6f64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321794, "uuid": "d22258db-76db-4ff0-a24f-6156bf2c79f3", "comment": "Malware payload (Loki)", "value": "51f9ac7602aff19b5a8b3deaccf44bb0a428e2778c8498d627c910a1ffe0cecac44d4f054ef22f4a0b9781efe2db993a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321794, "uuid": "142bef8c-77de-4dc5-889e-8a19c7a26958", "value": "T1AE14129465B4C46BF9531F32993EA9752EF6E5801124934F33006B5EFE316A3E41FBA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321794, "uuid": "f27ba933-3e2a-4ab7-828b-f1ed47710c16", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321794, "uuid": "d701fae6-de59-42fd-b72a-301ab4fd126c", "value": "3072:3fY/TU9fE9PEtuV6ibRsjfIwwI/6BBfX7XALPXTiTepZF1W/v2+d6OElw3owLC48:vYa6DirIfIiBBfrycv2E6JD/43nmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682321794, "uuid": "2df26bf2-de34-45dc-ada4-fb98e56bbe14", "value": 192917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682321794, "uuid": "79cf93c7-d324-4144-9505-14cebe34f7fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321794, "uuid": "54afae8f-328f-4d6c-bf2f-f79c26012597", "value": "1fdedcf2052d643532ea9345fffe565f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4babbd3b-e250-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682307001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682307001, "uuid": "2514d15d-c149-4962-b9c2-697bb76090b4", "comment": "Malware payload (Formbook)", "value": "eb149283fb1ba797a3a178cc8c061b9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682307001, "uuid": "dc94037e-b547-4823-90f2-012c069301c4", "comment": "Malware payload (Formbook)", "value": "99fa64e87ffbc808b732ea25e49e697303eb7bda64772b7b1f25ae9b3855253b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682307001, "uuid": "a0b869d4-db62-4177-94ba-87ab797482e6", "comment": "Malware payload (Formbook)", "value": "86c26bbf8abdf3739e1acfc744db681eb5af75aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682307001, "uuid": "9b618088-c9a4-4a42-8e2e-4cecd2884939", "comment": "Malware payload (Formbook)", "value": "ca868ad964364afb00886502bd4ae2ec7cb78badc1846c6f1d0acbc57a0cfcf82927b9ec0376d57ea96729dfa03074d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682307001, "uuid": "71bafd90-a653-4c1e-965d-ea82e3852454", "value": "T15CF4E11B4BC5BAA8E93D813281751E98A3F4CEDB2112D7873E9572F04E536CA5F4B2C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682307001, "uuid": "065696d6-4be8-4b14-87f9-bdd6912b97a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682307001, "uuid": "e8f40cda-956d-4c3d-8bec-e9a3a41e7a9d", "value": "12288:wWQ7PCFKYTzAGTrNXTOHqPW3f0CEtcxf6q3do1KF/R+pJsix/N2Mvacg7S:47EKcrNyz3I2xF/us+12MvaTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682307001, "uuid": "9de1101c-1823-4ba7-b39f-3d950920e151", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682307001, "uuid": "d9cf6216-bba8-42c0-a3e8-c878e66917e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682307001, "uuid": "ff610f94-96e1-4171-aa19-929a73b98c90", "value": "eb149283fb1ba797a3a178cc8c061b9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cf5ed9-e2b9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682352122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352122, "uuid": "47946703-54fa-43ed-803d-dc77781270a9", "comment": "Malware payload", "value": "5d1b8f78455d67d6aeb38b47d3108fad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352122, "uuid": "ed7f5b9c-d509-4189-af2a-f0c865f43ad4", "comment": "Malware payload", "value": "9a589e293829946f277e5a18dadd2e2741d93b91fcbddec2d246e6baea098bd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352122, "uuid": "147b9b63-d62f-47f3-9dab-fc3b368ea1d0", "comment": "Malware payload", "value": "c5e495487f74503275c55d1eadc080dd4c41cd37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352122, "uuid": "a5b6613d-6aa3-40b2-9bf2-4d008a3ef16a", "comment": "Malware payload", "value": "ed11c432c0ed3db3845220685795595daf5a52ff1a134ce8a4e34862ef61a389d36d6c5213291c97040b625940767dd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352122, "uuid": "a11ac0f7-a8e2-4b5a-9926-a42b34147c91", "value": "T116369D522698F5A8FBC594793F27C57911EE38F8B407C4427AA80B8307E4EBD5B41B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352122, "uuid": "026a7b33-8cd6-46a9-becd-7744c9e1f59f", "value": "d3e4af6b03643b4a3203719f0e935530", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352122, "uuid": "e5c55149-55da-4089-9cc3-c70f29c2354b", "value": "49152:zLLJca/BsHhk3JrOxXg2N4r1jWfwluDK+l6gkk0inIdcUpGbFFgarhI7K:zL9d5s6AxX7kRWs3kbUvkFXhiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682352122, "uuid": "86b6025d-d9b3-454b-9003-279bf6df09de", "value": 4944600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682352122, "uuid": "4ac8e94a-092e-4194-8647-090814fd71c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352122, "uuid": "df536b41-15fe-49d4-8729-1703bcc320a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26ffb9d-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682323172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323172, "uuid": "687f0ace-c716-41b8-99b9-e1352b807838", "comment": "Malware payload (AgentTesla)", "value": "696332a0fb3710e06e6ce3d56385c3f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323172, "uuid": "6a87a9f0-1b30-4cde-9f28-8993a55fb56f", "comment": "Malware payload (AgentTesla)", "value": "9bb03b942853ff9b4f4cc4b63f096df9bec4dcad0b4a4f8aa105e512e4e50265", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323172, "uuid": "05232315-38e5-408f-b97e-72508945c907", "comment": "Malware payload (AgentTesla)", "value": "714222773d252fb42e519b105b710ac22e5e3b58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323172, "uuid": "4f3b370a-5f49-4f79-b296-d01786c71196", "comment": "Malware payload (AgentTesla)", "value": "96b981945c18728c85b5fd442e1c3ada20f59e967cd4e7bd36690f0b0ec3ee3df662f04e0676f075a85c6fdd369d368e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323172, "uuid": "639ca359-ff65-45e8-b035-fa00afac557d", "value": "T15C94CEC5D9C08590EC292F3920372E2592A77E7ABDF8654D9A4CB5703BB31D35037A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323172, "uuid": "d75bcf3e-856a-4b12-af3a-5935a4f7ba81", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323172, "uuid": "7ff28c7a-b670-473a-98f6-1570ce15de80", "value": "6144:QYa6jxBN79/0hyOjM3iNXIm/hzCBmYOAyWORIKq/VQ1mOjGPt:QY3BNx/0h8sBVAgRI0maGPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323172, "uuid": "6061985e-25ad-4544-9a89-11fc3449b8a2", "value": 413701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323172, "uuid": "e569270b-fb5e-429e-9b5a-192be1b4fa36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323172, "uuid": "9be6e0c8-287d-4be6-92e5-fdfad2d4e19e", "value": "HUEDWE23REQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc5eb89-e284-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682329607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329607, "uuid": "b4cbd7ee-b055-4aa0-8dcb-09faac89c590", "comment": "Malware payload (Mirai)", "value": "7c66a0a85b121d53f510e6faf6c96783", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329607, "uuid": "8e535932-22be-4aa2-be9e-96d5f01bf49f", "comment": "Malware payload (Mirai)", "value": "9c69293bde4813434a38577acd2e06193f28bdb9305995e0e3e7e0058cadbbd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329607, "uuid": "4ef4a9bd-b75b-4e78-b11a-e81070deff34", "comment": "Malware payload (Mirai)", "value": "55dc5c4a63df7a76b743b6edfb774f21746c6cb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329607, "uuid": "9e127848-f2c2-48e0-a80f-a030e29fe64f", "comment": "Malware payload (Mirai)", "value": "1f78a53291a3b55863f3bdcb6ee6eb80ed8f85860487887a9f086a77ddda8de08056014f8fbf8b1a8a7bb655510e17f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329607, "uuid": "90df9765-d5ab-4d1d-9da8-6a290e42f480", "value": "T192734B9AB401CD7CF90BB6BA84560A09B92177445FA30F27A72BFDD36C331A56C17A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329607, "uuid": "04469503-5160-40fa-bf00-66ad2be808ff", "value": "1536:ZSeiwNHKdc1jDDXwp2MZn2bm8eKr35ka1d8RMtSWdYyCX6GDTbFv9:ZddDDXq2IumqJka1NXzCqGDHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682329607, "uuid": "c513ea87-7aae-4fc5-931c-5287cb90268c", "value": 76448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682329607, "uuid": "09ab89e9-8723-4be5-a9e2-6ba7bd12520c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329607, "uuid": "b09061ab-2454-4475-8e34-a99efdb17b0c", "value": "7c66a0a85b121d53f510e6faf6c96783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6106b596-e271-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682321210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321210, "uuid": "08d50c63-d919-4a43-a5a6-aa9cedaed92c", "comment": "Malware payload (Mirai)", "value": "27ff3d8446cb7bb35f9ea2be423f1c1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321210, "uuid": "6bf76985-3d37-4e4f-b923-3d25959f514d", "comment": "Malware payload (Mirai)", "value": "9d0b0de66890aa036bf8cf319dba732507d84ac8aa04e782500892ef19898dee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321210, "uuid": "28028cb3-01ec-4910-a24d-1b116d955384", "comment": "Malware payload (Mirai)", "value": "73a86a6af0f66916fd26aa42ede2b877cd348bb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321210, "uuid": "11249a20-1c10-4c0c-bc2a-ec9d822699a5", "comment": "Malware payload (Mirai)", "value": "4d0fbd81641a748a8c95f33ba6b4f3083ea118be8c4e715b0546bf24e12e4a42c54d4f037c57af1b918273b6083ec4f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321210, "uuid": "99812675-003a-4706-ade2-16f4e039b633", "value": "T115530956B8818A11C5D413BAFE2E11CE33136768E2DF72139D106F247BCA92F0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321210, "uuid": "42d84bec-03c1-4528-b84a-8974d55fead7", "value": "1536:cZngiMGcNKCB+REaIbKQnPKKWmFjikLzIoiEf1NKWC:k7ckzRYbKjLmFRf1NKWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682321210, "uuid": "4d7c3bbe-ae9d-45f6-aa63-83178ca68c44", "value": 62596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682321210, "uuid": "1db88dd2-ea58-44c2-961a-83e55a139cf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321210, "uuid": "e2686c84-f5e9-49e7-b599-634a467e8d0e", "value": "27ff3d8446cb7bb35f9ea2be423f1c1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6e295c-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303219, "uuid": "94181137-35ed-4419-9fb2-a43f72439c8b", "comment": "Malware payload", "value": "2c00c1b1a4aaab8fd11e5e0434cd6464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303219, "uuid": "972957eb-fb8d-4290-8894-ea1aabfe4239", "comment": "Malware payload", "value": "9e079d96a55bd841a7dcddecb46aea0c6d96f3dcaab58c2a5516dd5c0205da22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303219, "uuid": "a1b506d5-107e-4c72-bf32-5fb6d4d73399", "comment": "Malware payload", "value": "d6597ef0ea3c717e6ecfe44a43b571b78d896004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303219, "uuid": "5d683cca-01a2-425d-ae51-d8eea9909f94", "comment": "Malware payload", "value": "bd9255dbcea2f3d27863f4dcfcc0ab012cda19d986644d2ff839892cd2fc561531a311c4d4cec63998ae5d385149aad8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303219, "uuid": "e6d799d5-432d-41d5-ae9c-3931e163a063", "value": "T14A65D05226468C1AD2F112BC8651E3B88B185F946E31C64F78FC7CABF3B57835C29267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303219, "uuid": "ca083844-7f63-4111-aacd-fc5515b6b4d3", "value": "e0ed3d7696d98962a89733ca4b1068cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303219, "uuid": "2d74c9e1-2f76-4e6f-b56e-6425010bc161", "value": "24576:4Aba1ntCz2e2ONzT3+vz1UP/z7oZJsHInp:4Acn3uX+vKP/z7oZGWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303219, "uuid": "33194a20-9d17-402d-81cf-3db8f1ac12f5", "value": 1431083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303219, "uuid": "619e62ab-7fd2-438d-b38e-b241bb8eff86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303219, "uuid": "8d574eb6-a8a0-4c2a-88c3-436c175c1def", "value": "SecuriteInfo.com.Worm.Win32.Mydoom.26978.32046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ae7c4e-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682323146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323146, "uuid": "457d6546-0664-43c5-9074-a2e6cd4c877b", "comment": "Malware payload", "value": "f2db633681755caaccdbed9b8bffa89e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323146, "uuid": "d800e455-d908-46c1-84b2-2e843fb91f81", "comment": "Malware payload", "value": "9e57948b8683793824fe32463a683d32bd65c894492591dfdb737dbc90d149c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323146, "uuid": "ad91e4eb-e8da-4db9-b54e-89f2f3771525", "comment": "Malware payload", "value": "d6e744776457cb4fb7d7387a18de782cf08295d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323146, "uuid": "dc5ffa8a-0cb0-4547-8c09-df342c233554", "comment": "Malware payload", "value": "9d12b7ea75dd2c1ab088d0b7abe7cbebc3dce1b64c99f16f81810c4d1d23861be6728275f51ce854c3c5f8b54c4fc129", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323146, "uuid": "4d07ab26-0673-4514-b582-c294853c8aa5", "value": "T161357D01F1184079CD9383F0090AAE396A69ACEF8F57D7C3D182F2F6E435E94B565B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323146, "uuid": "fae9bd7a-c250-48b3-8a25-224f8a36de5b", "value": "12288:5qy9QsbpBW4DPFwdl7XHDDQlsvA/r8ukCNXhauuJgLQgbRtUoAmyCIh6b:5qsQsbWjgsv88uXLMg1KAi6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323146, "uuid": "08e03312-3cea-40ce-8c1c-86d2b61dfcaf", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323146, "uuid": "fb11cef8-5b8b-40a7-981c-a3acb76eb3fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323146, "uuid": "5885cdee-47b6-4b0b-9f2a-2d92fc915f70", "value": "9e57948b8683793824fe32463a683d32bd65c894492591dfdb737dbc90d149c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedc0c6d-e265-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682316187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316187, "uuid": "9d03e3d0-05c8-489a-a2c6-e288b3a087dc", "comment": "Malware payload (RedLineStealer)", "value": "a85ebbb88e7e063de9a99ddad1ef2975", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316187, "uuid": "830e7e33-679d-40a7-b922-48b99abb83e5", "comment": "Malware payload (RedLineStealer)", "value": "9f24d5e6bdc2b8ae795a3191a8d90ab225b8583643c836a07fb797371976bd08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316187, "uuid": "c4d861a6-80f5-4afe-9fcb-cf2c88fcfafa", "comment": "Malware payload (RedLineStealer)", "value": "9c0c2b7fa54f491321ba29c10aac6cd9876e4bac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316187, "uuid": "0bf50542-b149-4acc-9c7b-17007d312244", "comment": "Malware payload (RedLineStealer)", "value": "f77c29e68125763ca09f51e133b07f8f814e4889462ce13c406d3c88e32d96dd6fe0a91ea7e155a57f878e88a72e1806", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316187, "uuid": "1014ce98-190d-4616-9a63-982cdefd491e", "value": "T1B3C41216BBE88432DCF557F444FA12A31B367CB1ABB843EB26959E8C4C725C0B531366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316187, "uuid": "890d9c7d-5b53-4b7b-a526-28705edfca2d", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316187, "uuid": "af40cf45-7e9e-40b3-acd6-1ecd92895c48", "value": "12288:sy90r27vVaLxkhOMbQdLhN92p/uEf5p1bR0rEeaDjtg:syFIdkhO5dLd2p/uEfD1kvke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682316187, "uuid": "830149d5-c01d-432c-bcc9-7e4bf717e733", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682316187, "uuid": "24b734e3-0546-465f-8f64-a53bb4151749", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316187, "uuid": "66ba64a8-ce98-4f33-9803-75889eee8d77", "value": "a85ebbb88e7e063de9a99ddad1ef2975.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ae858b-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682346879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346879, "uuid": "0e2934e5-cbf2-4d48-a021-338c238b5005", "comment": "Malware payload", "value": "2b71456ba35b2965dc07f6360d903d56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346879, "uuid": "da4d3d6e-da0f-4509-970e-3ea3d6a3098a", "comment": "Malware payload", "value": "9f67c7ec719f109456df2f3a34d8388e7c4bf3a65f352e8c1d948daa3541321e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346879, "uuid": "b563d68a-e9fa-4685-9dcd-5cdea2df022d", "comment": "Malware payload", "value": "a0c5cfc0e329006060d38e4fcc9aa0b3646b0dd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346879, "uuid": "2fb1c2ed-9990-4dd2-855c-7ea12f635847", "comment": "Malware payload", "value": "ce8c90f499e31a6989cc943e764b2038b85dd29bc4038f50641b843a6c2868095f109805750a6a547612dec9904d1303", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346879, "uuid": "63e48798-9f04-4fc5-840b-7817f95b1bce", "value": "T1E4A3D717AB51CEB7C85FCE7306AA460120CEE55612E46B6FB274DA6CE74B94F08E3D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346879, "uuid": "1b657873-fbc4-456c-a59c-4965b190e4e3", "value": "1536:0GeTzI+eXiKbmTYWZMbZMPtAw7p7sXjYggp72ymOimW+zWBSirHzai:0oc/pOZM1p7Ngg52ytimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346879, "uuid": "7faee871-ca9d-430c-bc67-ca75cd43aec0", "value": 104824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346879, "uuid": "cd7520cf-7a58-40a1-a62b-32f1203446dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346879, "uuid": "985b2d4f-55f7-47da-b397-392f20fc7ad7", "value": "2b71456ba35b2965dc07f6360d903d56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb76bd0e-e2d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1682363479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363479, "uuid": "eba24e41-003a-4654-997f-68b4bd3ed126", "comment": "Malware payload (IcedID)", "value": "3ae2c1bdfb47f45a527e99c297003800", "object_relation": "md5", "Tag": [ { "name": "2141273191", "colour": "#93923D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363479, "uuid": "8045b0d4-86ca-4b05-aaa5-a979e49cff79", "comment": "Malware payload (IcedID)", "value": "a00ae529a1ce4e2eb7f988ed5adaa07e653de3fe0c01bec9452aae71b935f63c", "object_relation": "sha256", "Tag": [ { "name": "2141273191", "colour": "#93923D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363479, "uuid": "00176c0c-d74f-4af7-a50c-a0b402c20702", "comment": "Malware payload (IcedID)", "value": "22cc3eb6b532e7e3b3e33755a2ef18435c16f350", "object_relation": "sha1", "Tag": [ { "name": "2141273191", "colour": "#93923D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363479, "uuid": "37709453-1fca-410a-aabb-0301ec8c8a65", "comment": "Malware payload (IcedID)", "value": "4d60a89ee90fa8d20899f492d435e15bcf03a7f44ccfba31e692e06ab170901f1ec097f3fec9f3d2b3283a4d7a2a7751", "object_relation": "sha3-384", "Tag": [ { "name": "2141273191", "colour": "#93923D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682363479, "uuid": "52a4cfc5-f1d2-4328-9c97-a3a67fda5bd6", "value": "T12FB6337B9D43DE37D53CA6B9059A0B2C4752BA2099752021B230706079B6E23D2FEDFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682363479, "uuid": "83061f15-2619-40d1-bcc9-2963a08b963f", "value": "196608:7orB7kpX1xRw86H5zWqEmnfwEas37Mq21cUrP/W+hdkXbSKp2TS:7+7mXDwZrXfHHrJ219PuZXuKp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682363479, "uuid": "137f9ee6-9494-4027-b7a0-d83850886410", "value": 11315200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682363479, "uuid": "74cdd1e4-3d11-4ac2-b75d-560cfa993054", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682363479, "uuid": "b6f48cf4-981d-4dfd-b4eb-452cc81e8ece", "value": "AdobePDFReader.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7885b73a-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303211, "uuid": "0f39c6c3-5163-4701-b743-1aabdcf0e06c", "comment": "Malware payload", "value": "6af0c584fa0ada00c89f1f77ef67db24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303211, "uuid": "5569b4da-3802-4b51-adae-b0fa516f8360", "comment": "Malware payload", "value": "a054a2513910a629c185aa3c5d5f52d06b7bfb12711ccacbedcc757e33c2070e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303211, "uuid": "746332f3-91ff-4965-99b8-e1e6cb5090d2", "comment": "Malware payload", "value": "5548c724093a927aae75f9152ba4471f241ba9eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303211, "uuid": "0a1fa0fa-fc96-4798-9dbf-864dace5898a", "comment": "Malware payload", "value": "95a70fbaf1facb7fcc539f992422befc2c6f935cd44b609b8a38539d9d0952263edb92ca70172697e68321f77fa002b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303211, "uuid": "3760cf3f-213a-4aa7-88ee-271033b2f7f1", "value": "T19DC4F933BE9C2245F50304318D6A59A96626AC3574059E07B3C2FF5CA972B83BDB532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303211, "uuid": "9ee48b22-941d-4af5-ac7e-817c91857f74", "value": "0e84a6f48c9400a030aa6cd1145526bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303211, "uuid": "c48b292b-66f6-4363-994c-3349c7d47828", "value": "6144:qLXYsI/1KLPfSVK+mkCmGEboAlk0zbjVzmTpLtC5Hi2EuDn+5FL+Uh2Gl8NXFd0u:8YsaxCmnboAlz068uyPdhENXL9MiGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303211, "uuid": "9f94c686-fe96-44d6-983c-e461b435d768", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303211, "uuid": "daaca60d-c76d-4152-975d-9b8388f3e7fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303211, "uuid": "a57103b0-6df5-4e42-8ce0-f61b14bc2e8b", "value": "SecuriteInfo.com.FileRepMalware.13708.9633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1378a5f9-e26d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682319362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319362, "uuid": "d78d439f-028d-450e-a6ed-a0dfc5e91742", "comment": "Malware payload (Loki)", "value": "87c0283a7b6b9d3f20a2307e10c28180", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319362, "uuid": "dcf63ec8-8445-4578-9d09-c92f6f0792c5", "comment": "Malware payload (Loki)", "value": "a1a9fb795741adcd8b451723d08c26e4399ba038c4c4e7ba74a77fbfef2c37b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319362, "uuid": "f357e17e-6ded-44c0-b762-2e7073762de1", "comment": "Malware payload (Loki)", "value": "5efaeabec4dbd06312995b41081cc9fc85d52874", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319362, "uuid": "7c97f778-8b34-46cd-99ba-33c1377c5fcb", "comment": "Malware payload (Loki)", "value": "65b0df8e34508f32e6079b372659958c424af173aaa4bff4f7f89fcfd3fea84c33b2bc40eee96b89b2bdb77d17616cab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319362, "uuid": "6959cbc6-afe9-4bb3-8009-6883a8cb3409", "value": "T1F014022461B1D0EBE8E147710E7F575BAED9BC2229B0231B2B110B6D3D264C2E74F762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319362, "uuid": "3d66599a-5616-463e-8c9c-ba927e43cb96", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319362, "uuid": "81dfacfd-f4f9-4cc3-b0f0-136a89578c07", "value": "3072:HfY/TU9fE9PEtudybP/KhgJXTpVdo0N8eQJcnEDkLpoC5Q5cgZ35fbN79:/Ya6IP/eg1xf8eQKnEDDpN1Nbd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682319362, "uuid": "5eefe871-f121-4a2a-a20d-bc46769b7af0", "value": 193174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682319362, "uuid": "50e84260-114c-4442-b614-fe3b43eaebb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319362, "uuid": "990e6539-d6b7-4b51-bd82-88b787af08e0", "value": "-BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56bbf9b3-e2d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682362854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682362854, "uuid": "207d6821-3f05-4097-8910-ac0438f46772", "comment": "Malware payload", "value": "0d8c4ca04dcbd59ba33f260bc450295e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682362854, "uuid": "6ff7c3ae-f20b-419d-8326-c570e46727db", "comment": "Malware payload", "value": "a447fee5372ccb5a4efc5daf48f497d921a7dc01d3d4f24dd3c4319da9f55ae4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682362854, "uuid": "36d11400-3370-4497-a9e9-37b4992097f9", "comment": "Malware payload", "value": "e6800ec54e627c67205185859a362deb62a81922", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682362854, "uuid": "44c8690f-33cd-4694-9a84-ab1f4df73563", "comment": "Malware payload", "value": "0cf20f945c09019499195add0aa8b1d26ba72e99e9cf63d080f1704a60d313c137db4954f3004967cbffe1be4327f162", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682362854, "uuid": "ccf21b0f-1b0d-486c-90ec-d651f02ae39c", "value": "T1E8F24B487FD4831ACAFE2BF529B2651512B4D503EA13D75E18D885AA7F37BC08D013E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682362854, "uuid": "91c6c838-780b-4885-9101-230c0dde0edd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682362854, "uuid": "95b8f791-49f4-48da-863b-b21c8b7121d0", "value": "768:7rAKdijXMwX1eJGl8y0UaKt4qlYU/kZl+Bcg4tlTF592oO9h+SURn:7UjXMwX1eJGl8y0UbTuUsZcB54HF592Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682362854, "uuid": "dd8dd65a-2531-41b0-8165-932667646516", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682362854, "uuid": "8d2be21f-1921-485d-a66a-bbb38949e351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682362854, "uuid": "b8ca9b9b-18da-4d55-aaa1-5d9aea5e5527", "value": "download2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64149b9-e2fa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682380221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380221, "uuid": "8d27a8c0-1f26-49a5-b675-167c2345e34b", "comment": "Malware payload (Amadey)", "value": "82662cc2a9ce3cfe71efd4f9e8e75ac3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380221, "uuid": "03d291c6-e271-4433-9eec-8b3bccc915bc", "comment": "Malware payload (Amadey)", "value": "a4712963651b534bc6265ffee822f4019d969a6c8450454f61ee1bba614ebd66", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380221, "uuid": "4b3bbfba-3dc7-4911-ae19-43f79c97e3a9", "comment": "Malware payload (Amadey)", "value": "4438fc529706951bfefb1e5fa17a0720dc643f02", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380221, "uuid": "64551ace-35e6-43ec-85df-29c9589f3481", "comment": "Malware payload (Amadey)", "value": "af2768c3b4b0b139ce5806e5c65adecc105795958ba17049c68811cd32b79846fe25d07819326bfb686f7735375d539b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380221, "uuid": "319fed72-98d3-4f30-b698-8f251b6540f3", "value": "T15A352361ABE92173CDBA1BF064F900870B397CA15F69C3AF66479C894C736846135B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380221, "uuid": "9e86c208-c250-42e2-b3ec-b524b9b3043a", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380221, "uuid": "ec04fb42-679c-4dca-be1a-2bbee14c4aa0", "value": "24576:Fyf3ngmFzYPr87A1uYq4Kbj6zhwabSdLsby:gfLzYAE0n4KfqhVcsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682380221, "uuid": "126743c4-415b-479a-86b6-999cdb947cad", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682380221, "uuid": "81fd4124-9095-4fc2-9931-81e1be8ddeaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380221, "uuid": "1d3dc1d9-4aa7-4fa0-8305-d92607b3b6a8", "value": "82662cc2a9ce3cfe71efd4f9e8e75ac3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60951a3c-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330229, "uuid": "2e00fd5e-5a78-4c49-9454-e044719524b0", "comment": "Malware payload", "value": "9277d852a5df39e0cd5c8f04f26512c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330229, "uuid": "dd3497ef-6c0c-416d-addb-240cdccaef98", "comment": "Malware payload", "value": "a4cab01d61d8c18876d4b53d52de365fb9b512430371fd4217359159f3c507f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330229, "uuid": "9a1658a9-cb83-4195-b214-8f950e16b785", "comment": "Malware payload", "value": "df58335f70da4e5e5a8c469133d391e0ce51bd6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330229, "uuid": "10b66be6-d85d-4a45-ad8e-ec578ddc3d2b", "comment": "Malware payload", "value": "d94bf0d91de912763b2c08c336d5b706a2db6770f4daa708b1d05cbb79b78f0fa7103bb7454d173ab9d16e7f89480e1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330229, "uuid": "d87b1f6d-c184-45ff-876c-ee01cfa8ad97", "value": "T10666E0BF2860E83DC10693F761957EB2A533E91C4C9AC35C8AD6D9D76F402909E6DF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330229, "uuid": "e2cf2698-be85-4437-a0a6-5a78e3d723d9", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330229, "uuid": "d7948877-a4ed-4034-8a83-c6dae79200d3", "value": "196608:LhNFQlZVDwfUHVvkIfx0O8fJs+R0MiMt:LhN6lZ1vvfGOKRdiMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330229, "uuid": "f93ce2a6-4395-4de1-b17b-5ed6b18180b9", "value": 6665976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330229, "uuid": "844a69ab-0d95-4013-9148-9e4ae2ee5ff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330229, "uuid": "6952464a-ec5e-4795-900f-9a548c5e5726", "value": "a4cab01d61d8c18876d4b53d52de365fb9b512430371fd4217359159f3c507f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3dc953-e272-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682321798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321798, "uuid": "9ac3760d-8e43-4ccc-9047-8a06ed9b28e1", "comment": "Malware payload (Loki)", "value": "45242332d962bec62d02a04c91498654", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321798, "uuid": "bf030080-0a6c-40a1-8bb5-c5d8579ec0de", "comment": "Malware payload (Loki)", "value": "a56d453832124bbc6d71058014f135fd211aa05e7d303f291005f7fe54b91bd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321798, "uuid": "113f97ca-995b-40b2-966c-bf5afc2c3df4", "comment": "Malware payload (Loki)", "value": "a3b8a928b407da48271c6fd7d4b2cba1b1efb7b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321798, "uuid": "2e0e86d8-c523-4457-ad12-9f4ecf33a8c1", "comment": "Malware payload (Loki)", "value": "bb6958a51ade2b080e8693fea68b63d7365d6a27b22083057c5c9365b5aba33a4f08bc015e7b7f9437e79ec4655df5f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321798, "uuid": "d06e67fb-ac2b-4435-9534-e190337f9aff", "value": "T139141240AAE0C01BE9B143F0A8B76A567DF3E82115E8D38B37505F6C7A269D1EE0F715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321798, "uuid": "09717519-c685-42b2-8c48-87b0ca1a73f9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321798, "uuid": "cdd50b21-94f8-4eb9-933f-8db85c787193", "value": "3072:HfY/TU9fE9PEtuJblVhp/PEy54EFlXtOeDOo6PTuA5i49OR4MhnPnhZp5357VyZA:/Ya6fnPEyyEPXEeCoyP5iZV5xEhLPLiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682321798, "uuid": "d0992bcd-2d1d-49d5-bd97-4ad2c8a6c3d7", "value": 193157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682321798, "uuid": "cf2da61e-f493-4bf7-bbf2-badcbe344bdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321798, "uuid": "3c1a129a-545f-4c34-8d69-cff7e38d8735", "value": "45242332d962bec62d02a04c91498654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b2ab30-e2be-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Guildma)", "timestamp": 1682354257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682354257, "uuid": "4df2640e-d59c-4a1d-803d-e46aba56645e", "comment": "Malware payload (Guildma)", "value": "c63437ed191b820a4ed80e389dc8c78a", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682354257, "uuid": "64f5b15e-c61d-448a-be2b-b2a028848713", "comment": "Malware payload (Guildma)", "value": "a7773028de935f6c3060398256f1990d75ba519509e403c160af0c4079b6d4b1", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682354257, "uuid": "de195c32-42d7-4561-8a9a-13af878b1a0a", "comment": "Malware payload (Guildma)", "value": "2cd2af4946521b608fce6d0c45beca45326d2ab9", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682354257, "uuid": "02c39fe2-64a0-413c-80d6-d8ba61c9e102", "comment": "Malware payload (Guildma)", "value": "4b5585e0afe91d383c82f2a7ef804a1f9eca6323582aa864723acc1e9bbd4e98d4fe72c05f8646fd72287011f43729aa", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682354257, "uuid": "840b6cd4-8901-412d-ada3-1717cd449ac7", "value": "T14621963A82E9C504D52A91B3C71BB5CAD690030F0D03BF060E2087D259161FB3F49355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682354257, "uuid": "489ed571-75de-4b40-b798-670406f83848", "value": "24:9cSl+yTxPL/pwf3m9QUBskDbDST4TEWugcLRefmPV5+/tK47TM28TDwTEAel:9fl+sd6fzwsk3Dftuu4A82WwX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682354257, "uuid": "7e262b38-ea66-4795-b92f-0a8a6fb4097f", "value": 1140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682354257, "uuid": "4738d51c-f420-4d99-ab5f-e22ec1e6aece", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682354257, "uuid": "f5ac251c-50ad-4954-9513-e7ef2cae5bf8", "value": "AssinaturaAutentique27718.69724.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fa6b12-e298-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1682337933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337933, "uuid": "bfcfdc84-cc60-4e01-8bce-f16d3eb89e59", "comment": "Malware payload (RemcosRAT)", "value": "4da4a82bca78fa384d1ffca10c5df5fd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337933, "uuid": "6b4289d6-fa1e-4b71-9d40-196ed4ff817b", "comment": "Malware payload (RemcosRAT)", "value": "a848f66c8597488ab423ed3da7e094fd2cbf691905af066b23f087365e4fec83", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337933, "uuid": "329705d9-cc21-4276-9799-884b059fc274", "comment": "Malware payload (RemcosRAT)", "value": "f178dbc08cf99092dd281e44af94108e9c922e12", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337933, "uuid": "283a7234-fe64-4601-89ba-12da56e287ec", "comment": "Malware payload (RemcosRAT)", "value": "e96634d59f8339e8d42438f8914216926848b5e4cafb4f966e1cf9e89c6873f806a9eca4f511c0fdf15b07442c34ac70", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337933, "uuid": "ac0159cb-4b7f-4fe7-b970-52a95c4c855c", "value": "T180C5A525B1743DC7532612B2868FAC8A6319FC47B39B1ED8C05EEEF52CD4575A302E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337933, "uuid": "332e98ea-2ec8-40f5-b9aa-78026724ac7b", "value": "24576:wd2JJ7ohLiozgqgsWJ9gwPQaYY/PrXttcmh9DM/KXf:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682337933, "uuid": "6cd347f4-f8d3-49dd-8726-e274c23477ea", "value": 2534739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682337933, "uuid": "ab6aed21-690e-4617-bad0-76231a274767", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337933, "uuid": "3acf66bd-3ad6-4ca8-9f4d-da5bec8126d7", "value": "attached order 310S.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09adb30-e272-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682321800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321800, "uuid": "df19fea6-67bc-4004-a183-9137e610bb9b", "comment": "Malware payload (AgentTesla)", "value": "984ee0863d068b351cdb82d9193bcd5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321800, "uuid": "1844d5de-bbd3-4def-b32e-3bac4c00c2a7", "comment": "Malware payload (AgentTesla)", "value": "a84ce871209f18192168c19b17bc3c0061aff83a98611828128a54fafde6d4a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321800, "uuid": "91af8745-7175-45cc-8a7f-c6699e171017", "comment": "Malware payload (AgentTesla)", "value": "241bb59393e6e7a46fa0e45015fdd344ca45b543", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321800, "uuid": "fcc19c18-77c7-4239-a299-5c6c73e4ea0c", "comment": "Malware payload (AgentTesla)", "value": "b803cf09e57e387569870e7fe5eb60f86821e00ab03e05cfbdf96919405fa4455d99c8eaf74f2f435b8f13e993a008ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321800, "uuid": "38e050ab-8a06-47eb-8370-22d93b7bdf2f", "value": "T1C3C4126452A7B2A9DCCD67BB4A10248A437171826535E72C17E88E8B8D43F87FF0617F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321800, "uuid": "81be1e2a-fbf1-45df-bc64-deb7ae3810a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321800, "uuid": "0ba0d24c-ddd2-41c5-b9ec-accebe28e885", "value": "12288:gv6aId9apbTggZDnae9goJLu6FEOtz83N3F2KMemQ+tW2h/Xk:gv68fRae9goJxFECO32KMj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682321800, "uuid": "55257434-bd88-43b7-bc62-555d1aa43d06", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682321800, "uuid": "535336ce-67c3-4e0e-ac05-00f8fd1acd53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321800, "uuid": "a7fae997-d37a-43c5-845a-5d66938b9e70", "value": "984ee0863d068b351cdb82d9193bcd5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc68d9c-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682346840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346840, "uuid": "d95ee0b9-f770-429c-955f-bc425cd8129a", "comment": "Malware payload", "value": "8712580f9312c3be1782b238d17eed5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346840, "uuid": "79df1a49-896e-41b1-a859-444fa7adfc7f", "comment": "Malware payload", "value": "a8f92631e4bb6bb04b15b117f050b8dd02f91ccd368022e5547ea8da71124827", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346840, "uuid": "5f6db6bb-7837-46fe-bfbb-fe3b5cd564f6", "comment": "Malware payload", "value": "44e3bc8f15f0d15fd0e5540903e69dac18551ac1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346840, "uuid": "efc32f75-9a0a-4b92-b138-1d6bf77d9f4e", "comment": "Malware payload", "value": "c34af2ce9dbe8662976174b817e852b8c7918fc87bca61609b05dabf8ca35ef285329bfb4c0a0cb54e3d8967e0d07446", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346840, "uuid": "7408ffba-4e52-41b9-8878-0e691e0806d0", "value": "T16EA3842A3E21EFFFE568863107F35E7097D5629226A19386F25CEB181F6128C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346840, "uuid": "56064651-5d90-4a01-a03d-2044f957da4f", "value": "1536:S7j+1TfCq+LzIfK2rKIfmaHy6rfV2D3neq2bS1jxlrimW+zWBSirHzai:VR/fymd2D332bS19pimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346840, "uuid": "0c44f1e3-d245-45a1-b400-31900860baa0", "value": 104712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346840, "uuid": "ba03e9a2-f213-4e32-b458-247a01e6b620", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346840, "uuid": "7ea76440-50b6-4d46-93ad-bc76c2567c14", "value": "8712580f9312c3be1782b238d17eed5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73427a25-e251-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LockBit)", "timestamp": 1682307497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682307497, "uuid": "7ccae028-ba85-47b3-bf42-23ae275eb674", "comment": "Malware payload (LockBit)", "value": "415c3277868d9be6d62f6155352ba9fb", "object_relation": "md5", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682307497, "uuid": "a0f22abb-8512-45d2-adcc-dab645ea5df5", "comment": "Malware payload (LockBit)", "value": "a95000278cb1a755177d270dcfbf214cb73b5a410408345a18ec51b628ff7efa", "object_relation": "sha256", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682307497, "uuid": "55b343d9-8ea5-4f5c-8bc5-46a714e41e53", "comment": "Malware payload (LockBit)", "value": "0d919f9a52182dbea2bfae50fa9bd90bd933274e", "object_relation": "sha1", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682307497, "uuid": "244c258a-9635-4816-8980-74fc3c005ebf", "comment": "Malware payload (LockBit)", "value": "d93c45744b3d720f0d55b14ffb9b15b3f0dd5f792a981683e1e6211662774d6a7d591507ca3518f7e632475607fe988a", "object_relation": "sha3-384", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682307497, "uuid": "773dc065-fa69-4141-88de-f3237c09882a", "value": "T1A7253A0593018F96C813207951FE8DB3A877073192BF1CE6A78466DC83B2FA5776B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682307497, "uuid": "9c5f5ca9-3562-4918-ab68-feeb39199b73", "value": "216df81b1ef7bc2aa8ec52bbeef137c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682307497, "uuid": "57e02621-b199-4174-8c70-baaa58294985", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdyF:Ujrc2So1Ff+B3k796U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682307497, "uuid": "0e398178-2dbe-4a7b-823c-2cfa5ec66955", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682307497, "uuid": "d2553e4d-b06c-4ea5-92a2-fa30b3eb1e2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682307497, "uuid": "cf257628-2b0b-4686-854c-16f658b31874", "value": "2023-04-23_415c3277868d9be6d62f6155352ba9fb_lockbit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec8f986-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682323193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323193, "uuid": "a26eb2e3-2ab1-41d8-893a-a40c621e1587", "comment": "Malware payload (AgentTesla)", "value": "a51c4ebd3f30df79b6c8f81dfb28d271", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323193, "uuid": "c618cb9c-4519-4c58-a93d-ca21e2432349", "comment": "Malware payload (AgentTesla)", "value": "a9b98a60cb56ec8b3b05c5ebe0656afb6f42a5cb296c8c4fb2dccc283a2fe082", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323193, "uuid": "9082aa38-7bb9-4ff7-91f2-eae05498cf4a", "comment": "Malware payload (AgentTesla)", "value": "9a888c736f3ad1d8a7f8490268aa8467e82e2013", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323193, "uuid": "1813ba8f-3784-485f-ac08-492932885aee", "comment": "Malware payload (AgentTesla)", "value": "2cff5d7a8aa8f086070e64841ccc431b91e43f736c8c18c3f821ae58cbe3c0008a38d74dcefb4896ca2bb12563272677", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323193, "uuid": "33a01d13-d48f-4d50-9664-df32da8e6770", "value": "T146C41258926BB6EADDCD87BB4A242069037560536025D7BCC3E889CCCD42F8BFE4516F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323193, "uuid": "db3facf8-49d1-40ff-80e0-2b7a8979fa31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323193, "uuid": "1b6755d8-c082-483a-bc8a-c86eadf29e3c", "value": "12288:SJxQLa4Nk4u8+X9JKVM5f5uVaqMjl8V8uBewJJT1OD:cQLXGFtJl5f5Q4Ke8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323193, "uuid": "185b654b-0c63-487e-9f26-23a0734e0ab6", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323193, "uuid": "e2ecab0b-0278-4c62-95a7-ae5b2756cb77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323193, "uuid": "8d7e00e5-1615-45ab-ad71-220eacc1520a", "value": "RFQ#MV_HS pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc5bc50-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303223, "uuid": "ae7971bf-e2eb-4bff-a0c0-25fbb7aa517b", "comment": "Malware payload", "value": "d238b67c4be2748fe93d07db16896fb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303223, "uuid": "05f9a470-f5fa-4b86-8b2d-bc5eb60f3f14", "comment": "Malware payload", "value": "aa2d05fd421a6ea1eb31a1324158b7b7213bffab917f09c76016aa317d0222e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303223, "uuid": "7affb3fe-41a3-423c-af93-3d1a14f0678c", "comment": "Malware payload", "value": "2cc8d26a28093e9f67f8af9cc2fdc40a4de7c42a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303223, "uuid": "4571635a-2b6c-4eff-98e1-f3fc69b83a10", "comment": "Malware payload", "value": "0aa8b732546da9e2bba97bac78ca22757d1200aaa48c5e7476f158bbd4e6fe2284dfdaac4e8c44f97ace9da76930a0d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303223, "uuid": "4955edf4-a5cd-4c29-85fe-21c6ea8b2034", "value": "T1DAF05E63B7420EE3E10E07304C6B820532FCD83483A85313DE911735A8B0B15EC24B0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303223, "uuid": "4ca832ee-752a-4912-acc4-c60bd0d1a562", "value": "c2b12173bf2547f3d46413619a426f9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303223, "uuid": "910d0941-ebcc-4958-8dfa-f9518e269a0a", "value": "6:yaU/Ohk8xw3A4kXkVo/N1jl2FhzdBHvx:kO+c1xXuo//cv5dp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303223, "uuid": "ff2d5ab6-b229-4f8e-ada0-ea10c06bc3db", "value": 608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303223, "uuid": "502c03a3-1ae1-4bb2-8917-786794a81ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303223, "uuid": "5668be23-8536-4cd4-93f5-25d50389eaeb", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.21953.12478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e884c27d-e284-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682329598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329598, "uuid": "59bbda8a-5cb0-401c-be5c-732dedd73442", "comment": "Malware payload (Mirai)", "value": "797f4800a7ca572d5410b90e598e1f9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329598, "uuid": "a42576b8-3643-4c1d-89a6-177897165326", "comment": "Malware payload (Mirai)", "value": "aa46b90baf61688f377cc1d07470842e322d88fa2263efa50feeb63e42825feb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329598, "uuid": "46e9445c-1e12-4359-8d77-6debda6d59dd", "comment": "Malware payload (Mirai)", "value": "fce169d26e964d440d5f3b0cb5d8164e46915e8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329598, "uuid": "ed0da6b2-e025-4723-a699-75024cdc7fee", "comment": "Malware payload (Mirai)", "value": "551f8f91f574873e2402b3e69fb9b1281b1e85e14a975e4cb48b7e65c5b622684b891a8b934dedcd0becf64e0e28abbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329598, "uuid": "28c0c6d0-172d-4c3c-9f51-43551a0ced07", "value": "T17763AF73C4266DD8C18902B4B4B48E796B43F809956B6DFA49D287AA8007FFCF5097F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329598, "uuid": "1be96de1-ca14-4bcb-a99a-12e56b46951b", "value": "1536:8/RN9SQazB8e5PwtMqaRgrAgduNV1COTd85Btz33:85rbbe9RgrAuuNV1Ta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682329598, "uuid": "e08d6eeb-b27f-4555-9502-97c2cfabb046", "value": 67736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682329598, "uuid": "b067fddf-8c61-4823-a281-20153cff7e1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329598, "uuid": "114078b4-fc59-4198-ac4b-f707383abcd7", "value": "797f4800a7ca572d5410b90e598e1f9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37c9f81-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333482, "uuid": "f2e2df02-50aa-47ce-ba03-dd0b4398bc73", "comment": "Malware payload (Mirai)", "value": "c55f4eb2bfb2dc28c0845fd131d3a353", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333482, "uuid": "f3c53630-c1c8-43d3-85a9-b1d93cc683e4", "comment": "Malware payload (Mirai)", "value": "aa4c7ece040d02195238500024a5df9e22745fd5a4552a09916ef56be46ebc96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333482, "uuid": "310a1b5b-d773-4a06-9112-b127ce87f537", "comment": "Malware payload (Mirai)", "value": "9ee99c51d240e359faa4e2a12634b8766d1e6a2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333482, "uuid": "af154a15-f404-43c5-a312-cbcd046c383d", "comment": "Malware payload (Mirai)", "value": "e102f04437b665b0e0fbf5d3a385c165b4a72a981eba1a66fc93dbdebb3db178ac29c9441e97082a9b6dc33d3fde4587", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333482, "uuid": "05a39391-8355-4470-9ea1-b043b5d92c26", "value": "T121632851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333482, "uuid": "55e12530-b450-4d69-95ee-79e4f631240b", "value": "1536:mN6lxMmiioB1k5WO//kWEzZEioUbgo8DNRu9AvHWa:mNbODk1NEioUb3ihH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333482, "uuid": "e0f2c11e-b6b5-49c4-b401-d84cef22e321", "value": 66912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333482, "uuid": "1275c411-8ddf-430a-9faf-cbbca7dc493a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333482, "uuid": "778ad08d-a80e-4a63-8e80-36e7c91563d5", "value": "c55f4eb2bfb2dc28c0845fd131d3a353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0712f5-e26d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682319455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319455, "uuid": "bb564186-5cb0-4123-9793-a09b31af57ba", "comment": "Malware payload (Loki)", "value": "ccb3d203dc3f82441cf3fe67c88ef9e1", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319455, "uuid": "1a1a35d5-20ca-4529-83fa-a1300c3a08df", "comment": "Malware payload (Loki)", "value": "aa56d26e40bf6a8592ba1379f3d70c2f050a69df03d8c0e18a6c999243b4a197", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319455, "uuid": "40de19ba-26b8-471e-bdc2-22e8ada96ec4", "comment": "Malware payload (Loki)", "value": "ab7eae48bcb413684ef80ae09c1f556fa82e8684", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319455, "uuid": "04565df6-bdfe-48b6-ab9d-15b8f1d599d0", "comment": "Malware payload (Loki)", "value": "3fc4abfd7cda59c957547794225e84ed819d58387a7abef68dd72cda4537c759cf6f738abe40f01b296134b90e478225", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319455, "uuid": "278cd9c8-8fe8-48e2-a337-0732e8a3c054", "value": "T11E041376C47510D67CECA2F44B6EDBA6458C7C22EEA033247E4212BF654C4877BAED11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319455, "uuid": "446cad10-6cb6-423a-9189-daff01522241", "value": "3072:5pOz8IaLBWFuLPkd0loKXTp5do4N8eQJcnEhkLpGC5Q5cGZ351bY7j:5pU8PLMFSPo0lo4pl8eQKnEhnpr1fbqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682319455, "uuid": "330727d1-d52f-49d6-b131-3b9de05e96d6", "value": 178327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682319455, "uuid": "cc59551e-9bde-4fb0-b9b4-c69aba936ce2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319455, "uuid": "f37e5e8b-72a9-4366-a34a-21d1363c7d9c", "value": "-Invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f24ecc-e2bb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682353129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682353129, "uuid": "530a9854-d188-444c-9253-3b06b8efbdd8", "comment": "Malware payload", "value": "a633c918b06afba94fe530b9d3ff702b", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682353129, "uuid": "6e2b7941-ef09-4933-800f-d3a358232cdf", "comment": "Malware payload", "value": "ab28be6b24acc791aa6681175babf68d9591ac47f92c0ef053dd4621fc1cd773", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682353129, "uuid": "bd4b1301-7879-4473-9570-af81baf18bac", "comment": "Malware payload", "value": "74bd67995a7f591794cfc0f90eb3d106cddb4594", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682353129, "uuid": "1353eba4-fe83-44ad-a56b-0ddbf0e359eb", "comment": "Malware payload", "value": "0afb045bf7914d4398b3f0f99875e28b2dcb212f4836dba08a341c32d2345359d80430cc76dbd6fba40fff39b1b7c2f4", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682353129, "uuid": "f50f7264-2f8f-4b93-b9cd-9634ba7ae81d", "value": "T197A42339BF213D0DF343F6B9142902DDB2980E8141A8DCF5DA9BAD54848CDC63A79A7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682353129, "uuid": "2120b4b6-86e6-4a43-833a-ffa8c840f771", "value": "12288:kPLalZkGoyJFoViBX8uDTZrT4Kgcn4tHLPbSrz9U:kPelvJAiF8Gn4KLnmI9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682353129, "uuid": "33714227-8be3-44d9-a97f-ff05a9dc07c9", "value": 469776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682353129, "uuid": "9a338d8a-19e1-468c-b5ab-10f3775d4480", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682353129, "uuid": "f39fe535-fd70-41c7-a4e7-6d5e8389bf28", "value": "new_order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b5188a-e29c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1682339799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339799, "uuid": "a55f808e-d426-43c0-92cf-46fd45c97a2e", "comment": "Malware payload (Quakbot)", "value": "43b3f50bf3ce55ab5070af36d5ec665c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339799, "uuid": "61d7db2b-a7ee-4ea1-91c2-cd182f5c924b", "comment": "Malware payload (Quakbot)", "value": "ad7fdfbdeeeabf9d4b838ec13ef2c910c5d2ee3ecae434319e1567c2ef1f40ba", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339799, "uuid": "8b261b64-9d62-4fa4-9b32-f196744e5a2b", "comment": "Malware payload (Quakbot)", "value": "f45ee884ef27a84bf2922640a4203d8a529d61ef", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339799, "uuid": "80df1458-9c1c-402e-b046-87a944ad2c58", "comment": "Malware payload (Quakbot)", "value": "e23b6c7756fee873bb65f0d30953071cc3fb94358db4af7f2d4beb90daddadafae5e9d52c4fa171eb1a65fa0e677c0fc", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339799, "uuid": "88df61d2-43b2-4255-b10b-5f2923715be9", "value": "T15FD57C21B287C136D56D0172A92CEEAF5138BF730B3150E7BBE83A6E58B48C15635F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339799, "uuid": "bc0f75e4-36ed-4537-b055-bbf5130183a8", "value": "49152:x/jsOOTLCTFQq5iNZ4KS5WPvwaqX/nREYVoB5JSHawNx:OrTLmIp+/nREYKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682339799, "uuid": "da531daf-5a32-48be-ab8a-57c8331ba3c6", "value": 2862080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682339799, "uuid": "78c8bb68-119f-4984-a921-ffe66e20845e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339799, "uuid": "6bf724b1-da85-4870-b91c-26d4c2e0842e", "value": "rX-fve7qv51Lg47BPvLJEMXS7j7K5DQxnhVnwu8fQLo.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64019f40-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330234, "uuid": "d0026e88-1f2e-48e6-ae9e-d5469edf31f0", "comment": "Malware payload", "value": "70f94249a7323d9711488e6d4e69ab38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330234, "uuid": "d522f244-3916-495c-b633-9a28c7922ba9", "comment": "Malware payload", "value": "adb6808f97191d961687b5f30f35c843686699d70f482f4d7d8d4f41e84faba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330234, "uuid": "03dd19de-32d8-463f-8696-2ab73db3a180", "comment": "Malware payload", "value": "8914709ba612eeca93fd10442fa864ead8be4216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330234, "uuid": "1dbe51c9-b9b2-4aef-9a7a-e9a5f99d02e1", "comment": "Malware payload", "value": "eb328a211dd325e23f2952426e35f558be43f95952e1e80bb68524169253613a13e3d5ecfc0ef770012e89298ea1c5cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330234, "uuid": "6102a6ca-66c1-46be-bc31-497e5e546235", "value": "T14036CF5F609097BEC20A9232C1FE5B34D53371A24467C72E5AC1E2F16A95D608F7EBB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330234, "uuid": "75b34a62-c4c0-4ed4-b073-98afa3f06b7c", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330234, "uuid": "83baa146-5a1c-4985-99ad-0d390417c116", "value": "49152:mQ/hNQGEaNUdcZ3LZ5cpb3rwNHPb+P0dTKUsu2kRMMkS0DhDItBUZqvS0whq5FcY:9/l4mSZhQAqK0whoco7G8y7gH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330234, "uuid": "29e7053e-a7a1-4d3f-9cc0-ac88905aeacc", "value": 5096824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330234, "uuid": "79e81492-3efc-4e0e-a126-d8e44723e42d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330234, "uuid": "e21027f7-899b-48dd-aa8b-85a8f02dac9c", "value": "adb6808f97191d961687b5f30f35c843686699d70f482f4d7d8d4f41e84faba6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eedd84e-e28b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682332293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332293, "uuid": "93d91449-d902-4da5-8cab-a40f81223e70", "comment": "Malware payload (Mirai)", "value": "7303a72ae014f7fd9fa5dd4f4c32ddcc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332293, "uuid": "fdc6ca9b-df0d-4628-878b-4f563c8bb06f", "comment": "Malware payload (Mirai)", "value": "ae30c865264f2602c5a37e1497e0c1d7dbb7821c46486abe8223801e6b5e8b86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332293, "uuid": "fa442b17-573f-41ef-8ae5-d2526afac7fc", "comment": "Malware payload (Mirai)", "value": "1d3a730f46b87347bdd1d56422795abc96e1290e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332293, "uuid": "e287df3d-880c-44bb-ab84-f58bafc5c653", "comment": "Malware payload (Mirai)", "value": "1cccc06eaaab79a52c56889fcf0fb8f772c3649992f7261bcd1b315afc748049ff352908114342d7f548e772ed8c95bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332293, "uuid": "fbbdcb26-2014-4bb9-9678-9d5ddb6bae1c", "value": "T136338DA6C5BDEDA8C1544AB87D258F389B63E00086933EFAD744C65A8047EECF1593F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332293, "uuid": "effc5bd2-4115-43f1-9c56-66bca34e4dee", "value": "1536:5aRVewtQAWt8GdcPs3q/aKlMLEm0DOFCn:5kVe2k2P+qiK60CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682332293, "uuid": "f55b58d8-97a2-4d2f-8e64-b8275bd652c9", "value": 51336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682332293, "uuid": "f5fed461-9076-4adf-a7e7-ccb594e8aa6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332293, "uuid": "05547877-7924-4a2b-8509-95827043196c", "value": "7303a72ae014f7fd9fa5dd4f4c32ddcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853061c2-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303232, "uuid": "ef7ca835-902d-465c-9b37-1fabf0bfe126", "comment": "Malware payload", "value": "a32add436fe7248e31bd53f13d1cf693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303232, "uuid": "4575974c-1396-4ac0-8609-0fac6d96c35a", "comment": "Malware payload", "value": "aee7b825b1f4fb3a1cde73e280b70cdcda7f15f0967aaf23dc58cbb816952540", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303232, "uuid": "68429e16-3e1b-4f16-a83c-9d0f944c61ce", "comment": "Malware payload", "value": "eb067abb2e0a6a43f5d1b41ef6c1f4282badc7db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303232, "uuid": "bf6ae1ef-7329-485a-811e-80ba5236db85", "comment": "Malware payload", "value": "db471892682ad3cf8b49087ef5582fedaf6c5805b467b6057ef8daf5b43a65766abf208884b83af20a2c478672c47ff2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303232, "uuid": "78111b2a-0d7d-4b5b-aac0-eb4c4872dd08", "value": "T1CFA3F101DF0EA83AC80C2E73DDA8DD39053CEE49DF092796758D75BE7A3933A861055A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303232, "uuid": "f7ddcee5-1986-41e5-856a-f9f300065164", "value": "09d0478591d4f788cb3e5ea416c25237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303232, "uuid": "d7a9b287-1cd0-47ec-9210-c4c1125570c0", "value": "1536:gNQTIx9A6uFaqe3Fop8Yh/IWTg7XISlNL+tdnlc1YSc27+dwTUP6ynyvlT6:8M631W8bI+L+9c1YldU4nyvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303232, "uuid": "f23052ec-285e-4a60-92a7-01b94075e1d4", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303232, "uuid": "f9a850d5-e7b4-40b7-b6da-0cdf19df217e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303232, "uuid": "f69b0fbc-4194-4ec4-b1d8-f63d2fdd17da", "value": "SecuriteInfo.com.HEUR.20334.2187", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1beae2a-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333452, "uuid": "5ad75ebe-e742-47c4-b14e-3ccfee36af55", "comment": "Malware payload (Mirai)", "value": "c8ed54b3ecc2b6599e81fed8cf0027c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333452, "uuid": "0884965b-a8ef-4621-909c-16a136614ce6", "comment": "Malware payload (Mirai)", "value": "af8d42aa90a66efbe8029eb9744eeef507717d2b5abda6b1a4c2f2a613998626", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333452, "uuid": "e561af57-d22b-4367-bfd5-04c98c0403aa", "comment": "Malware payload (Mirai)", "value": "330f74ef78ca7708599f6b34d71a3d9370db466a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333452, "uuid": "b7184816-9f68-46ed-af36-727b23253ed2", "comment": "Malware payload (Mirai)", "value": "22103c0af16ef90f3c350cd981be8f7d3305496cb15b28193d3a0edb5f4eaf645fc13ecf0457c3a4871d859424e4a6d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333452, "uuid": "67220d6e-916e-4e44-b342-b3fdcb30637f", "value": "T1D8F2E1726BB2E082CE6C54BDF9604DA20F6503FDE2BF312057518DAD9EC5D43D0EA682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333452, "uuid": "66be5112-2599-4673-8478-5992db51ac52", "value": "768:nYVgAxkU1RHz5p2Bi1KLA7+qKg83zGTo2s9q3UELCg:nYyAxdRH9ei1Kk6l6Z1Lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333452, "uuid": "4d7178d2-067f-4229-ad1b-695e5528f7ce", "value": 34484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333452, "uuid": "033462a8-96b7-4338-b00f-a08ec0b3d09b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333452, "uuid": "1d96be5f-3a71-47b4-949a-469f16b5dcf4", "value": "c8ed54b3ecc2b6599e81fed8cf0027c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c71d5da-e251-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LockBit)", "timestamp": 1682307512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682307512, "uuid": "1512b8d0-1113-48dd-9779-4b3adc39f05f", "comment": "Malware payload (LockBit)", "value": "68b405e3e6c86b51cc6f2e7adb66d0fd", "object_relation": "md5", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682307512, "uuid": "762b59fa-eb29-45b5-8cae-d2ce3149f3dc", "comment": "Malware payload (LockBit)", "value": "af93184558add5c5f7c3551e94f2fbecde5aeba5141be7d29f4577b67551a35a", "object_relation": "sha256", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682307512, "uuid": "28801258-95a9-4953-87ab-ba9e0b73b2eb", "comment": "Malware payload (LockBit)", "value": "b64e8cf2f0aa3ed35644870906b37edcffc5ab0b", "object_relation": "sha1", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682307512, "uuid": "2fcdeafb-c8c6-4708-8719-7f0d28d67335", "comment": "Malware payload (LockBit)", "value": "5d4918c524e041690cce7113e175bc9f33fb7cd2eb4939b946198d0dedf069b3feb340eccb6ccc6119e598796ee627b0", "object_relation": "sha3-384", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682307512, "uuid": "61876922-2dc0-4bee-be5b-99efb6697e71", "value": "T1D1E58C07BC9915A4C5EAD23189769292BB31BC891B3037D32B54B3B92F337D45E3A394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682307512, "uuid": "0912c727-d5bb-43ae-a592-d419ab047dbc", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682307512, "uuid": "058c94e9-6552-4f64-b382-407f17e7f659", "value": "49152:g0vjlWMi7PXNsVrb/TEvO90d7HjmAFd4A64nsfJP5eI/ArqYgZm7RYmdn3E6q1/P:UBsnpABdNIZpiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682307512, "uuid": "01f162c5-7c8a-4f25-a05e-31b4e4528f50", "value": 3246080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682307512, "uuid": "56c0c0c0-c736-40b5-8055-2642d7a70869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682307512, "uuid": "7608b999-1bc7-461c-990f-c6738ce846f2", "value": "2023-04-23_68b405e3e6c86b51cc6f2e7adb66d0fd_lockbit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3503c5-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303240, "uuid": "0fe6deb0-2b38-43d3-8e8d-fbbaf8d821f7", "comment": "Malware payload", "value": "31f9023352d09c854894f250ef8b361d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303240, "uuid": "524168e4-deda-48da-a92f-c74f26c103f6", "comment": "Malware payload", "value": "afcf02093648a8a11641e9abf1ccc9b18c6c158c8eb5051513bd0360ce3b246e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303240, "uuid": "8dad95a2-aa4d-4f08-ac46-1d30e03cd54a", "comment": "Malware payload", "value": "26554f15438d95fa3d9ff8c392cdedaa3fe42a54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303240, "uuid": "ab79d0f0-c390-4317-9530-cb5d2344f539", "comment": "Malware payload", "value": "d79b438e2679016932765727546e4745f11ef3717facf8b7b60403a0711b784cbdb7ece68d19f86d118b64f19905d4f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303240, "uuid": "a9db3a75-51ce-4602-842b-b1784614eb8c", "value": "T13F0412572067DDD1D3F6A2F5454A17BC6268E0D1AEE0A633096227BFEAF98370C13349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303240, "uuid": "89331012-6d57-43ca-8816-a6fa6979c8c5", "value": "41ee72c99c71a24465b57aaf14dd106c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303240, "uuid": "7c6161ef-1c94-4916-85f7-750f3f62e852", "value": "3072:CBZNfAJ+Haa/OVDnrDIhflr/rY07QJFSfpDqZWfxdh7:CXNIU6a/Vhflr/uJFSfZfxd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303240, "uuid": "0d6b2706-5e06-4a3d-a329-a562e7501d55", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303240, "uuid": "85afd69a-df8e-4bf9-9d74-785554372fa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303240, "uuid": "52c9af33-aa5e-4e21-b41c-9a938ab14661", "value": "SecuriteInfo.com.Adware.Agent.VFY.27990.6359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102dd1ad-e26d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682319356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319356, "uuid": "f07e23ab-9f58-492a-9dd4-2801f32ab1d9", "comment": "Malware payload (Loki)", "value": "de4e75b79ffea59ebbeddfa040a32482", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319356, "uuid": "e46e47d2-6edc-4c35-ba74-3e24dcf313d7", "comment": "Malware payload (Loki)", "value": "b0cc58ea6f02963c94de021cf5cd9214eb4cbb0ce1e1321cc6fd6b55b17107b1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319356, "uuid": "01fd0a00-5e79-4cf4-a29d-76d6fe2dc4df", "comment": "Malware payload (Loki)", "value": "6264c1a510af9649dfb6cc964e536ed36b09bdcd", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319356, "uuid": "5307c1b9-e382-487f-88dd-f9d6b30ce98a", "comment": "Malware payload (Loki)", "value": "3516019bbf102678c3930b4501007b700e826b25c33c7a1eba02f87aff0ae85456a3bdf1d1bf6e702efcd5bac04b56be", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319356, "uuid": "06d295e3-f861-4dcd-b4be-1ddb0e867d11", "value": "T1E0041376C47510D67CECA2F44B6EDBA6458C7C22EEA033247E4212BF654C4877BAED11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319356, "uuid": "07711260-fb28-41a7-9050-43115dcacd6a", "value": "3072:jpOz8IaLBWFuLPkd0loKXTp5do4N8eQJcnEhkLpGC5Q5cGZ351bY7n:jpU8PLMFSPo0lo4pl8eQKnEhnpr1fbqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682319356, "uuid": "b270ab39-9c60-43aa-87a4-8e02b4f94101", "value": 178317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682319356, "uuid": "1f888612-53f5-487a-abc6-35b8621b8e38", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319356, "uuid": "021b882c-68df-4282-be5c-2c1921b7933e", "value": "-BL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcc53b8-e272-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682321792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321792, "uuid": "65e9afa9-022a-4ad3-8f1a-c1b9972956d7", "comment": "Malware payload (Loki)", "value": "fb9991907a26e5df3668a869de7e4525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321792, "uuid": "dc32e743-fb01-44f0-b926-b062b783e4a8", "comment": "Malware payload (Loki)", "value": "b175593d1ac69bbb4ccb9d1ecac2eef8414ef9dc8bf0ff6975c63537dda6ec13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321792, "uuid": "e2074c33-2de9-43d4-a281-ee932ce32a6c", "comment": "Malware payload (Loki)", "value": "99445f09cb9868967393cf335b705c581b426c95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321792, "uuid": "af3b91bf-40fe-4bef-9ad6-08f3c21f373c", "comment": "Malware payload (Loki)", "value": "5153118abbf3f0dca20866e7d77a53044c94c52699b7c11ae8d6dc6865c579ca1dcd0e789372165f811edcf7b8641118", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321792, "uuid": "857f61d1-ec6d-44af-b553-b1f544d69cdb", "value": "T17ED4E024F21D1DB2E58BA4F14919A3572A1973CE6A7C66947B7DB0E122B33CF1B49C03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321792, "uuid": "d10504b9-8898-4c1f-86c3-685a585a615f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321792, "uuid": "8db44799-411d-4f15-8e3b-8ad7fe838878", "value": "12288:P4gjjzkCS3z40SAnLNujDtIsker3CSvCjlb:P4gjjzkCSJDLNKDtILeTCSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682321792, "uuid": "54cbf392-6b3a-416f-a949-7c5b23c437a3", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682321792, "uuid": "c7c56b00-a975-498f-b599-affce52b7300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321792, "uuid": "bebb9bf8-b09c-4a9d-bbec-ab91d6ac8692", "value": "fb9991907a26e5df3668a869de7e4525.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6768410f-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330240, "uuid": "18585988-a692-4374-9875-aaa6c34377a5", "comment": "Malware payload", "value": "47e8ea2ef2da34b515117ee0066315ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330240, "uuid": "307a63ff-48f4-4cc4-a9e6-4b7136437529", "comment": "Malware payload", "value": "b299898055262e065afd5b0479b2e3a190e314cab3ead3722b2cdbe3534a2681", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330240, "uuid": "4671a672-0b85-4fbf-886b-4f8e42d4a4f4", "comment": "Malware payload", "value": "562778a1790b65be1b9eebc0c840c316ae6c90df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330240, "uuid": "6406ed87-e7d8-48f5-a5a9-efe13d3a17da", "comment": "Malware payload", "value": "0280e27d38bd42f95a45248b44793edce6e8ab4b48895474e78c9724d5c69bd0dc27d2e67add9f1d66c4edca06b8763c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330240, "uuid": "c6849f17-9252-4e75-8eb1-088edb790fa9", "value": "T1DD36CF6F609187BDC206D232C1BE9B34D93371E14863C63E96C1E5B16A95D248F7EBB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330240, "uuid": "fc0793a2-f3bd-44c5-9e61-8ad5515047e3", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330240, "uuid": "9849ecb6-f24e-4a8c-8ae3-da4e1671c8e8", "value": "49152:7pghL0GxlIP8oa2op+pChboi2CjASvvhyZVW3JvDTiY4ekJb7keVPPm3RYnfjJ0t:dWnnEJz3SuU/zJqdTVm5alfYPy7LGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330240, "uuid": "2cbda3b6-8523-46c9-a86b-aa243267d265", "value": 5096312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330240, "uuid": "914907dd-b328-437b-9d66-74424c8747f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330240, "uuid": "7e8059d7-e540-48a8-9b49-5d5594fcdcc9", "value": "b299898055262e065afd5b0479b2e3a190e314cab3ead3722b2cdbe3534a2681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6eab27-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303215, "uuid": "696aa9e7-9c62-4a74-80ac-9b7c377c1c7b", "comment": "Malware payload", "value": "2b9e860a50553c771b92539e19fe4789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303215, "uuid": "4c964af6-ff31-4610-b8f8-cc4333d67ae0", "comment": "Malware payload", "value": "b2fff8903fa0729c49569faaae4ab0b412d05ddaa994ea1975fbb46dbb85b22b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303215, "uuid": "a5346866-fc78-4220-b2e3-a5dfcefab97e", "comment": "Malware payload", "value": "7f5f34147f2e678750e4681cd559a17c6821d4dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303215, "uuid": "705ece85-72f3-43ea-b523-ca458d320f25", "comment": "Malware payload", "value": "563ef9e1500da69541196e829ead3efc65b42f691c3adfe047ffd1f6703b089b95cd44a00a1a02e887a6e37f3ef25937", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303215, "uuid": "f20d977a-69ca-4d39-a2a7-4c714f3417ac", "value": "T18D816D1E0D9F8B98C26475347CC0669AEAEBE17FC7056C54091BA1866D07ECA4F71C48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303215, "uuid": "aef6c049-257b-4945-bcee-6a1473528b7b", "value": "992b55ac6e4285130bc78a171683f859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303215, "uuid": "69a55120-8572-48cb-a5b1-b8f135715eb8", "value": "48:9OvEJmxFgGnEbpLLM2nP1lg0IPn8gp1ot2N75rEuQL3SeJmCaU8JhzKtztrD9gPy:ctDspLLM2nDxIXP75kL3/Jm1dkJ9Th7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303215, "uuid": "731a1bcf-035c-4a5a-b19f-500d96e95e19", "value": 4082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303215, "uuid": "d5c834a7-dcd7-47fb-b015-0da4cda89644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303215, "uuid": "6692dcdf-0d5b-4201-91cd-84459ddf0356", "value": "SecuriteInfo.com.Trojan.Crypt.21045.30171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbabb87f-e27c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682326194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682326194, "uuid": "e691dcdb-4edc-411c-8501-374166fd9cef", "comment": "Malware payload", "value": "75567dd86120977bd62ab9ebc92906c9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682326194, "uuid": "3420871f-9f52-477b-9cac-dcd54d6c06b2", "comment": "Malware payload", "value": "b33509ed5c7c97e92392858b83fe208ff79632ae096444e9f81967cfbf2e4973", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682326194, "uuid": "8dec84ed-e107-4299-aa2a-6941a5530e07", "comment": "Malware payload", "value": "bb0fc0607eef28138906dfabdfe242f2133867ed", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682326194, "uuid": "34d436cf-7b69-4de2-96c0-7bee80a8abc7", "comment": "Malware payload", "value": "1df4675a6cf799c6d79b5c3155a5e8e8d21a2ed990cc31bf511ee6f7b5eb6836a6213570a21817a44acddb74fe1df23e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682326194, "uuid": "952f1a16-a337-47e6-8cec-921a6856abf4", "value": "T146E423D0819E30F4F76C34721A586D7B33BA772A948F5E6BE3D150D0CE928E352A52C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682326194, "uuid": "366e9b13-7092-4fba-8118-c74f3433c2ca", "value": "12288:zjUXqx4cZKA2BFdbx5iXf+2hUccfPO/7BarsxHLuRdGT9zFCyaSO:HUXQ1UqXf+AUn27EkHLuLY9zFC9SO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682326194, "uuid": "770a9277-33f7-443a-acaa-0330bc81eb64", "value": 670715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682326194, "uuid": "3fc11d76-7c8a-40cf-942e-a1414888d617", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682326194, "uuid": "e430fb93-5e38-43db-bd25-5384a690099a", "value": "SWIFT COPY TO45678.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92397df1-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303254, "uuid": "23204b65-5728-4b66-80e8-0647f76d3171", "comment": "Malware payload", "value": "187a4668b8580ba37f5278117ebe3099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303254, "uuid": "ebbfa04c-2835-44b8-9e7b-3c2b4dbfd577", "comment": "Malware payload", "value": "b532e8134269532d811aeab14ca1c70292dc07a18b0a42a337988e04158df2ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303254, "uuid": "443d5182-5b36-4e66-b4ed-241b6851e919", "comment": "Malware payload", "value": "1bbed8305916bbe2cb7603c4fec510841857694b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303254, "uuid": "0de81db9-ce65-434b-84dd-5f2ed6c176d7", "comment": "Malware payload", "value": "3103756e60e4d50bc676641bf72847fa157330aa0d995966b49e3f28dc3beb49605203270ee4a0fe2e52f22455e1c71c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303254, "uuid": "0385502f-6e8c-4b45-bd14-8b52acea3307", "value": "T17C438F3776E18073E4A384B017B54F668B7FE611032287679F44A55D7E30AA1EE35393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303254, "uuid": "21848968-7950-4a8c-9d4a-022ac99abf48", "value": "6d7262a957616f786de56f96417e37d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303254, "uuid": "be8a3e4f-f13b-42e4-9b07-ad4fa3389544", "value": "768:+jRcCGgrr9Jwjig3J29Tq9ZMS6NKiB9PzqQNilRA6Yo/y:8tGgrWZaG2XfjHo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303254, "uuid": "17cc185a-9ad5-4d94-9776-922df357cc40", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303254, "uuid": "3ed0fd93-46a7-4c6c-b767-bf8f66499675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303254, "uuid": "13845986-592d-429b-85e0-00b3ff8a83a5", "value": "SecuriteInfo.com.Backdoor.Win32.SdBot.6789.28727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07db5bcc-e2ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682345971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345971, "uuid": "3bb492cc-8794-4460-836d-cb7a97a2a784", "comment": "Malware payload (SnakeKeylogger)", "value": "4a3d15088555641896d15bc0895cbb70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345971, "uuid": "9486431b-b94b-4e60-9200-9a5015ee7336", "comment": "Malware payload (SnakeKeylogger)", "value": "b552da218e4db455b5ae7ee1c0f70a86d307b0cf5f14ffdcea271c189c31e97e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345971, "uuid": "1dfe3829-aedd-44ad-b2c6-4859aff15262", "comment": "Malware payload (SnakeKeylogger)", "value": "9278d16d01b8e4ae940102fa4525b953df38b7c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345971, "uuid": "c713ee85-d236-41b9-b32d-382294546228", "comment": "Malware payload (SnakeKeylogger)", "value": "4f75693ab6c90d3785086e665c619fea8bbb128bcfe0cd7643a97bcd8c0e3ae9876f80408c4494dafbd294510f40ca85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345971, "uuid": "ffe59819-e2dd-4c93-ac08-cb7c8552eea2", "value": "T15B056ABA21D14617E4157274C893E2F32AFBAD206421D2CB5AD77F6FBC401BB961334A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345971, "uuid": "8d394802-744d-45d8-9d77-3106b9e27c7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345971, "uuid": "5c3b56cb-ccc9-43dd-a3ba-0a93b4be0d35", "value": "12288:47KgcFh8YDxc2CJrsQfJi2tDASt6MIjyDX:a+hNDC2KsQc2PAjAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682345971, "uuid": "4fafae2f-5314-4fab-988c-dc804e53ab17", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682345971, "uuid": "d6c35e62-324e-4e96-bfd6-4806d658b262", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345971, "uuid": "9aeeb653-15d2-4c1f-a8df-b27aaf692b10", "value": "4a3d15088555641896d15bc0895cbb70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f055953-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682333206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333206, "uuid": "ee70a5fe-1f60-49e3-bff2-2050905344fb", "comment": "Malware payload (SnakeKeylogger)", "value": "1e7d09f82c81bff5aaa232d396db26cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333206, "uuid": "2796404a-ccdb-4289-b814-6830b2a95326", "comment": "Malware payload (SnakeKeylogger)", "value": "b559f2c5da63f93d113863c3328df3db4b81cc1e35cb68989ad06a19b9847014", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333206, "uuid": "36b1e89c-be05-4249-b264-6e5efa63a7ee", "comment": "Malware payload (SnakeKeylogger)", "value": "9a4c139e37288d060084319d0d77d59b3a83fcb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333206, "uuid": "76a08c87-e5a0-4aa7-b7ea-b89c78998ac4", "comment": "Malware payload (SnakeKeylogger)", "value": "cac48d67a7489f2721eb5758fd11155186332473c01ad37920563bf8f3ff2ba364de349e446d6c070e26f0da5e8a65ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333206, "uuid": "f05b3fdd-0172-45f8-b4ac-b93dd9b92dae", "value": "T1DAD4BE2B222AD5B6D15E66B3D1E617FB0F6C2ECAEE7990530BA87DD4317237D1B08011", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333206, "uuid": "9d560522-5f04-4ab7-8034-46c79698d602", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333206, "uuid": "20ff6fc2-0a9a-46d8-a417-ae2507399acb", "value": "6144:cCG2Er6p2WhX02OkF5efVEqmpxDZXYZPdntRxGwZn0RNW4cpkcPf5EJbP9BgFD9O:cyYTM6nKNW4GFf5EJblOh9csG3NXSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333206, "uuid": "4e52e9e7-c4f3-48a2-b594-2e8bf803a3aa", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333206, "uuid": "399873e9-d13a-4a73-9ca4-99b4c56207d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333206, "uuid": "3200d9fc-a042-4458-931f-b09751bdebe8", "value": "Payment-Advice-MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46aca13-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682323148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323148, "uuid": "c5dd47f9-78e8-467d-a752-34d2fc52b957", "comment": "Malware payload", "value": "e47d56b12acb159653c177565dfc3f6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323148, "uuid": "94c2e05a-2ef6-4ec4-802e-36bd54aff760", "comment": "Malware payload", "value": "b5ece4d5ee46ab60552b6fd3c073faa5b074c0f05dd8dd1dd1e726ce33222950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323148, "uuid": "5aa381c3-b200-4cc1-a1bc-863992f84343", "comment": "Malware payload", "value": "24482db2bb0e8ff645518eab9043c4b77cfb3bc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323148, "uuid": "faad16c1-6cf2-4ab5-b88f-8d27223ad08e", "comment": "Malware payload", "value": "e01c972bcd788318979e806c3b2aab5577c53b27aa32509c107ac87b354f177d931bab0097468128ebf36eb874dd2f79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323148, "uuid": "3278f866-a18f-4343-a605-3d0e5e26c3ae", "value": "T18413D4112AE84135E4F237B8597E21248A7EFD641B39C2CF728846DE9E21BC28C75777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323148, "uuid": "8824dd81-0e42-4ac9-b510-7563f2505635", "value": "768:GWOCkhKlKJwnUK8qDAF4g63FWQxSeyoPti4diqXF1cnOhriWltv5URY:N8Kt8hZ63FWESe1Pti4kM8hKtCRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323148, "uuid": "edc79b78-9707-48df-884f-c631b9a0e0eb", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323148, "uuid": "556457ca-48cb-4b12-84f1-18fd34db4772", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323148, "uuid": "d03a7759-da7f-4fda-95c8-ba7ea29aba73", "value": "b5ece4d5ee46ab60552b6fd3c073faa5b074c0f05dd8dd1dd1e726ce33222950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2af37d-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682346945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346945, "uuid": "cf22c862-91df-4cc2-ab7c-9b12d1898e36", "comment": "Malware payload", "value": "afd4e7f72260640e860a3be061ee6fd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346945, "uuid": "55149390-73ac-41ad-b9fc-9caa5a5bf2e7", "comment": "Malware payload", "value": "b60cdf37e12697f4afb0b588660e7e955889f4f6d7c420db2e50c8af47558253", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346945, "uuid": "8a2a8449-ece3-43dc-9db1-6ea22702ff5f", "comment": "Malware payload", "value": "4f6e2bcb81e858e5793b0c467ed78b18dc008ac7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346945, "uuid": "e25d20fb-b821-4090-96e3-2091b17592d7", "comment": "Malware payload", "value": "25da58677b06e78a60c1ade78939ffe619a343e91fb4ae49d35611ac98fd8661e7ed71474d56c38e90ca40dafc1c2e00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346945, "uuid": "8d58ba9f-c76c-4feb-ad65-67f0b5bed4bc", "value": "T157457D32F5906076C9230730AA0D772973FD97B1073A569767995E342AF0883A33DAB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346945, "uuid": "7bf2324e-ffd8-490e-bfbd-d0914d343dbd", "value": "24576:iBofV1YbjZKLyPhWpyUB7OjDHLYDwvqipulfNWX9jO5i3l0c:NVqbjZKLyw3B8HLuiAf4XpO5i3l0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346945, "uuid": "9fb37795-dba9-4e4b-a8d7-a38a723c616f", "value": 1271956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346945, "uuid": "1dfd0959-b390-4403-ac1c-e60e36ca98a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346945, "uuid": "8567628b-6031-4751-bfd8-e8b6729b87d1", "value": "afd4e7f72260640e860a3be061ee6fd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146317a3-e2ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682345992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345992, "uuid": "8df1ca2f-b265-4535-b58f-60425faa2b70", "comment": "Malware payload (SnakeKeylogger)", "value": "374bfd79554ee5cbb25e28db0b770495", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345992, "uuid": "a1c4d85f-813f-4aef-a97b-86e1ee9ee0f0", "comment": "Malware payload (SnakeKeylogger)", "value": "b64fe2b2528d50876265ddebe4b4c14b0e78ae82c1a9c6c64849d0868f191815", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345992, "uuid": "4ad8f68c-fd4c-4dcc-af16-30ea09210b12", "comment": "Malware payload (SnakeKeylogger)", "value": "887b12f07034b4c1cb75fde26c2601c14818a63e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345992, "uuid": "6ea57e02-591a-4bc5-a0ba-a407e129a653", "comment": "Malware payload (SnakeKeylogger)", "value": "b61f9b0c499ba1d0a7392e63e46a916e598d5a8c27e46e2f8270433da614cd1dc4441cec5c736cbe04eb914191ddf2b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345992, "uuid": "d06d484d-6ec9-4cd4-a70a-9944f17463ac", "value": "T1B1D4AE1B221AD5B6D15E56B3D0E927FB0F2C2ECAEE7991431BA87DD831723BD1B08411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345992, "uuid": "6013b699-2973-4537-be82-bb5ddaffa584", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345992, "uuid": "a8db4755-0ac5-4c4a-b41a-8b5b65cbdd60", "value": "6144:BCx+ErVp2V5X02OkF5efVEuZ/dKGw0xod9x/Am2gvQw3b3XAysxj7LiriuXtvo+q:BWDoWm2gvQw3b63Iism+5arG/t9EKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682345992, "uuid": "3c5f54bf-d458-4f65-93a2-3a6c8f46711f", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682345992, "uuid": "d4c0ba12-7954-4d06-a963-f79aabf5911b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345992, "uuid": "b6e1266d-d1ca-4555-873b-29c8bd508132", "value": "PO42024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef59fc3-e2ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682346815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346815, "uuid": "674db5fb-1785-4dad-ae27-994a5931649c", "comment": "Malware payload", "value": "a5ac818d59cf28e52fe01c4cd6dad19c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346815, "uuid": "7116e1c0-ebe6-48dc-997b-d69558562ee2", "comment": "Malware payload", "value": "b77224bd68142280da59c91ddbe20c6bdf6344b652a68512ba72581c712ab79e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346815, "uuid": "f99ea033-38c0-4ed0-83d4-7e48f9bb73d3", "comment": "Malware payload", "value": "5a86aeca4eee29c878ab7fe2a6e1a922dc727a90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346815, "uuid": "a8c93a44-6be7-42ab-a19e-e9eb8a7489e9", "comment": "Malware payload", "value": "f65e6c91bb9486dc991484bcd4207ff586e06a96ebfb3e68ba37c8c52c1a82b7b69d30ee7ae8af09cdc911dbf15e0bc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346815, "uuid": "039c48f0-a93d-413f-b6a8-38869f1599e5", "value": "T1ADE34B05E7408B57C0D2277AF7DF424A33339B54A3EB33099928ABF43BC27A95E26515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346815, "uuid": "2c7752e8-2636-49e7-972d-b227ccccec9b", "value": "3072:Ib2NQviuoSKTe1a83P0wBCaJQM/9ISWHFwmhwfCHQC2W:Q2NQv9oVTe1a6vBCaqM/9wlwmhwfCwCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346815, "uuid": "aaec519f-20f4-401b-9e8b-e5cd6a61ff04", "value": 144778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346815, "uuid": "a63d3056-c231-4491-a136-2c5fcd583049", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346815, "uuid": "af52329d-743b-4ebe-a15f-0ff95519fc63", "value": "a5ac818d59cf28e52fe01c4cd6dad19c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7809d36b-e2b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682348736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348736, "uuid": "1385332b-fa13-4dac-8cae-468cc085918e", "comment": "Malware payload (Mirai)", "value": "5288cad6567fba7ba3d4a8e0fb8d2eaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348736, "uuid": "837bb6c2-fe4a-4a51-80a1-9b08b23b8a64", "comment": "Malware payload (Mirai)", "value": "b795b72ab1a22d70707a8e18907b1c34f5d90c0565bd299182634ffc8ca4bbc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348736, "uuid": "bf14d4e7-65ba-49ae-a231-b61da4576032", "comment": "Malware payload (Mirai)", "value": "5ef3d0d9aa80341cf5d24fda5721b93887a2f40e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348736, "uuid": "0990fa0d-5483-46ab-9af3-124636e2ca5a", "comment": "Malware payload (Mirai)", "value": "4c056e3b85bc3fedde7924828afc76f5d6f580327048baf3087a954f32afe461945f3d07489ce2c3918bf62e422f6c8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348736, "uuid": "902e8cbf-9f25-47c2-a58f-9acfba7d97d8", "value": "T192731A377B130E53C0CA14B255E30730ABF5C20A2CBE5A97BD91AD987F16AC436167E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348736, "uuid": "e71e5ed4-7a5f-4f43-824b-f13dde652d1a", "value": "768:OC4yF79Ru6MrbF8x/QoO+d5V6Ma1PgiA1t1Ei+CqEzaKUvGI6UD9TX3r2STvK7Oj:g+mRbSNZd5gstDaZvGUDJ5TvK7OnqQ2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682348736, "uuid": "80bda18d-7537-4aca-8d59-276eef8636de", "value": 78562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682348736, "uuid": "8019fee5-4dda-43be-9fbd-93f84883d93e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348736, "uuid": "6c6b82ef-9e3e-457b-8f11-072875e742ae", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58842b1c-e2b9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682352120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352120, "uuid": "3527ea44-a0e0-48e7-ae8e-1f21881aeaf8", "comment": "Malware payload (Smoke Loader)", "value": "0d16b13ba328db7a22b0243804b4bd98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352120, "uuid": "f3f013bf-0c60-4f0e-bfaa-e1245e4f52f8", "comment": "Malware payload (Smoke Loader)", "value": "b8575c68058ec0f8ad9be38e9ddd88937fa7099fe216c6598777cfbcd240cacb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352120, "uuid": "e0b8fba0-2726-4191-8a7f-f8ee807c8a21", "comment": "Malware payload (Smoke Loader)", "value": "ce3ac1789f41af233a285ad6488c4aacfc93fb20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352120, "uuid": "046a1474-67c9-4f5c-abe9-459f5f137393", "comment": "Malware payload (Smoke Loader)", "value": "5555453497e25fb6d183f4d2d7566899d6e1652e90ba40f32ade53303a468f62ce06dd3ec0fd106ce0113f731e0e7a33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352120, "uuid": "5f46ea7c-cb43-4c01-926d-a3c1d021b8d6", "value": "T1D4646C9292E03D37E66696728E2EC6F43B1EF4538F1536DB26588A3F0A301F1D272345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352120, "uuid": "fbf9e28f-8d57-4bc9-8a94-8cf84e05b1f7", "value": "c263ea9fa71edd34b56a166511864643", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352120, "uuid": "c10d09b6-c0f0-489a-b95b-f0f8af625b2c", "value": "6144:XsbQ5PQ1RmimMlFjqdw1yACGG2sUK+oRZtpBTV:XsbOimiTFIwM52sUK+gPpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682352120, "uuid": "8d0e6eef-ce73-4a0b-91f1-c6f2579ffa19", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682352120, "uuid": "d2275574-43ff-4fd3-a9d4-79873b82517e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352120, "uuid": "9331445f-7b25-4873-94db-337a0717c68c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e3c82c-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303206, "uuid": "2cb6c489-5f01-4e0d-8abd-2528c4c40de8", "comment": "Malware payload", "value": "4cf944d495af684d93c14aa61710e898", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303206, "uuid": "f95946a4-9553-4e65-a005-3820340bf4f9", "comment": "Malware payload", "value": "b863bc2781ab7112b5cf4acff28aa2e429e2c3e2be79afc042a7bdd2e7f79cf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303206, "uuid": "5f6f1bcd-d70f-42b6-9f6a-adec5f2296d5", "comment": "Malware payload", "value": "a6d28481761f614cba598683f83af7aada91c2f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303206, "uuid": "f0a9482e-281a-4959-b54d-272d6ae6436a", "comment": "Malware payload", "value": "bd8c371c3176495f7a66bb7c0320d67803cf104ff91a98f50cd924ce63f7d00184a20b5823a90ee745698fa62522fd6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303206, "uuid": "ea169da5-8aa0-4210-8594-d98d9c7ee9f9", "value": "T1F5D47D13B5F16020FAA336F45FEED719573E7938127AE74F5E840E5A32609209E35B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303206, "uuid": "9c19194b-b0d2-4726-8440-6c60b1598e83", "value": "6144:eR2WZ3iDn1zD4dYZnp9rwrlUHETV/0YfBdAgV+pqtIUm/jhMRXbm7N:eRZyD1zD4dyUrlmExH3Vqqt4aRbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303206, "uuid": "90df1e5c-b289-4fc8-bd54-39820b9f4543", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303206, "uuid": "5295ceb6-3243-4c24-9f9e-4a30eb4a8742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303206, "uuid": "01f5b888-4af0-4068-af51-3241774269a3", "value": "SecuriteInfo.com.W32.Agen.JSAV-4966.14353.7502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e580e7ee-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682323150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323150, "uuid": "9260f31a-e176-4587-8fde-6bc508c32a02", "comment": "Malware payload (Formbook)", "value": "23cc9424daf0f44ea912e77ce8302447", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323150, "uuid": "5ff839e2-e2d2-47d2-bf89-aa2b798849d6", "comment": "Malware payload (Formbook)", "value": "b87fa8da6f775f13b1d72b19c0b107e87f875f71a69426ec24b61d7fb98929ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323150, "uuid": "42b6e28a-5838-47d3-8a5a-c459e6935649", "comment": "Malware payload (Formbook)", "value": "0e41e5f6f6da3e85747fe57c3243e4f74c8ca8bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323150, "uuid": "73c4f1f8-ae24-4105-8294-0e340ce1e5a6", "comment": "Malware payload (Formbook)", "value": "82460e6e5c55087f31aaa6466e87a2beee913968da7f3f845165a4aa37bac03baa3bc58ee515deefb78f3b85823bdab8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323150, "uuid": "df54def7-7fcc-431e-b7d2-89c31b534a80", "value": "T1A004AE32DA42C431F2B252B5B2BD1B7B883D0E353295A4E9A3F115E06EA19D5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323150, "uuid": "c8460786-6cbb-47bc-8363-6c411fc87785", "value": "3072:sGcUkxSHP3Er83AYT8NGSYW67OycHpITU+ucNRPvCwlUKw:sysyAq6x6KycJUucNRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323150, "uuid": "0607c7f6-d034-4655-a3db-5933a717d264", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323150, "uuid": "5ff8b83d-9e7a-4eb8-bc6a-c8ea35829aaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323150, "uuid": "a22c54a3-d8c1-4957-b60e-a81b8c184f7d", "value": "b87fa8da6f775f13b1d72b19c0b107e87f875f71a69426ec24b61d7fb98929ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765508e4-e2ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682346586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346586, "uuid": "eedf460d-8491-47a3-88e1-c1e8efafe4b1", "comment": "Malware payload (Formbook)", "value": "2cd8b419585b5cf53b8429fa7f91f48f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346586, "uuid": "4eec308a-455d-4134-84bc-94fda637d3c1", "comment": "Malware payload (Formbook)", "value": "b88e57d5a5c71c13a67297b142cc0dd27476810a02ebb2948d0a4a08068473fc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346586, "uuid": "956831ca-9aa1-46e1-a945-5169c9d40917", "comment": "Malware payload (Formbook)", "value": "a0059fd5f0b5c18f92eba916f8b23636acce0f22", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346586, "uuid": "04d73ad2-12bf-4bac-b909-7b3b952e0df6", "comment": "Malware payload (Formbook)", "value": "ad8f28ac3a6290c4d75aeefb9d081190b874b6845085f02f765e299b741a661b46885462f087655b0195dece06bb96ae", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346586, "uuid": "17cdc984-1e5a-43a1-9d76-ce84d5714c83", "value": "T178D25B1D978F02A58F0653B7932A1E8442BDB67EB71151B2345C933533EEC3D822A6BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346586, "uuid": "fc74443e-5c6a-411d-929a-8a0259207695", "value": "384:IL0AbZSFEiWrqYgal1WxA8M8w4Xmg9i65DT7s4WdKM2veKs9xUFq89MV5DpBaWuA:IwAbZS+wYDEx5MH4XN9pVWjrKZk8GH/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346586, "uuid": "ea7ee99f-0378-4c9c-b52b-939631ab4b8f", "value": 30820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346586, "uuid": "417b065d-5ff0-4d48-a396-4faf5f04b234", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346586, "uuid": "d7fba32c-e723-4499-b8a1-50d608db9372", "value": "swift copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04eed4e-e292-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682335570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682335570, "uuid": "de4716f2-2a4e-4473-89a1-0d52ee468562", "comment": "Malware payload (AgentTesla)", "value": "18be9d9afb0c63ed7f73dfdb82f8956e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682335570, "uuid": "02db81ad-8e74-46d2-a2f7-bfbcc1083550", "comment": "Malware payload (AgentTesla)", "value": "b98c9ae6f9b97f2e9e1dc513d7de2a0b93ed2f8640129fcca8eb83e50f7c1379", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682335570, "uuid": "579127b0-3f4f-4dc5-82e5-bc2d161ecb01", "comment": "Malware payload (AgentTesla)", "value": "e0d9206cb8d945e6fd2978019646e681a4aab050", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682335570, "uuid": "272f92ab-b2f9-4e45-8ab8-6723118deff2", "comment": "Malware payload (AgentTesla)", "value": "1d4efae01ea2d94008100fa3a7899335af7771bd44d0f04a1943fc28f33dbdfdc834b3a2c803d290f7fac81dd50709cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682335570, "uuid": "90936e3c-e877-4de9-9a07-ac44bd67d46f", "value": "T12945D055BECA6EA1EFBF42B78360E53D1126736E03A15ACF6603059D3961FC2443EA07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682335570, "uuid": "cd77ab7c-607c-48dc-be54-1eb525b48900", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682335570, "uuid": "d9c5174c-de09-4bf6-a6d7-ff74e5874939", "value": "24576:bx7PkX1WFxqwKYg5FDTScTKJyq7EGQa8eZeM:bVFxXLgvTJWEGQ0Ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682335570, "uuid": "3710ab5d-fc30-46ed-b453-e1faf31e95c6", "value": 1256448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682335570, "uuid": "9cfa7009-bbeb-4957-81db-0a48b7f1fb93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682335570, "uuid": "d7718c83-6603-48f8-b4b0-e6a9565e0526", "value": "INV736103251059.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900aa780-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303250, "uuid": "c39f115e-0bca-43f6-985e-f81b610a489f", "comment": "Malware payload", "value": "dbaa41dbc4f47dadf894226f3652acf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303250, "uuid": "145e5609-554a-4ae8-a4ce-9f6dc869384b", "comment": "Malware payload", "value": "baaa62fe5bc252ffdd4bde176857fb8bf356677d3bb4b992b168fb8f12ac0099", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303250, "uuid": "db1517bb-d091-4a66-bed3-ee52e65c0b33", "comment": "Malware payload", "value": "26040949039dc74ca2fce87fb404d5065b2dfca9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303250, "uuid": "f3ec45d9-46d5-4d24-bf78-d57fbaa26a37", "comment": "Malware payload", "value": "5a6169deff3d58daaf9d249ff4d611306001ea052c7ed8abc5dba90ed8b5dda3b2bb7bfde31e509beb16972a7d50cdcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303250, "uuid": "e01d4f0b-2a98-4be3-90b3-351540eafbb8", "value": "T1E1A2C0BBB2981B61C6A11272416BDAD011AF25725FDED7A500213B6FFC32374AE1D9C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303250, "uuid": "2607abf7-9880-416a-9f3d-73b101490f30", "value": "5b06dfd481a9697fb0c7efa862e6215e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303250, "uuid": "b172c982-eea1-473e-8017-c049c91e8255", "value": "384:RW2G+GG/qUsHNLmwszJ0Mft6AgBBJijIjuZCIxvIVwMHrRjz0Ha3:cx+x/qUstGJNft9gj6/Ux063", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303250, "uuid": "c00d9962-f779-4ce2-aed8-592ba789348c", "value": 22338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303250, "uuid": "4a1bd5ee-a6a8-4906-ab81-a1b090c2cc53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303250, "uuid": "d153342d-a0ae-42e0-94ed-98da04d04977", "value": "SecuriteInfo.com.Trojan.Generic.2568077.10129.19734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3c142a-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682346923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346923, "uuid": "57a57a90-4523-4b82-9331-f906b5db2a9e", "comment": "Malware payload (AgentTesla)", "value": "cd60a81d712e4f278be1650bc5d8b5bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346923, "uuid": "71ff2103-0044-4551-a594-d33440519c76", "comment": "Malware payload (AgentTesla)", "value": "baecc5ff2030bae2c7bbefd317d15f0a0c9934e3366993f78f920918b6fa675b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346923, "uuid": "74842a0e-8b44-456d-8580-6b5ba4ad9cb5", "comment": "Malware payload (AgentTesla)", "value": "f049a6b0c4ea73a0ff10aa8a2469b9782a0d51b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346923, "uuid": "458b5468-6041-4ab5-b52d-957b755dc51a", "comment": "Malware payload (AgentTesla)", "value": "8da8240aa329858d6793ac5d85c031f4ebc00cff6f19895648338e85fbd95c97318e98dd26cb9b12eab18319e29591fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346923, "uuid": "043241a9-29fc-4107-a77a-05e6c00e1437", "value": "T1DAE4E124F21D2DA7E687A4F1095AA3172A0973CB6E7C65946B7EB1E125733CF1B84C03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346923, "uuid": "25a5ce4a-0f00-4e2f-b2ae-4bf36cfe4d59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346923, "uuid": "f3b6efae-f0c7-46f6-b03b-016827eb63b7", "value": "12288:2gjjPkCS32h/800n4H6IHdVhyOdwO3IpKvOTSMz2AYZZ3WObvUEnzKIJTIFPSew5:2gjjPkCSGhE056ayCGLZbOmOwEnmSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346923, "uuid": "acef2c8d-8ed0-4c70-9145-2a81eabf026f", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346923, "uuid": "a9539e59-b3a0-4a08-bdbf-0a7d32cf8a77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346923, "uuid": "b2e7efae-feca-4837-a894-cfb390c6b285", "value": "cd60a81d712e4f278be1650bc5d8b5bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6abb5a21-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330246, "uuid": "860e3fc9-41dd-40ec-86f1-a4c374fa984c", "comment": "Malware payload", "value": "35486af6a5cfc098d3f024079b573a02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330246, "uuid": "93ea15da-89d9-42aa-8dc2-e9d3ab8d01d7", "comment": "Malware payload", "value": "bb9a16632ae94bbfae713f56c51dc5d2ff6199ccd051e2285ea90c6dfeb5d4b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330246, "uuid": "8a93160d-c2fe-4b4b-83f3-0aa31d134282", "comment": "Malware payload", "value": "95aa6742b4cd3efe3e1eb6264f351a142f014389", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330246, "uuid": "91ed0de0-ae07-4bfd-9616-997b1fad759f", "comment": "Malware payload", "value": "3c9597064ad2f5ee071e56dd73a2597e13687cad05c2248971c729f4ee9f5aa1c49a196fbcbcdb75e316a6c28992c2aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330246, "uuid": "9a692e51-d4c1-4b01-b425-2ae1b8905616", "value": "T14636CF5F609097BEC20A9232C1FE5B34D53371A24467C72E5AC1E2F16A95D608F7EBB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330246, "uuid": "730ec1a3-954c-44c8-92f5-e6c99e8fbdee", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330246, "uuid": "74af74db-92d2-4f5c-95d6-c612bdda04b9", "value": "49152:7Q/hNQGEaNUdcZ3LZDcpb3rwNHPb+P0dTKUsu2kRMMkS0DhDItfUZqv90wqq5Fcx:c/lemSZhmAqF0wqoco7G8y7yM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330246, "uuid": "fc2f5339-9f49-4376-a132-cba67d479400", "value": 5091240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330246, "uuid": "b00d753c-7e0f-4dbd-bc10-0c2a0de68f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330246, "uuid": "60a9b087-bfb5-456e-bef4-d8a3b0643512", "value": "bb9a16632ae94bbfae713f56c51dc5d2ff6199ccd051e2285ea90c6dfeb5d4b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca08c2f-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333497, "uuid": "eeefea0f-6cdf-4313-811d-b0ce42b8f1b4", "comment": "Malware payload (Mirai)", "value": "7698ba14ef40666a899d4b75fc3282fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333497, "uuid": "fe7c5f5a-ff9e-4a29-9772-0f62ce8ffc0e", "comment": "Malware payload (Mirai)", "value": "bbbcd9502dfc589086d19828774e70328e31f567b9f4611c9a01943b48abf8b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333497, "uuid": "b4eec7ce-c26a-4b0a-9d8d-0ebf9e1aefa7", "comment": "Malware payload (Mirai)", "value": "d6fbfddd05281a447dc98ad8845da2f162762564", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333497, "uuid": "c3ed22ed-9f87-42dc-b0cc-fc20ee5cff14", "comment": "Malware payload (Mirai)", "value": "a0a50087917eca4de83716d1b421cb69974dad34ab0ae8c536a9ff3b821157a6cc695c553f7efba344c5d56447d2bd2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333497, "uuid": "ec4a5123-bcb1-47c0-bc1c-7894e21f3fd0", "value": "T15363A506BF214FF7DCAFDD3749A91B05258C640B21A97B397E34D828F64A24F19E3861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333497, "uuid": "3d5ebbff-25e7-40d4-8cd1-4edf0c184ff2", "value": "768:QHB0JIEYlDYhHnfwqsFDwLX3U6ngBhN6PNUpGXS5SyeweVKe0n3oNWpkmPqXitMF:QHB0JVYl1FwwjhwPTXSNxIKzn6CpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333497, "uuid": "3d14f2e8-5c76-4e0b-8473-cdac85bf714d", "value": 71528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333497, "uuid": "084bc1c0-b9ff-4bc6-9660-77c6873afcf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333497, "uuid": "de6e28b5-eb18-4eea-ae02-313931f25b69", "value": "7698ba14ef40666a899d4b75fc3282fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e4beb3-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682323153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323153, "uuid": "8bd4cc17-8d54-45bc-88f7-0ed02c735073", "comment": "Malware payload (Loki)", "value": "29561dfe6a23568553f23966d1fcaa51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323153, "uuid": "73772193-c598-4f89-bc3f-b97030b9a683", "comment": "Malware payload (Loki)", "value": "bcb0712f7ce3fc39215bdd3af15404022cd58c0dd5ccb827590b8f34c9accacc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323153, "uuid": "26cb9583-ab5d-4403-bc0c-3b5167d9cdb4", "comment": "Malware payload (Loki)", "value": "f491a46e836c1a6887852334af4c6e89280493af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323153, "uuid": "9062f815-2766-4096-9a04-80363b54c96a", "comment": "Malware payload (Loki)", "value": "f03bb007da98156731b59d942cd56c9b4a713e0d1116f6efec16fd538495436afaf638156dacf6738503b7d2aee6b062", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323153, "uuid": "25559a7a-c6fd-4d8a-b176-d16dff2b3868", "value": "T187A31942B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323153, "uuid": "ce24bf81-d2cc-4850-b0eb-388b66d5a169", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323153, "uuid": "e9955603-e2ff-4edf-952c-22a7fae64d4c", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323153, "uuid": "1938c85e-0ae9-426c-9baf-48da7d59b92d", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323153, "uuid": "dfdaa3cf-524d-499c-b7c5-8623a6e68da5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323153, "uuid": "7f289677-f18a-476b-954c-b774ab0228c9", "value": "bcb0712f7ce3fc39215bdd3af15404022cd58c0dd5ccb827590b8f34c9accacc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0725f7d-e2fa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1682380211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380211, "uuid": "2c419853-4dd7-4907-aca2-38ef83c2622d", "comment": "Malware payload (STRRAT)", "value": "1770e031366e2d91415fa1a1d902814a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380211, "uuid": "c60e46fa-ee80-4e76-90a6-78790cae9041", "comment": "Malware payload (STRRAT)", "value": "bdb39f75a5b8e2cc95b68a96e5bcf4660449dfb1523a8d00dbf9444206acae02", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380211, "uuid": "7d3a0235-8da2-4a20-9e0e-e98302e90a7d", "comment": "Malware payload (STRRAT)", "value": "ef37063f282a2e6d70c9800b20dc45889c3fa90c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380211, "uuid": "7fd46266-9ad5-47b2-9bd4-f9c40ee5e5b5", "comment": "Malware payload (STRRAT)", "value": "b71c438516cca4276c6f90efa88a9bedc6df4eddbc1e1ffe21086374e916ecbde65d45e6ce07c1d4f42d6a00d4b42f0c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380211, "uuid": "671bb693-d031-4728-b436-d549b9077744", "value": "T16D63027FBDC6C0ECEA2BCAF737A4F545B94490C7A0F3E52F1918489719509880BC6D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380211, "uuid": "7490d301-3a36-4870-8536-9d9a6006221b", "value": "1536:DSpNvzfcN5YRlN1qhlV0EwVW948MrlDzOyJgtMNNp7FFbKL6aw62ZLsY+azgR4Wi:kvzUYh+Zo5lDSSC6f7d64+34zZEskc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682380211, "uuid": "cd70438d-c53c-4fe1-a54a-2a89f4da60aa", "value": 72302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682380211, "uuid": "02333418-942f-4f0c-9aec-b1055ab37e70", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380211, "uuid": "5bf5d014-9b5d-4dc8-bce0-720ffc2c3c17", "value": "Quotation-List-Copy.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e087da2-e28b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682332345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332345, "uuid": "c2f3638a-1c12-4e62-a990-65da35de4e18", "comment": "Malware payload (Mirai)", "value": "d54d3c236f10242d20c5df705d410417", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332345, "uuid": "5ce80487-0335-42f4-a398-f5353746c643", "comment": "Malware payload (Mirai)", "value": "be750a9fa61542478d8388537801562e0fffac1aa9bdd4f731ce354c050700ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332345, "uuid": "81e91801-235b-433a-9122-fca84f95bf1d", "comment": "Malware payload (Mirai)", "value": "9515154886888b7d48f644659048e6ee8791d6e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332345, "uuid": "274b5396-ecef-4f50-a9f3-22e862948aef", "comment": "Malware payload (Mirai)", "value": "8c9ee16befc74a12a034db20935d3ed5debdf3d2a889e316b049ccba0fa8444fc3340afab096d6f6d7bddd6e8b6fa38b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332345, "uuid": "36b625ff-b914-449b-aea0-b70c758aedf0", "value": "T151E2E0EEE4C47896CFFF6C3D614C0464EE67205A122FDB9653718948AA6E01AF8CD43D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332345, "uuid": "3c218adc-78b2-4075-a0cc-55a74820ce51", "value": "768:yfpWceh8mAHq2tkD6pcKBQ7hy9t24a3TWW:yfkczHqqkurd9w4a3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682332345, "uuid": "c4974f2e-cad9-4c63-b7bf-ff21d8d9633d", "value": 31968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682332345, "uuid": "1c9e2e52-2330-4caa-916f-3fec93754c13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332345, "uuid": "953d9337-8a02-4ad0-9648-9f3eed9152cd", "value": "d54d3c236f10242d20c5df705d410417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e7abcc-e284-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682329305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329305, "uuid": "07606dd1-ba47-4d45-ba21-16e6805b204b", "comment": "Malware payload (Mirai)", "value": "45cd658533769fcef932e1c37e721e26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329305, "uuid": "fef6c04c-6460-46df-840e-0228cf8929ca", "comment": "Malware payload (Mirai)", "value": "bf567db59b214df7f9a2d89d687c3ac650c967123927a7d193dd640e39fdbdb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329305, "uuid": "6dd6d3a8-2690-4fad-a466-47c93bd7eae9", "comment": "Malware payload (Mirai)", "value": "51e2f8a480e7ba9a07067647f8a47368c5cc5e5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329305, "uuid": "213becd2-8c60-48fa-9e02-b28270338d75", "comment": "Malware payload (Mirai)", "value": "8242681bcd44d68aff1c6738198f256402fdba2e554339ac4450fdd2c687206d54b1f4a8df6e4c195d1df0785f96968b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329305, "uuid": "c92ed206-6cdc-4305-ab9e-655cc331448e", "value": "T1072319C47583F9F9EC15457C307A9B729EB7F43A703AEDABC398A4239805601A6072DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329305, "uuid": "029def04-6d63-44d5-8155-61f6ed1da161", "value": "1536:ORU4/jdgjlSbc+PCtdesNCqBNM7vk9Yn/SP1Hoa:ijdaOc+PCtdeECqvsvk9sStHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682329305, "uuid": "8f06e80a-cae9-48bf-9e19-1c689d10f5aa", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682329305, "uuid": "db7627a4-e031-4ec7-a431-506c1bd7f474", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329305, "uuid": "0f944dd3-bf1c-4204-b886-94422e37bc49", "value": "Josho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee4dcb5-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303248, "uuid": "f2187192-bad9-4bf2-bcf6-5a87eeff3313", "comment": "Malware payload", "value": "9bdad09fc8d6e11f020942e716399e31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303248, "uuid": "16dc6c8a-c8f0-4120-8d10-1da9bdace750", "comment": "Malware payload", "value": "bf7e206ed604d9530e8e3499a0c2210ff5523cebaa8391dc41ca2bbfd93163c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303248, "uuid": "b2671b18-2f72-4e4c-b378-aad95aac04ed", "comment": "Malware payload", "value": "d57f536a37a619d6d9a5e597741ae5279e640397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303248, "uuid": "d2c0ff1d-ffb6-4834-9c12-1a9184229b8c", "comment": "Malware payload", "value": "6e0d883d5d1fad535558cbaba9d9cec9eb64a94526556afda10eca13fbd5ec78561c31d2f085e82809e4a599806c2c5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303248, "uuid": "77d8d8d2-a884-4363-b92f-192455c00451", "value": "T139F2E17B7A80CC67C690627B2A0FD5E64214BCA16359D257B6FFBD6F2C3127001BC586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303248, "uuid": "b211d7cb-1c70-4149-98b7-3b6ba73a7755", "value": "db671296b43af2623bb9b9a14fe58b79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303248, "uuid": "c8a36861-39a9-43ac-8116-1ebd6c8ff33c", "value": "768:W6XyoATSI5xvVwYrRyLmsPbt+z6SO+Tjdatyf1ZS3E:WUA+Ea+yLmsDt+nO+TI4f1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303248, "uuid": "9219ed41-306d-4a62-844c-9fba3f3ccce6", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303248, "uuid": "7eb20030-1b35-404e-a688-674d0cbdee0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303248, "uuid": "dc855d15-74c7-46a9-a1a3-507b2a366543", "value": "SecuriteInfo.com.Virus.Win32.Delf.25613.8642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198f04a1-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682346860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346860, "uuid": "b9dad7b7-b223-4fad-87dd-0e5c5e062462", "comment": "Malware payload (Gafgyt)", "value": "d497bdbf72d14cd0ea0d06dbed8bd7ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346860, "uuid": "6edf3e8a-55de-4d83-9161-44f067fc1801", "comment": "Malware payload (Gafgyt)", "value": "bf94d633295932d03c3a97f36ffc1db9e195b36dbe12711500ce7e42d15ddbd6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346860, "uuid": "03c9f09c-0598-415a-9efb-2f6cd6e6515f", "comment": "Malware payload (Gafgyt)", "value": "5a6e06c616177395c21a373d52768eeeb82e0423", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346860, "uuid": "75bfd275-81f5-4508-9741-efb0fd07ac50", "comment": "Malware payload (Gafgyt)", "value": "63e955bcede4ef78ff6d92831d5cb3d581f1074033785da043825e0a45c170e31c1dbccb1efa476959377b24b2347c14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346860, "uuid": "c0c9b0aa-7a01-4136-ac7e-617ddd737984", "value": "T1C3933B41F9418B17C2C327BAFBDF439D37366A5897D7330169297EB42BC67891E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346860, "uuid": "2315fd6b-4ded-46a2-9135-fd5b8b0a1e95", "value": "1536:HzDBmIByJZIlhOPx5O8vQTsGYP+CvZUOStVNXLqZ1mkgmQAE+dAXDfj:H1BSZPjQkBZUO2WLmkgmQAEUAXDfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346860, "uuid": "4c5af6da-fb53-43fa-9493-145237711694", "value": 91819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346860, "uuid": "3edcba66-63a9-47a3-ae9c-b5748750d0cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346860, "uuid": "c445845a-a0f4-40ec-9c62-125e192dfced", "value": "d497bdbf72d14cd0ea0d06dbed8bd7ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83037fb4-e233-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682294638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294638, "uuid": "c6104bab-97ab-4b08-9613-fab1aba92267", "comment": "Malware payload (Amadey)", "value": "6d1ae6320b06afb69e8a7128ad24463b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294638, "uuid": "627936f8-e358-4746-8897-9fc4c3781789", "comment": "Malware payload (Amadey)", "value": "c0226b29571a306b6b019dff687da0cd44d8cdf59e1fb0960a88dcf6203a7550", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294638, "uuid": "4eb16a24-c089-4b78-a26e-797a2dc83ee4", "comment": "Malware payload (Amadey)", "value": "bb3fb8c6ffd8bfcda0b6649bfa4a34be91827f0d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294638, "uuid": "0febff05-4a2f-45e3-87e5-9d92900c610d", "comment": "Malware payload (Amadey)", "value": "7bdf3d389b59c75e6bf8dc3c1d5663fa1c8d2c032227b31552efa0010d19792e8130acdd98758f03ca5d995e6a053a24", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294638, "uuid": "d517146d-89e4-4aa0-8f94-83d13c83be36", "value": "T17C152302A7ED6233CDB6537048F651D31B36BC524A3A43A3368567DE48B3AC0BA35767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294638, "uuid": "386b7279-28e9-4cee-ae7e-d7df4651252d", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294638, "uuid": "15d83075-f12b-496b-a03f-6f792f34a79d", "value": "24576:TyNUZgIuvuawOIw1Fl27Ib9jkjB4R0IWI8egymp+:mi7a5FLdb0IWpf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682294638, "uuid": "21c7d37f-c259-4582-96d6-ee5d02d958e8", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682294638, "uuid": "50aa760c-7e1e-47d6-9db2-51a1d261770e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294638, "uuid": "3c457bbc-04e0-44e4-8885-db8cf0b0c087", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e50e797-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303247, "uuid": "e3af7b0f-4466-4977-bebf-ec55fc0ffc1f", "comment": "Malware payload", "value": "791b0118347e3a946dd89d04e0509f17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303247, "uuid": "59b96c3b-f65a-4eec-baee-0e9e733a4052", "comment": "Malware payload", "value": "c04206a0d50b6569bcc5c236e335f6f2dccf0f4e0595fd3cb33c2bd1f4f9c97d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303247, "uuid": "0a7c27d3-73b8-4386-a67f-4ee7d7b2d295", "comment": "Malware payload", "value": "25cd0341a692755d8e4b4431f2ea4e0e9345f29f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303247, "uuid": "869765e8-c520-4895-9e79-071e71ad189b", "comment": "Malware payload", "value": "6ab4d0b14a7a6afe3cfdb3e9f59ec0fb08c74136ca61a4eec8231c2c208ac0b6fcf9cd01bf293c09b101a93797c0eee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303247, "uuid": "d34a2f08-8c2a-4bfb-aed0-29220e828581", "value": "T1F65412F9E8A6A6D0FDE8093E094ADFB33610F092E52B154360FDCE1BB5ED1853111E99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303247, "uuid": "9e1a5473-d29a-4acc-b8e4-5b4090ab5b53", "value": "2f5cd8feae4d0bac4e4339b85c7d4f4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303247, "uuid": "af38dd2c-57d5-4b66-b13c-458f6614c57d", "value": "6144:Zfw+DLLqH3dnqhfN4B0MxQzOZLh9YNabXupuKF32MrUftk:ZfZDLmHNgfN4TQzuh2NQKF32Mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303247, "uuid": "6837a42f-4714-45a2-a466-69d2f3c9a3a8", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303247, "uuid": "969cb19d-c8cd-46ec-8bb4-6bc21c197389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303247, "uuid": "85fe8fbf-6826-4c11-b406-b383164a5076", "value": "SecuriteInfo.com.Trojan.Generic.7690342.5688.26364", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75fabf61-e29d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1682340143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340143, "uuid": "ec8759eb-adc7-450d-a383-450eedf3350a", "comment": "Malware payload (Quakbot)", "value": "77079f381ac044ad7a3df18607657f74", "object_relation": "md5", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340143, "uuid": "173e9279-e7a3-4926-8c32-5d27fe109874", "comment": "Malware payload (Quakbot)", "value": "c1a4c4ed2d090893c08c4fc701008215a17e517e86a912936f9687399d9e6da9", "object_relation": "sha256", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340143, "uuid": "286bf48d-14a2-48b9-9949-4c03b2de9fc0", "comment": "Malware payload (Quakbot)", "value": "36f6f608a1e4d944980f76ffa6b8218c3cfad475", "object_relation": "sha1", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340143, "uuid": "6162810f-0b36-4a58-92ef-2124122f7320", "comment": "Malware payload (Quakbot)", "value": "88291775403a42a5b13cc655dfe9dfe2025e02cf2d6b420a3b738af87fb57a2cc0762ef96aa67b81935694d6c310a423", "object_relation": "sha3-384", "Tag": [ { "name": "1682330454", "colour": "#47960F", "exportable": true, "hide_tag": false }, { "name": "BB25", "colour": "#01D459", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682340143, "uuid": "700d8244-0cf2-4b1e-b64a-9e84d5d779fb", "value": "T15AD58C21B287C136D56D0172A92CEE6F5139BF730B3150EBBBE83A6E58B48C15631F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682340143, "uuid": "5be044a9-d8c7-4796-a0d7-81fd38c85da0", "value": "49152:6jchOOTLCTFQq5iNZ40S5WPvwaqI/nREYVoB5JSHawN79:nrTLmqpN/nREYKdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682340143, "uuid": "721ec762-c8a1-4a06-9717-b0ae146720ed", "value": 2968940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682340143, "uuid": "5b75a29e-4f3f-4c58-9eaf-db5d7e179a25", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682340143, "uuid": "a7728160-f82f-4dc0-ab93-a22e4c595d34", "value": "Neque.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e20b841-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330251, "uuid": "c7d587d2-793d-4550-a256-36473f32713b", "comment": "Malware payload", "value": "dafbaa8851355784a9a2de8141aa8ee6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330251, "uuid": "65a342b4-71b4-49cc-9184-a515451423f9", "comment": "Malware payload", "value": "c1dafead343c67d203d2fa9050967fea868fc517f8d66b23cc166642d8b7985b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330251, "uuid": "c0f3f45c-be62-4794-b0e9-db471a74a426", "comment": "Malware payload", "value": "347de1e845d61e0fb6b1a989f47acc75bcd02d86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330251, "uuid": "7514ecee-fa56-4999-8ddb-0019a9ecfc7d", "comment": "Malware payload", "value": "90473b75987843c8a7aa6221126fc8f48b822351c78f3551b42135e6ed4fcc912a9e85ec8c1d71e1b616cdc508ea57fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330251, "uuid": "a4b4ed60-c017-40c7-97f1-94d7474a7f01", "value": "T1C036CFDFA4046A38C129E271C08F9732C837F3951B37C35A8A90D9626F9D5B44F9FA61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330251, "uuid": "8642bbaf-7697-4ae6-9b83-414442eba980", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330251, "uuid": "23f542f7-9371-4046-8901-dedf217ff700", "value": "49152:Poxh6VGeSoP8OsV7Nq1jmXnVe0YT1TRxgPYNJVIb83hUDdpxQnjoFdziTxaydfaL:AhyAidgAzV+8KJgjmdziTxTw3B4ti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330251, "uuid": "970f22f0-f8bb-496a-a185-c4cbaa68325f", "value": 5085696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330251, "uuid": "2846a081-a547-46e7-8892-061b1a8601f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330251, "uuid": "00c358f5-9d90-4a5a-aa6b-8b1e11004f85", "value": "c1dafead343c67d203d2fa9050967fea868fc517f8d66b23cc166642d8b7985b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96976105-e235-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682295530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295530, "uuid": "91de951d-5e10-4c83-b015-607713746a1b", "comment": "Malware payload (Smoke Loader)", "value": "c46acde318e3274c991ea1d24e5970e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295530, "uuid": "4f21ed1c-1d1b-420a-bb21-373c174f7068", "comment": "Malware payload (Smoke Loader)", "value": "c220c5bed8632290d44b2e7ac2aaf9a53a1454d9d6db2a6bd7682d83ef5a07dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295530, "uuid": "0fa820d4-dd69-4236-bf54-642d05e6505b", "comment": "Malware payload (Smoke Loader)", "value": "aceffe98447f678271ab25bbf090347860fb0cf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295530, "uuid": "d95833cf-3478-459e-a436-eb0a5cd74f41", "comment": "Malware payload (Smoke Loader)", "value": "b22d4e48824057263badb5ea065179bdb664865d5ee997cd6ed0ffffa8420ffbc5ab1ce6f383d9b66047a3bbd01075fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295530, "uuid": "b0a73d70-12de-4679-8310-7f24c887d3ad", "value": "T18234D081BAD0C472D8578077C864DEB4AA7EFC205BA5869B73642B7F3D306C14B7A216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295530, "uuid": "5e31af6b-5450-4627-bddc-201f61645468", "value": "cbb199b85bd7e99e36eb212e7f14e32a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295530, "uuid": "db0df600-efd3-4bc8-8069-fbe9bcae2ada", "value": "3072:etuiYqz0gCeFT5xGzcHmGHDHwVqLXskg0tIu54QXP6Ge:0PYGCaCC7L/sKPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682295530, "uuid": "85929f8a-efd3-47f5-a655-6b9a06fe4c60", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682295530, "uuid": "e5ef8a0a-b2e8-4d2c-ad95-c75229040f50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295530, "uuid": "6cfba368-e628-473c-98a5-782735a678c0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63e6952-e28b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682332493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332493, "uuid": "f7d9c898-7928-4acc-ac29-c7cf5f4a4b93", "comment": "Malware payload", "value": "fd6c355b64052d7e9b9f7ad59f2cdf2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332493, "uuid": "becdc444-a4bf-4aa4-8156-08248de3b963", "comment": "Malware payload", "value": "c266477af0e1f86d0cf5700730033ae3896d325d5c7a74a81a2f4a34f3e59fbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332493, "uuid": "6d2a6e1d-52f7-40a1-8ad6-d9abc9bc3988", "comment": "Malware payload", "value": "73daa27878b7bbb38484851e5e885dcc6cd59e55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332493, "uuid": "085f767b-b252-419a-8155-8cfbada6eefc", "comment": "Malware payload", "value": "2d24e222a0be136a9c7472e9af1f901e3581086a826ed90775fed80e774b4392d4691a44565b77f7b5a607a42f606e47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332493, "uuid": "9984a009-1251-463f-8ed1-9bc341a093e7", "value": "T132936C01B5D1C472D67619361971DAB18E3EF9300F609E9B279806BA4F312C19F36EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332493, "uuid": "a39de64d-2ffd-4897-b8da-a064dcc3671a", "value": "dcd2bc944e2d8742d9b062adf15b0e52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332493, "uuid": "2aa2560f-a61f-4156-a78e-119e05dc0be4", "value": "1536:MLMEgm1AbRBy6UAM+Rm01YiRxvaFEbu7maSq2ZixCwoNCu6ylvGAVsWvWcdeodko:MLMbeUO01Yubu7m7qqixulvh3XefyCbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682332493, "uuid": "c748c445-9d5e-4785-82d8-1d101163174a", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682332493, "uuid": "fee50fb3-3c27-4255-a8f6-7cd1598b64b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332493, "uuid": "33ba9147-190b-44d2-b059-a8d9fb2a020a", "value": "SecuriteInfo.com.Trojan.GenericKD.66612839.1838.13105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3063d06b-e29b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682339167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339167, "uuid": "f1002896-1dd8-465a-818c-23cb054df816", "comment": "Malware payload (AgentTesla)", "value": "944e7cac44014cfab1244019a2b4197d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339167, "uuid": "819944a8-1539-4766-beaf-b2c11749836f", "comment": "Malware payload (AgentTesla)", "value": "c355864463b927059cc17bc8929f29afa9102b4bea8c84f5991cd2c494523a5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339167, "uuid": "e8b432c9-66ab-4702-bb08-9879579ea534", "comment": "Malware payload (AgentTesla)", "value": "74673d931f22afa43eb66d957e7a5b9c87bec527", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339167, "uuid": "dd02a7f9-1c6d-482e-9624-94245e7e15f8", "comment": "Malware payload (AgentTesla)", "value": "53bef2e19b7fce48af4d7c29b7950d8e6017d14ed814350040935a442531bba6d8ccbc6d884a894209c6bbf340b73f9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339167, "uuid": "879e2394-5e44-4b92-a1b7-721047f22c25", "value": "T13504394567C8C723E6BE1BB5657648750B7BAE76A8B2E74C6CC870F14A33380532127E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339167, "uuid": "cb9c6eb5-8a2b-414c-b68a-149ced2067d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339167, "uuid": "43c62b40-78c5-407d-972c-615fa520775a", "value": "1536:+rjlPCJE7I2S2QvqYj80mpVqOzhL1mvvvvvVd5QJAhuL/fN73g/Z5xCTnRTGn:QG1i1LAvvvvvjIAhu7fN7w1CbAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682339167, "uuid": "f1b008fc-c59a-4ec1-ac93-7d6749473359", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682339167, "uuid": "111d9225-c012-4170-a8ec-2f6a9eee02b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339167, "uuid": "4a750e7a-b326-4db0-b3ab-97023fb5d22b", "value": "Nuovo ordine.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b082fe-e2d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682362854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682362854, "uuid": "a032c808-af84-4a1f-a642-458adf30be74", "comment": "Malware payload (AgentTesla)", "value": "91c3f5ac7498a0b113a5a549b7aadbf3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682362854, "uuid": "c7015f4a-6ef8-44a7-9cc6-ee17ca29513d", "comment": "Malware payload (AgentTesla)", "value": "c3cf5c8a569686df882fc43e402047967a7c74b0274864ec28c007a3d36d9fca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682362854, "uuid": "8a91030f-54a5-4cc8-a329-8a86558dafbb", "comment": "Malware payload (AgentTesla)", "value": "d37d54cfb52e6816ee2d13de9de704becc6adb75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682362854, "uuid": "99f051d0-f5a7-43d7-a891-10a9e457e663", "comment": "Malware payload (AgentTesla)", "value": "4614fcb8fdacac6c4c200b4da7e28a07ea6c015c7cbe9f1b4c847c17dcd006b07917e48d0d864f22b20b9ebe766bc170", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682362854, "uuid": "7f46e11f-0e45-4493-8424-c58edf51641f", "value": "T1F9D426285A9C1BE6D039B3B8DE3A5411E7E3D417A361D9B87DEB00C81743E8226D177E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682362854, "uuid": "f9eea6d6-3fbb-4e7b-ad86-3fd21d28b4c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682362854, "uuid": "067054a8-fce9-41eb-90f2-21142f339183", "value": "6144:94vykQXp7E3eATTrR+2On7AD7IhYjBCqjd6ci7nEkc487ezJqlZVX+tu+yVG2lO7:qFw7y7Ih6BCqrynEizwln+yVGLMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682362854, "uuid": "91222099-979b-432c-a720-ca48a9d9eb05", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682362854, "uuid": "460a5194-5e24-4e78-b93f-7b80942bc55b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682362854, "uuid": "3a93073e-35d8-4fab-af9f-e17f67317929", "value": "DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bc6667-e29d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682339956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339956, "uuid": "95742c5a-4b23-4571-a0c3-5fc43c752a37", "comment": "Malware payload", "value": "0052724eecd37f62424bb3dc28314712", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339956, "uuid": "bdbdda7b-c170-4473-8f47-0b7bc7984fe7", "comment": "Malware payload", "value": "c3dbe530d4127ac29fa87f9d348f87daa74513bf3d086a9695508b0fded61937", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339956, "uuid": "9675c06f-ede8-4881-8d2e-d7f895d3386a", "comment": "Malware payload", "value": "5de00de63eb9bdc49fded774b67a1c169002b158", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339956, "uuid": "430a166c-71df-4475-a29f-e4a8ed8e17d7", "comment": "Malware payload", "value": "9dca61d46d5ade3623018d0478a3fc50e6797495c43b23daf1f3f642d69a214ea341c82a6798a16cab46b8a887d37076", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339956, "uuid": "a8adbc91-4b5b-447d-9f43-d0125cbba51a", "value": "T171951221F4963721F84ED5B005B01EB883F16D3623AB97C82239385FD66BE9D9B64C35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339956, "uuid": "eeae14aa-12c5-4864-8986-883a2b8d92f4", "value": "49152:vVgl9Fgy5Xt4Hk1bHM5fGGaocQAaYcFi4:vVgVgyq1GVoc72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682339956, "uuid": "bfc87659-6ce3-49e2-ae90-5030bd1d19b4", "value": 1969143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682339956, "uuid": "1c6d2355-38ce-405a-8ce3-094ee0bed95c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339956, "uuid": "bc9eb0de-6eb9-4a0e-8b62-7ff95132caaf", "value": "RPP-1270.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f3f958-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303235, "uuid": "e624a5d4-8aea-4491-ba90-dcb43a5f012d", "comment": "Malware payload", "value": "465cd4956c8671831ee2328906a3043a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303235, "uuid": "af3fee35-92b6-408c-b030-1e0ee6b852af", "comment": "Malware payload", "value": "c3f521ca1e8830a1cd5cb3ace29ce3c8a0d7a1b19d8229e0bb3730189df2f2d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303235, "uuid": "cfa5438a-a476-4e4b-942e-4bfdb545286a", "comment": "Malware payload", "value": "8366fa3bc88d8c844800c2ff707715dcddbe438d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303235, "uuid": "dab0ff3f-d8cf-46c4-8a44-b49e56d1240a", "comment": "Malware payload", "value": "13b418cf49bdd8a569351d2a5a80794fc2098aa37ba856173fd6a1652542c85a1254007c3c1e8e244940bef3552c20de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303235, "uuid": "1e38e862-aa96-4383-879d-c1b92a1b0c3a", "value": "T190D47D13B5F16020FAA336F45FEED719573E7938127AE74F5E840E5A32609209E35B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303235, "uuid": "440f51af-68d2-40c3-becc-ea834dd853db", "value": "6144:UR2WZ3iDn1zD4dYZnp9rwrlUHETV/0YfBdAgV+pqtIUm/jhMRXbm7N:URZyD1zD4dyUrlmExH3Vqqt4aRbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303235, "uuid": "755d33b2-b8df-48d6-a717-54adc87b14a3", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303235, "uuid": "3d861d00-87dc-4213-9637-8564ad576e2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303235, "uuid": "89af3147-09f8-4fe5-a012-1853c9876186", "value": "SecuriteInfo.com.W32.Agen.JSAV-4966.14818.15282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bde6dd4-e266-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Socelars)", "timestamp": 1682316584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316584, "uuid": "4c974140-755d-4c90-af53-c8f81ece1a60", "comment": "Malware payload (Socelars)", "value": "dbcd95d6e385f813811abeef68521697", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316584, "uuid": "7e303779-d911-49e4-8d77-60e50b8e1f22", "comment": "Malware payload (Socelars)", "value": "c4b22125c084fbcfb3eb6d40e54b344b044fc6e0f34f0c110f4c3d10e2054ba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316584, "uuid": "8a14ea34-ac00-41e0-82c1-825ab0f32901", "comment": "Malware payload (Socelars)", "value": "d067da0ec6bdcd6baf4f5d4519869253f49eff14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316584, "uuid": "6e009be8-8015-4536-a80d-20b8ea3204ab", "comment": "Malware payload (Socelars)", "value": "f17bb5bd1150e48926d4a66c1d911a205a98c74967de80129ec2b553ba780c1bef834c71864392960a3cd36b9cfe31df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316584, "uuid": "9d4e63ab-bfb3-431d-8ac3-a3a3ff47d50f", "value": "T100658D21F7C26032E8E310B745FF6ABF9D2C6A11470894D7D3C81C999B615E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316584, "uuid": "bad48e6c-7466-42a6-acef-435e9bbf3d78", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316584, "uuid": "1b656c2c-064f-4b46-a4f9-ecb791876335", "value": "24576:BGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dR7F5h5S2:0pEUIvU0N9jkpjweXt77B5j3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682316584, "uuid": "55be672a-0712-4ac7-bdb0-643f9c7e4e59", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682316584, "uuid": "7420dbc1-6ccd-4d61-87b4-02eca87b3c47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316584, "uuid": "41e39014-b72c-4e96-aee6-081de6ed6867", "value": "dbcd95d6e385f813811abeef68521697.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8a62ab-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303244, "uuid": "b6cd94b1-98cb-49c4-82cd-d96491ad8b1e", "comment": "Malware payload", "value": "46ea01ae5b5fcb72a4bd7a178ea2e5f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303244, "uuid": "dd4a50a8-971c-4e2d-8900-4d16af70df7f", "comment": "Malware payload", "value": "c567d5a4ad7235e10f7afa7371f7dca42f6707b903efb267fddf429f3d838152", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303244, "uuid": "c6e95de9-8e5e-4492-a122-65e832e76bb1", "comment": "Malware payload", "value": "fee42b55adb18db874f02c6e0cd51b12c11e8c61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303244, "uuid": "f58fac57-23ec-4a74-ac4b-50d6eb299ae6", "comment": "Malware payload", "value": "8e6e0c4bad5982b0000bb23658133013b05acab9e78a6e53ac4ecb5ac71f79b41c38287fdb6935729844cfe1d7619981", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303244, "uuid": "a180c45c-0194-4ead-adea-f48f51f03135", "value": "T18D814B26195D8B46E871E87612B3584F033F414DBB9F1BE6289292E85550AAB082E8DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303244, "uuid": "816d2207-574e-4af6-9b5d-e3ab0c5c2bfb", "value": "992b55ac6e4285130bc78a171683f859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303244, "uuid": "75333dfa-0829-4738-8e4c-b065636ce89e", "value": "96:csIqDd2EOunPUu0wpNykOdCrT2ODj2goajQzM34MUyyzI:9FROIUu9pcDDODatzM3rTyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303244, "uuid": "7f0f6e2f-5030-45a5-9072-a4998818fb6a", "value": 4075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303244, "uuid": "76ffe63e-0912-4284-a55e-70cf4836d06e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303244, "uuid": "53ab17a0-80ec-4953-8bf8-fef1df8abf4f", "value": "SecuriteInfo.com.PAK_Generic.006.27472.13015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3d7e4b-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682346918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346918, "uuid": "9cff5f0f-f470-478e-94bd-625a6a43fedf", "comment": "Malware payload (Formbook)", "value": "d67d9bf7354e7969abe6a4ced998b145", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346918, "uuid": "b8d6ec91-30c9-4266-979a-8b35f19a0cdc", "comment": "Malware payload (Formbook)", "value": "c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346918, "uuid": "5cf908bb-08a2-4917-92de-2df771c6d69e", "comment": "Malware payload (Formbook)", "value": "12ac15d5eb62eb68f88d6bd149497a57e43e6fa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346918, "uuid": "1081d541-723d-4331-977d-7f118fe547e8", "comment": "Malware payload (Formbook)", "value": "f5d5002bb54e60d887242654d21622f548e30c0ccd3a970362d156c9148e0de3de1abb3d6608390c2d279af941df944b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346918, "uuid": "e77a9d45-084e-4baf-b3f9-ef8eb0306d74", "value": "T166F4F124F21D1CA2E58B94F1091AB3672A1973CE3A7DA5A46B7D71D122B33CE1F85C07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346918, "uuid": "b398fb88-b365-49ea-9430-d4fa6859193c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346918, "uuid": "c6360f68-7bfa-4bbb-995a-bdae247015e3", "value": "12288:0ZgjjkkCS3OydyH73bJ4gnVfo2ZQTR23onxpQH3oJSAT1i1NFW49Mx:0ZgjjkkCSPySN2ZQk4nxQ3cF0Mx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346918, "uuid": "85fbf13e-692d-4b15-a257-c269e95d358b", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346918, "uuid": "859c9694-ce86-4943-8d65-ad0753e8332c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346918, "uuid": "da95068d-cbe5-4c34-9694-ad2799b11a53", "value": "d67d9bf7354e7969abe6a4ced998b145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e190e15-e271-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682321286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321286, "uuid": "5f57124b-0d31-4f42-a1d0-ba73dba66f74", "comment": "Malware payload (AgentTesla)", "value": "cf35302165a29fb1986e8483b49f0c95", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321286, "uuid": "dea2fb8f-396c-41c8-bdc7-82ce945e35a3", "comment": "Malware payload (AgentTesla)", "value": "c6930aedb822a6dc5f7f7956e1e6fac29f18e045c92c1634eedfba7ec9bd138a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321286, "uuid": "931966cc-ac19-46f0-ab0b-a9051b5e166f", "comment": "Malware payload (AgentTesla)", "value": "093aff258c10be9118c8c12cac2b63557e8d7d33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321286, "uuid": "14e42211-2ce9-4901-845c-3a878b2e5981", "comment": "Malware payload (AgentTesla)", "value": "2e2f3d384062d5ceb823c5de1dd9d4f9b7401a3a272b85c08295d81e1843c43b1dd6ec3713b23e983eaf7d112bd8bbe3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321286, "uuid": "5d93228b-6f63-4c6d-8d3a-bcc83e2161e1", "value": "T154C412904127FAEADCDC6BB74B543499477170C3612AA72C6BE84E898D01F82EF4527F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321286, "uuid": "4b7dd99a-43a5-418e-82ea-a554662c56fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321286, "uuid": "84b0971f-4c4b-4c57-84bf-a37a8d4dec96", "value": "12288:UvTaHggia+hCOiT3fSXxZ2NhNPgEpHL7CJEBl:UvT6ggq4L6hMRVLeJEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682321286, "uuid": "80823ff1-8e91-46c9-b6c9-7bd5f9f949b6", "value": 560640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682321286, "uuid": "0423bdf6-246d-4dff-bd0c-8d30161f6b42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321286, "uuid": "0281932c-2d3f-469c-8b7d-361c1e660bec", "value": "scope of work.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4117cf7f-e2b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682348644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348644, "uuid": "51e606ca-0e9e-4414-abf4-821beac93f7d", "comment": "Malware payload (Mirai)", "value": "28daa32212722fd3cf4a83f97bb1c1a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348644, "uuid": "399f5e98-8d5f-4797-8073-b9cec239bf0a", "comment": "Malware payload (Mirai)", "value": "c6ceb474f7825817748743eb42081790b3ea062824687ccbee5118abbe4518de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348644, "uuid": "68b9e836-3a5f-4eba-8774-b99b94b56f40", "comment": "Malware payload (Mirai)", "value": "42a3c85d960640e6dba6509ecbd0803a49f26f03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348644, "uuid": "8b7c936c-39d1-4bac-b9b6-2f52990b6699", "comment": "Malware payload (Mirai)", "value": "d48ccb7476ff3463073604b7729e9eafdb10a67e7c2586dd1fce504e7dfd598e39cbfb8ab7ea9a8bc25a418f7192d9d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348644, "uuid": "d0544d51-aeac-4fa8-98cc-a0b62c0b6e91", "value": "T1F8830C01E9454707D2D267FBF78F47AC3B26696897DB33016D297EB02F8279C1E29221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348644, "uuid": "ab1f07ac-3e66-4dee-b647-4305f0ae1647", "value": "1536:nQkJhC2F8bZs0uSQL21vv5KpvCyeA918aR/U2vMIuPi53q7nWlaKQOOFT/IOG:FFeZM/oACyebwMrTKQOMT/IOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682348644, "uuid": "e90c0244-ba8e-4986-aafc-94f277729c93", "value": 84520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682348644, "uuid": "9d902f63-95ba-4355-960a-799b6ea87a99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348644, "uuid": "947acc44-b8c4-4a67-add2-ec4f6710d1ab", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68dce852-e270-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682320794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320794, "uuid": "ad83430a-167c-404f-8e38-38ee77a9929c", "comment": "Malware payload (Formbook)", "value": "a4a65e0f37cfa1fbb499e37c3b349db9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320794, "uuid": "e42d0d02-2b1b-4a31-9e4b-c7158cc3b99d", "comment": "Malware payload (Formbook)", "value": "c9a39c36b0fb495bd816ac4b750f8078b6ecd3d2d96c651b82dc92f3d2689ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320794, "uuid": "5cab2415-babd-404e-8959-2e70090402e1", "comment": "Malware payload (Formbook)", "value": "6425851753dc543fcdd5de09df6506370e7abdc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320794, "uuid": "6fae6926-0820-4040-967b-a82f0212f0da", "comment": "Malware payload (Formbook)", "value": "5ae613f10dbb9441cb5b0bdca5211a77ee45758386f97206ea99306bc7ebedf83cce4ca0e43d79b12918bfdef345af24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320794, "uuid": "4a7f0cac-df84-43d2-89e1-aa3532669fba", "value": "T1BBD4121404FCD277C41D087B29B4E32307BA5E936992FBA129DD5CB97D737858230BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320794, "uuid": "52c5ca88-813f-445c-98cb-33c89116653d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320794, "uuid": "35505b9a-b0a8-4a95-bd45-c2406ccfc79b", "value": "12288:+dj4Y86F+Rq45xvdu3m21BVCZD2IlF1tJYKxeZ1LbJB:+hQ6Mb3vduP1fsHlTjYKxeDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682320794, "uuid": "b4972aeb-3b70-4848-9ebc-432bdbaffdbf", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682320794, "uuid": "e8031e55-d914-4950-9e1a-1a653524bbd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320794, "uuid": "35a0215b-8ad7-4bf6-bbd8-68f8ec3f9260", "value": "AG-037551 revised PO#01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e81d9f-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303225, "uuid": "bd899db0-fb0e-4b91-910c-627c02a6158b", "comment": "Malware payload", "value": "9f51a074238b0a2323ba581f0cac87c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303225, "uuid": "6c945902-0836-4f11-8c46-106cd38c7fbc", "comment": "Malware payload", "value": "c9c6d17cd0f6896a922d3d62bf034beac0736556a8617adb8c4e60a0cc2af350", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303225, "uuid": "985c5523-2847-41d1-bddc-0ef461d8d415", "comment": "Malware payload", "value": "08858a28996e072368e3d6c2efa5f22a0ec4681d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303225, "uuid": "f0b1620c-a9b8-40a8-8b42-2a0e0f9e91cb", "comment": "Malware payload", "value": "f6e13e52c13f4a7ba70c8196d0c54d3b5c6a31f09f951bee8e06cbf0ac4e0cf2f63bc630b13a5f6269e84bd1fd08d3fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303225, "uuid": "5263ad5e-e571-47a8-b75b-7288ae06478e", "value": "T1C5817F456A6DE6F5C774F07E15E0A5B609CB71D84FAC83DEC41307981E01EA0ACFB948", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303225, "uuid": "6fc2dca8-5191-41e5-afa3-3b66fe6816f2", "value": "992b55ac6e4285130bc78a171683f859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303225, "uuid": "694cefcb-60ec-4ee9-8aff-d884c814266e", "value": "96:cJvGnBvYqimLVlYtJBsL9zZFrPlwFw+sQVLz0CyzOWxNdSJ:ZBQ6Vt9zZ+w+/VLYX5rMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303225, "uuid": "a501a04b-d987-496d-b451-5d02f0551dcb", "value": 4073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303225, "uuid": "c31a343e-b3dc-4cd7-a0e5-e47da465d72e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303225, "uuid": "5fb96eae-d300-440e-8602-ba30f10336ef", "value": "SecuriteInfo.com.PAK_Generic.006.18828.26746", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c921d026-e284-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682329545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329545, "uuid": "4faf4dd0-0c9c-4696-91e4-4cc902aad48a", "comment": "Malware payload (Mirai)", "value": "220be22f64dac3950f6930ba46972e6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329545, "uuid": "6d9e15e8-2e21-4067-a399-b600b9df3ef6", "comment": "Malware payload (Mirai)", "value": "c9e9592147d691176d8ad2b134637101e0f4c4d2a2313882a0eb64c0a25024a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329545, "uuid": "beddbb6f-2c9e-4db5-82d2-110d6cc0a0aa", "comment": "Malware payload (Mirai)", "value": "522b2411de7bd2cfea41618969de7f70abf653c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329545, "uuid": "f8589c35-0a3f-4403-aa41-c288c2e45db3", "comment": "Malware payload (Mirai)", "value": "149b02037092108143de628544111a70a82b6f2e749520852e0a30b6fe5d1c68700887ca074ac77708e6252e0f58147b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329545, "uuid": "548431f3-84af-4315-b6a8-eea6ba10aaa2", "value": "T1C1734A22B9792E27C1E4A07F21F78220B6F6274E36B4C61E7C720E4EBF2554026576B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329545, "uuid": "365b4c50-aa50-40b4-b027-01d53dd31e16", "value": "1536:w2sqljohwn5xqT49iInyH49XnyhD61mzS7vyvSVFcvsv9hTK0wDtHYJ2qiSxtVCC:zVN7v8SVFcvt0gdYViSxES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682329545, "uuid": "f1150d99-08a0-4bde-a8a1-1bd4f4679c2e", "value": 79424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682329545, "uuid": "a064919a-4edd-4645-9b89-e7fb2dd25335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329545, "uuid": "e80ff578-b993-4c11-92d7-34a0b3bfb937", "value": "220be22f64dac3950f6930ba46972e6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8e7982-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682323189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323189, "uuid": "f23b84b4-c67d-46f7-9927-0ed6bb18ad41", "comment": "Malware payload (AgentTesla)", "value": "d65bb2125b549c61c5caa7def9729e75", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323189, "uuid": "8dcbd01f-e0e3-41b5-b456-9fb4728c1132", "comment": "Malware payload (AgentTesla)", "value": "cb45acf0dee36f463a87825f46ab30fd03a9301199adfc689a6bb60727c87a17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323189, "uuid": "92258f91-54f6-4e02-9776-a7509e024ad7", "comment": "Malware payload (AgentTesla)", "value": "9e2305042eac4addc9517cd12722764f4feb788a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323189, "uuid": "bac25390-db99-462c-8bf8-546d8ed63d3a", "comment": "Malware payload (AgentTesla)", "value": "409849e16471d3721c0303b83fdb76763c615d2e20adf8a2cec08eedd8c8f11b300e0b1b70b61d5decc7505ff10405cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323189, "uuid": "d5f866d1-4921-4d1d-89a3-e88650720b08", "value": "T1FA64129B1794C877ECE75E720A7D17176FE9DA3206AE5B0303101A5DB822346E78F342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323189, "uuid": "10e8604b-c360-4119-b0c3-5dbf9b0d971b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323189, "uuid": "8ef2f5d1-191c-4a72-ac8b-c0186a3a9449", "value": "6144:/Ya6+41nSRIB6j7lv4Zgj0eVktoFtF+aVEEL6ZYKxBYvmjRgJ3:/Yg41nSRpXN423dbxVElmKxGmjG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323189, "uuid": "a508bcfd-38b5-4066-977a-d76f08046a66", "value": 310639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323189, "uuid": "79eeecae-db38-4e4a-9e9d-829e5584000c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323189, "uuid": "28919086-ae6b-4a57-8b5e-6b1e9e0f9b2a", "value": "quotation.pfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416ea4be-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682346927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346927, "uuid": "fa2d470a-b8b5-4aaf-8f38-b66d962d91e0", "comment": "Malware payload (Formbook)", "value": "f9178f4a0fd9431b4bf04be1a1f1602f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346927, "uuid": "cb3cc36d-a2fb-40a3-a703-5faff0700690", "comment": "Malware payload (Formbook)", "value": "cbdac32d6f43a1f03a26cc2fcc6ea13586f0d7f85764c1626cc71ce30bc0434b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346927, "uuid": "1ea39f01-def1-4612-acaf-f27bf6804f84", "comment": "Malware payload (Formbook)", "value": "c65726a5d131a83e95dd6d9ebd6aeae63b34db7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346927, "uuid": "0becacaf-7afd-4f17-a484-39896c70daa7", "comment": "Malware payload (Formbook)", "value": "4c9d014f0942fba585732c378c445de33a67a6b340a2194e642d7d6576946a0cce2a76be9f1d52a2704f8214c0ee7e37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346927, "uuid": "0be586b9-97e9-4c14-9079-fa3b1b31b2aa", "value": "T106F4F134F21D28A2E58B94F5191AA3672E0873CE793C66A46B7D75D122733CF1B89C07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346927, "uuid": "a427c387-8d76-479c-976b-32bdf7079a7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346927, "uuid": "febb8882-1c29-4eb6-8e85-edebb6f802bc", "value": "12288:fwgjjykCS3rhjmC2JIussWxToNXEYZF41OK3G8k/z/ip2PAlwNl:fwgjjykCSVMszToN1TB+lk7a8s2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346927, "uuid": "035aebb6-ffb8-4d42-849c-8b6963801cc6", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346927, "uuid": "7869affd-34b7-4435-9e59-36ad36f14826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346927, "uuid": "9de07361-138e-492a-9310-4d7c7f8285e2", "value": "f9178f4a0fd9431b4bf04be1a1f1602f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1726eb34-e2ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682345997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345997, "uuid": "afe79603-438c-4839-b817-98c955c92d1d", "comment": "Malware payload (SnakeKeylogger)", "value": "5ae16d5f8eae9b63068ad5a08a311179", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345997, "uuid": "64d7e5b0-5c5b-41d8-be80-8b8756d1153f", "comment": "Malware payload (SnakeKeylogger)", "value": "cc138ced1fbc3fd146c76a8ab520bc6e436b84a4cd26542e8d75ae57c435511d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345997, "uuid": "952225de-88e4-44b9-b9a0-6356e0e481c5", "comment": "Malware payload (SnakeKeylogger)", "value": "4189bf7a6fe8473395ee5814ca19a5aa70a20158", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345997, "uuid": "99f3bcf1-51e2-4d5c-9004-63198f79fbd6", "comment": "Malware payload (SnakeKeylogger)", "value": "fcbc09d2eb411f7f96a9014b007b90d7f41d4b3c932e765383ad431f45c9eaeded6ee426667db54e434dd88eca58c608", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345997, "uuid": "bfa85cb3-2538-4aac-bbce-bb022416b750", "value": "T142D4F1ADA7A9D7A3C1690FBD801661892B7050E73677C63CEFCB408DFF47B081985686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345997, "uuid": "5daafc4b-4eb0-45cb-aabd-331c49618325", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345997, "uuid": "870fba79-fbe1-4222-89c6-f51e49d44d7d", "value": "12288:opGBO5ZZC/W2n9wl/mbORAuDSRB6okvdT1lPQiowic/7:mGqTC/fW/tRAu+RJk1RlPPse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682345997, "uuid": "585faefc-6577-46b1-a8a3-b2b402c33b00", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682345997, "uuid": "9c323c4d-3da5-40c9-9362-a19f4f35d99c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345997, "uuid": "5f52c905-0d00-418a-9533-69ce387c9c44", "value": "5ae16d5f8eae9b63068ad5a08a311179.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717a639e-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330257, "uuid": "edcc6573-5707-4d96-b057-97d6d9d53bd2", "comment": "Malware payload", "value": "6767c2f3ef1e2324d63fd19fd736b7d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330257, "uuid": "7b050865-4140-400b-80f3-94b2c552c286", "comment": "Malware payload", "value": "cc79ef40d93c939c43624504461ec5ddf8279624ae88a739e7382c181e18104b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330257, "uuid": "457d94bc-ddd8-4c60-83ce-6c98f4e4a2fd", "comment": "Malware payload", "value": "9c5e85ecd008fd0d3251a3a634b83c43efdeac06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330257, "uuid": "6a92633b-9778-426d-9155-9175edbbc8f1", "comment": "Malware payload", "value": "c957a729e7a6a758dc219cabe641c70d22d0c090d602239091a66fc62c8a885fc70c7c4ce5a12abeb24d806cdadc243e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330257, "uuid": "9c332e6e-cc2f-4491-a3e8-fa44525691ad", "value": "T12C36D0AEA054823EC65E4779D4C68E32E132F1F11E7FD32E5A90C1E46A574A40F6FE60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330257, "uuid": "76045079-3c74-4e37-81e3-919b8633985d", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330257, "uuid": "3c33d1e5-fde5-4f53-8529-f158459a60cd", "value": "49152:89cha5GRE45F7OcI3Tcr10bKaAC1leVb1fXdY9UFG/fLte0H6GkboEzYL+v9MXKX:e/tTcJ0bKZCTe11valfy3LduNRtyKqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330257, "uuid": "61c81db0-dfb6-4495-acd3-c3dbaae70ae7", "value": 5135224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330257, "uuid": "105b4a4a-e6b1-4996-b803-42484f1c844c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330257, "uuid": "eed8a5f4-9a43-4e64-8774-3ebe9909fe26", "value": "cc79ef40d93c939c43624504461ec5ddf8279624ae88a739e7382c181e18104b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e4d30c-e2ca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682359500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682359500, "uuid": "fd7a895e-af63-4f2c-820d-a9031b749163", "comment": "Malware payload (AsyncRAT)", "value": "c80f44f67aa862099f67866a26e84253", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682359500, "uuid": "07f78a62-eaf7-4c45-bdc9-84410ad23828", "comment": "Malware payload (AsyncRAT)", "value": "cd279fe4806f1925c2985f4a3f4a0052b140e85ffad9a2e46b27f8ff2cd99baa", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682359500, "uuid": "38a24fec-fddd-480e-abfc-6258da9bb5c4", "comment": "Malware payload (AsyncRAT)", "value": "e55c67dc7a05b0a1a32c30b66431642c075e6724", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682359500, "uuid": "fa4897de-45f9-4c0b-b6bc-c663823e5dab", "comment": "Malware payload (AsyncRAT)", "value": "2c95f7c3da62a6420935b26bc68242d858d79b382fcc00d1f84a985c38b5e50e2aaffb8e2f1de5d00a7b1e3b5485f495", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682359500, "uuid": "0cad943c-fc9b-4c43-92e9-e7789123fe1a", "value": "T19363F8053BE9802AF3BE8F7469F625954AF9F5AF2902C55D1CC510CE0632BC29D41BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682359500, "uuid": "7f4859ad-994c-4ede-bc21-8a21d9a3f175", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682359500, "uuid": "d1a6d2b5-4fc4-42d5-b0c8-d7e267ecec21", "value": "1536:n2UukvF1tkk/hEYRo2NQphePvUgcKu5UYF17uKRlME0IbpUCY1KwrCrCVx:n2JkvF1tkXKu5UYF17uSyEpbpy46x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682359500, "uuid": "f5417c5c-95b5-47fb-9ac3-2b606def21a3", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682359500, "uuid": "22e8a13d-04e3-4a5a-878c-2c93b9593bae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682359500, "uuid": "876b2df6-bc19-485d-af2e-4057c4c5cd81", "value": "stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd85c45-e2a2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682342280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682342280, "uuid": "ae9ebb97-5dcf-43e3-8086-7c0832c82082", "comment": "Malware payload (AgentTesla)", "value": "6346e73879a7c437b1e36bb34d1fb104", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682342280, "uuid": "229a47ec-3694-4afc-ac5c-144aa5209a4a", "comment": "Malware payload (AgentTesla)", "value": "cd48df9bc39d67ecb4eb1e95e4943239cf895b2ea52e85f7ebcf330f403f559e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682342280, "uuid": "84eaa2ec-6e6a-4117-abc5-dbf73da6243a", "comment": "Malware payload (AgentTesla)", "value": "b367d750ed5ca46c87726c1eb4d8fa99db9567bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682342280, "uuid": "cb19ecd4-07fe-4ce2-9d7f-f2077b09ac29", "comment": "Malware payload (AgentTesla)", "value": "f31ac2796a9226fc24f3a52ec0ebe9fed15d59c64b0d2df9e925ee628d2332f6a1bf4d910761a843b33675e58f7b2b5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682342280, "uuid": "65a0cc60-7d50-4276-bd72-7a1dfaa3ff86", "value": "T13CD49D2C6AEC5AF6D179F6B5CEB98821F6E3D5637211CD396DD701880602D8362D02BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682342280, "uuid": "caba079c-cac8-4ab5-9753-870e4b15a42f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682342280, "uuid": "bfee7fb4-0a57-4baa-82cd-ed62fb0a6c43", "value": "12288:6xk+Do8AKnjqen7wa+GF+mlUbSNjyyamWVI:ylCjgZ9N2yamWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682342280, "uuid": "f5dd00be-cf5a-4451-b221-a28ef867f294", "value": 636416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682342280, "uuid": "9913e5f1-5ad0-47d2-9215-881386307f7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682342280, "uuid": "6ed4a76f-a1df-499d-be51-15959665ec8a", "value": "cheque copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b690d6-e29d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682340030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340030, "uuid": "01f1cb9e-8832-418b-a894-1bb385a8c885", "comment": "Malware payload (AgentTesla)", "value": "3c54465135581275cb38670a32586227", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340030, "uuid": "94153514-ef3c-4a85-b5cf-c4e70a14f719", "comment": "Malware payload (AgentTesla)", "value": "cd85a1ffe92b7458e913adc95765fde43e6626aaba89884492fd13c3baa34753", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340030, "uuid": "32ef1007-1e32-4da5-8726-844d53f26f8c", "comment": "Malware payload (AgentTesla)", "value": "677b630c3ab4a562592e6076d39f545a11330e01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340030, "uuid": "71a9109e-30fd-4c6f-99da-31ae6f8a8fda", "comment": "Malware payload (AgentTesla)", "value": "d248ff6dba58404f6b9cffdd721e9638e013a4aaf4ed09a4369e5602bf9d3a0b05e85bf1d71e0c5064d5da24382d4dc9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682340030, "uuid": "0cc8d9af-9566-466f-9a06-6f596d544508", "value": "T16E9423576D083A05F02DC539E5A35423069902E18717BD9082F5BF0EBF1CBB1A9E77B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682340030, "uuid": "dfb2f2a5-c65c-4346-99dd-e11d967239dc", "value": "12288:g30DBMgEkeqYff4hNbCdbchWr9WDpRuti87Zx+vcC:gCMg1DYQbC049KfCiyZYUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682340030, "uuid": "b9e60acd-fa13-4554-92cc-d6ca41a9a278", "value": 435440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682340030, "uuid": "41c2b29e-d9fd-4e21-bb9f-381532bdca56", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682340030, "uuid": "25e00b28-9117-403a-8c4f-35fd27fb8097", "value": "Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fa0dbd-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330263, "uuid": "64371e63-2ad7-4c5b-a0f8-b1540c45872b", "comment": "Malware payload", "value": "d30c13d9bfe560545231e9d5e66d7fe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330263, "uuid": "47e85452-4773-4b7f-a50e-de21d32a4b3a", "comment": "Malware payload", "value": "cdb09a5df36fece23bc3c9df101fe65724327b827ec43aa9ce0b3b76bdcc3101", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330263, "uuid": "a01a865d-2bfb-49f0-a0e9-d08c5cbfc580", "comment": "Malware payload", "value": "8605a805ec407195b33423e55737d1871c95bc0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330263, "uuid": "376d2292-e66e-4f43-ab56-5c712fb40938", "comment": "Malware payload", "value": "4f2bf987a6be8ab4fd19e2c1b05b5a37baaa5568175118884ef44892bb92ac38ef9af89d25dea74552bb5553caa2abd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330263, "uuid": "ae88e8db-5b18-4f4a-a840-23b31ae2ed34", "value": "T14636CF6F609187BDC206D232C1BE9B34D93371E14863C63E96C1E5B16A95D248F7EBB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330263, "uuid": "06272be6-d16e-4c4b-a205-76cf5baa7576", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330263, "uuid": "5f85e2c9-5cb2-48a4-848c-b55699c6fec5", "value": "49152:vpghL0GxlIP8oa2op+pChboi2CjASvvhyZVW3JvDTiY4ekJb7keVPPm3RYnfjJ0S:RWQnEMe3SuLekSqbTVm5alfYPy7JGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330263, "uuid": "e90aeaf9-8ec2-4a2e-8280-ed9e5e4c7bc8", "value": 5096312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330263, "uuid": "dd6d9e6e-f7dc-4129-92f5-4fe09be12981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330263, "uuid": "f2ea8970-8897-45b7-8567-45f702397896", "value": "cdb09a5df36fece23bc3c9df101fe65724327b827ec43aa9ce0b3b76bdcc3101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a4c13a-e234-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682295119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295119, "uuid": "fff1534e-9dac-4a3a-9319-7d243ae0dd3d", "comment": "Malware payload (RedLineStealer)", "value": "8624122c77b6ab0e8d4c8f6a8a1e25d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295119, "uuid": "f0598561-20a0-43b8-8c6f-94bd2cef085c", "comment": "Malware payload (RedLineStealer)", "value": "cf098978cadb89f8b88f475dc0737526ea63bc8ac71e3361ded1c0a4f44f053b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295119, "uuid": "b6f63b4c-4ab4-43c5-a62e-5eb29a51eee0", "comment": "Malware payload (RedLineStealer)", "value": "b58bd534a7b1f001a655d9f3bc82450fff287cee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682295119, "uuid": "7ee05fd9-e82b-419e-9e49-46d469c44cbe", "comment": "Malware payload (RedLineStealer)", "value": "d1a94f6f994550bf5b74dc508e2218c7ad1cd41aa25319c426485b7e28ba25193dc22e655e5c5008dbc8f671591be846", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295119, "uuid": "d2d02d15-ce31-4be5-ac75-f312e0020dab", "value": "T14B2523255BEC9132ECB5637028F613430B3ABC919B3543A73699DA4E8CB25D8D13637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295119, "uuid": "66b5b546-0322-4fc9-98f7-9bfa6e1279ce", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295119, "uuid": "718f4a8b-d107-428d-b5bd-0ef1c2cec08b", "value": "24576:Uygncy2KLzqqU8u4g3H0X1I1YAQ0e+6CP1sh:jVyoqtu4gq1I1TQ0e+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682295119, "uuid": "432fb779-73e2-4c96-bb78-33cbe16e70b5", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682295119, "uuid": "2f64cde5-489e-499e-8995-48f9f28e17e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682295119, "uuid": "48fe1c02-2616-4d6b-96d7-70dc544b7556", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49455632-e239-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682297118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682297118, "uuid": "b1cb4c72-48d6-4048-96fc-1aae33cbd992", "comment": "Malware payload (Vidar)", "value": "c5008d5b25a861948430ee2d2a279fc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682297118, "uuid": "e5f09ede-f38a-4d24-baad-9e62c975ac64", "comment": "Malware payload (Vidar)", "value": "d006278368f6815fd40a2aa47c455c46f87f616bfae93f714dc1fae67038f8b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682297118, "uuid": "31f7bcca-57c3-4659-979a-7edf467353e2", "comment": "Malware payload (Vidar)", "value": "7ed1131a8853e9e953d149804dbd8d10622f5f47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682297118, "uuid": "42cc9305-944d-42b7-8b34-e0da05692f95", "comment": "Malware payload (Vidar)", "value": "141050acd8c56802e8448ca6ced51c43f3c01df18d61e38d8560fb24b73ff73ab68f3a7348331f77f7747430252679ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682297118, "uuid": "06222017-f9ee-485d-9ec1-fd1e9a158a1e", "value": "T107F523902D4AD81DE90E02735703052164F81FB41EFA898F9287FB5A9F461CF49BAD6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682297118, "uuid": "edf5a0bc-d4bc-4af6-a946-94b44eed9957", "value": "55598916d3559b7ff87df57da236c990", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682297118, "uuid": "06b48a73-d30f-41d6-8c8e-51f688b19c2a", "value": "49152:eoxEgvY/7fC6JR4dWpvb1LePNf336NCVTQPpm/TGaQMxWdr48JISLxh1R4CGvQ2/:xEUdWTeFf33o6QRsGAY3txh1RFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682297118, "uuid": "f8f54c53-160e-4663-8552-811006de6478", "value": 3482624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682297118, "uuid": "81dccdf4-a313-41a5-8736-272a67e64530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682297118, "uuid": "5b8530e1-12c0-4eab-bc1a-31ad137cbd9d", "value": "QuickSearch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e7d6c1-e2ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1682346688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346688, "uuid": "522120f5-79b3-4bf7-b3f8-1987ba361321", "comment": "Malware payload (STRRAT)", "value": "9e3c6e0377e6921156fc1a5949ed4879", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346688, "uuid": "f295b664-427e-4726-b5d4-fe6f27ce11a8", "comment": "Malware payload (STRRAT)", "value": "d0415c0cf20a5915c6139702cf824f2fef6c872d8da0a23200cde0cd9b2f8c33", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346688, "uuid": "0266cfdd-9896-44a2-82a0-266ec80db2d0", "comment": "Malware payload (STRRAT)", "value": "9c823398b3820d4ac295a4519d3a3bc709905595", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346688, "uuid": "ccccb51c-3025-4bd2-aa5b-637dc23bdb20", "comment": "Malware payload (STRRAT)", "value": "daec6b2c0399cce37f943a197b40efd1665009ed16d0ed12fc51e44c65482b3da6f570afd52d93e36bc161804104a5a7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346688, "uuid": "96fabdc6-7051-40d0-8b08-5bbf5a13dc22", "value": "T1D024F12FBDA7C0BDD433A0B958048137661A4297E485900B36FC358A5D7ACBD4B27ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346688, "uuid": "6e61d25a-a827-4def-9367-395d50f41bae", "value": "3072:oSsSYqVPFtyQSpJULQIJEdRIrDf4+QOV8sctALgqzUTTtETQneFmuThBHO7:pshqVP8+EIJdPFDKagbTUQ2T7HO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346688, "uuid": "3308d08b-33fd-4e4b-b45c-4297c21ccdd2", "value": 210031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346688, "uuid": "28f20c5f-b7e3-4414-a83a-b5faed8cfcdf", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346688, "uuid": "2a3d212d-9727-4a8d-9b62-aa3b39d396ca", "value": "PO.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0804e9-e2cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682360071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682360071, "uuid": "ae668be9-8c8b-4fba-907e-38a9714f86e8", "comment": "Malware payload", "value": "2db3713a8df0569d1108106045553d72", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682360071, "uuid": "5c853277-4ebe-44ac-ba33-18a93af36318", "comment": "Malware payload", "value": "d05e72b5d5ee62a18b8c24b92309a2bdabd8149499845a0418fa226da367a62f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682360071, "uuid": "34378159-f5f3-44be-8ca3-de28952ccdc7", "comment": "Malware payload", "value": "013ec89c7c225bec44d18840a8ca53c0907d6108", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682360071, "uuid": "0ca11956-4b1f-49d0-867b-d50ac4f3f17b", "comment": "Malware payload", "value": "1e0ed52aa76fc5d1ad2d6add4a1fa8e9d84def4268ff91235c287523de45fab83dac621c807bd695b8ead0619531d633", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682360071, "uuid": "cd66012a-81b9-4a31-8b0a-ec29814938a6", "value": "T16424BEBCA4E785D4F54F884136ECBFA4017237F3A9CD0E641329A6448BE9EA52F4458F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682360071, "uuid": "90657b7e-7dc2-4d17-8ce1-b21f9fb8c30e", "value": "6144:gk0t0ZnKWQIypMjiBBBBBBBBBr2BBeFBBtgBBRfZGjowmGcAe3Apj:gk0t0ZdjiBBBBBBBBBr2BBeFBBtgBBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682360071, "uuid": "947b197f-74f1-41ac-9d02-a4a6621df13d", "value": 216636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682360071, "uuid": "39a57e40-f8a6-4060-9db5-24d65c635249", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682360071, "uuid": "5415a3ff-50c2-47df-90d6-7ad4dae26236", "value": "n.PNG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e038cae-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303220, "uuid": "e9abfe84-e0bf-4183-bb1d-0dc9d8862ca5", "comment": "Malware payload", "value": "a9cf159dc014d7e4a6f9092768758963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303220, "uuid": "e50f47d6-5d02-404c-b2e8-f44ee5785b2c", "comment": "Malware payload", "value": "d1fce16563263aad776f3c9b0887dfa2634bb520072a91b28a3f462ec95c30dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303220, "uuid": "2dda62e7-b052-4af4-a7d3-9bbb770c0918", "comment": "Malware payload", "value": "04de1a1f8aea3075161194338efebccee10022c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303220, "uuid": "e96922fc-9ddd-409b-839e-0068a711d270", "comment": "Malware payload", "value": "773b66c546e25c76b280e4c214112a643a3f717f250d1bcf40d13108190a115813983ff88e36dd6ec86c54ba7dc6dcb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303220, "uuid": "a165d72b-c3ab-406f-82d2-8894fe28b66d", "value": "T10872BF163F72CA48C060E23ADBB1CF452754F35158177717BADAAF4FCE961392919824", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303220, "uuid": "7121ad14-4286-413c-892e-919706e5de62", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303220, "uuid": "5210a7cc-2acf-4cca-9968-2d2ff8a17e7f", "value": "384:C2yt1op4CJ9ZJmyN3VR5oiLx6/1It9RNi1:hg1omC7ZJhN36ixb9RQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303220, "uuid": "4985cfb3-4646-4044-b44b-82787a9d8768", "value": 17360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303220, "uuid": "087e2ba1-b8aa-4197-b958-e95da4520a4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303220, "uuid": "e10cc3be-2726-4ffa-af16-4ab7e55ea0ef", "value": "SecuriteInfo.com.Trojan.Heur.GM.046040E122.17550.15295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b996baf-e2a4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1682342998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682342998, "uuid": "66e09f28-d6ff-4580-8995-cc187a8eba26", "comment": "Malware payload (RemcosRAT)", "value": "f09b8a08a1ba4d7a8a14cac51470e567", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682342998, "uuid": "9827fae7-f31c-4cd0-9e87-ffdbc42ffa11", "comment": "Malware payload (RemcosRAT)", "value": "d227570e37175ac604d3589bfb6cc8dc35691b4d2695a79d0014797a9cffd31f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682342998, "uuid": "a5cdf0b3-9d85-4421-820f-9f92308012f7", "comment": "Malware payload (RemcosRAT)", "value": "31e4f8183953a140fbbdef5e05ef7c3bc62e2d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682342998, "uuid": "d3c42f44-aa39-4e09-acec-52985817b6c5", "comment": "Malware payload (RemcosRAT)", "value": "7f153c5a5f1b2649bc750e9c3ea2de0cbbed109b7e94e9e256dccedb986f08c31c80d1d990ee2f723c10573dd26cdf53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682342998, "uuid": "68eb36c6-4880-4b89-93b9-84810a4a5a30", "value": "T1EE12A34A75860BE3D6C44D705E374B5B263D13A9126C6B710AE7BCE8DDFC213A702619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682342998, "uuid": "fc593a4a-ea19-446d-83a7-64fcfe0efb18", "value": "63393299977e5acc51eaba5bf320ad3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682342998, "uuid": "ad7188ef-db7d-4573-b60d-f380489757ee", "value": "192:3uH0JH08lBH0yH08lg0pH08l/jU0sGfvcQaKHm:eCvBNvdv/9nvcQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682342998, "uuid": "d261d83a-ba09-495c-aeec-56ed450a8a0c", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682342998, "uuid": "f47bcafc-5186-4d5e-9f4f-eefa563896f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682342998, "uuid": "2202aab6-1bb4-4a4d-aca6-609d34aad058", "value": "SecuriteInfo.com.Trojan.GenericKD.37610631.26179.6873", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03e8e10-e288-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1682331248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682331248, "uuid": "788ef9b5-693c-45ff-be3f-b6db7fa9301d", "comment": "Malware payload (AveMariaRAT)", "value": "4349bd58fde2ebe1afca5999f6002967", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682331248, "uuid": "82a9e6d0-8b84-4594-bc65-4a5969267ef8", "comment": "Malware payload (AveMariaRAT)", "value": "d2a041af6347ee6e32e62d51008952d03bc870e48b3133c63773aa302b0d4e06", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682331248, "uuid": "7a4b98f1-12eb-4b84-881e-8e915d509fc7", "comment": "Malware payload (AveMariaRAT)", "value": "9a26ea62746806e0d5fb248c4bd7bf62492d9907", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682331248, "uuid": "2f4e3925-7d11-47ad-9ad2-787711e2a402", "comment": "Malware payload (AveMariaRAT)", "value": "53743fe4486ff3c3fc54654dde3ca1f44b1acc3b87fcfefdf2e16dbede78c4066b70a44f05a4cee6edd96b4a4ce15cac", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682331248, "uuid": "8c172eaf-4426-47aa-a740-b1622e36b360", "value": "T141A423854B1F312A6C99883B1DA3B14382AB37FAF65C51DA31C7E42D9147B3C326A7C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682331248, "uuid": "bc272349-f1b4-4d19-a762-e2274875eef6", "value": "12288:ELVLHfo0t/h+2+6nA3V4yS8dEfvhl7Ff+MEvURNkrOqEmWjE:EVHfbt/Q2znA3VQ8dEfvLFNGUYMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682331248, "uuid": "46a7bcfd-506b-414e-8f55-1e101107fe06", "value": 489071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682331248, "uuid": "e4c6e206-d285-4b82-91b3-3e969ccffad3", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682331248, "uuid": "0488b2ea-3593-4a71-947f-13f6ac32835d", "value": "Swift_240423.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379a00f0-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682346910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346910, "uuid": "00fa1f0c-85db-4fb7-8c22-e8fdeb30f7e0", "comment": "Malware payload (AgentTesla)", "value": "a3bf4067de0bab2eb1fbac9387dee051", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346910, "uuid": "50fdd2a7-c1af-43a7-909e-f4f1941cfddb", "comment": "Malware payload (AgentTesla)", "value": "d3863329490232ec4baedef01a781ba4f7e5053c9fc0cf6a7b5a904447662888", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346910, "uuid": "af2348d4-f7d3-4e18-a028-0266175387ba", "comment": "Malware payload (AgentTesla)", "value": "e64101fca02a7f17dcf949c8c8f1bd8e3b728146", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346910, "uuid": "29dbfce3-3d84-4cf7-9830-6a946c9617a2", "comment": "Malware payload (AgentTesla)", "value": "8c1a9125e08fa4638c3e5f93a360e5c7f67528d39722569c935e32915c57a9d22ecf57a21cf8dae3782a2d79dc77ef14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346910, "uuid": "62f61fc0-965f-4544-96fe-b05868012500", "value": "T1CCC412D1539B72E9CDCC537F0E68246A43706193503AEB6C63D45ECA8D42B87EE0616F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346910, "uuid": "72cd7115-fdbb-4f90-a29a-e5dd332b454f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346910, "uuid": "c7000539-d90e-41d3-afba-ea5fb499ae05", "value": "12288:LJRWzaxwecadQGGU3ydB/v2Ns0enoT7vJfcUvb:7WzO4UiSNVenkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346910, "uuid": "1dd3af52-4363-49ff-80a9-0bc23efb4719", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346910, "uuid": "c955ef36-d625-4c0c-b281-e81463b411df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346910, "uuid": "6e868dfb-0819-460d-87fc-7702cbc32808", "value": "a3bf4067de0bab2eb1fbac9387dee051.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0708d3e2-e270-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682320630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320630, "uuid": "4922df1e-2bc5-49ae-8fd5-11008d61478e", "comment": "Malware payload (Mirai)", "value": "dded5911db90407847701d81a60d8d01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320630, "uuid": "c13a19e8-6216-4dc4-9593-0dfbbc2fbfa5", "comment": "Malware payload (Mirai)", "value": "d39f003b7d98cc5247765aa750f6946e0ffd7e60aa770b0ddecff7458d5e2548", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320630, "uuid": "0d4c38c1-97f7-463f-bca0-3963a14440c9", "comment": "Malware payload (Mirai)", "value": "0cf874d7fa8f0956b4e8e7bb3a387761c50d90dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320630, "uuid": "3dcb0c9a-7fbb-4a8a-99ed-e468233324e6", "comment": "Malware payload (Mirai)", "value": "56396bd9c6b1770ffa9cbf85356f27a3def4db45e9356293c63d25c4b31a6108d9206c07ed6ec951120a9bf38a72a6d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320630, "uuid": "c68f9253-35a7-4a8d-8f97-1f3e18694a1b", "value": "T1DE130996BC839A2AC1E0677ABA6E118D3315A3ECD1DF3217CD156B007AC591F0E7BB41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320630, "uuid": "c53a0b9c-b73a-4ca3-8960-955b3c31219a", "value": "768:5fXeMgDpmuDYdkKZZCcEsYYD+ED1tusl+1DoCerCYUOxKx+XvYPW4/haq3VsuCPR:55Em/aKzL2sl+uUO/XIW45VI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682320630, "uuid": "a97d68be-0406-497c-a2e8-6b8a67f7df95", "value": 43984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682320630, "uuid": "acf13710-f246-4ce3-8ea2-41ea37721fff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320630, "uuid": "37bf9ee5-7ce6-419e-8aaf-55b997628890", "value": "dded5911db90407847701d81a60d8d01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fc55d6-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682323185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323185, "uuid": "6362e848-8b79-4455-80bb-0efd41ca756f", "comment": "Malware payload (Formbook)", "value": "0300dbdd5f0120adf5317d3172867258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323185, "uuid": "2433f537-468f-43a5-8954-52f421c4fed6", "comment": "Malware payload (Formbook)", "value": "d40024a841668b3cb64cb894613ee64fb37288125d32ca3068007f70db30f1ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323185, "uuid": "021e5430-9f01-40b0-8e60-1490c3b55b87", "comment": "Malware payload (Formbook)", "value": "aee812e05fe0c691d2ea6278ab4f990208ad1725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323185, "uuid": "6dca4f35-f873-4ddb-a48f-66c22729e228", "comment": "Malware payload (Formbook)", "value": "3ae5dbedb97bc576c2a90462e295ff62ce3645c214ac6eb39a07396b1ce5747168ebc22c2a207b3ba6200bfe88709282", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323185, "uuid": "e15fd89b-4855-4b18-916a-2de6a2e0d347", "value": "T143E4F0787217AEA7CBAECCF2518C63411BE733B77ABC755CAB1E04D10A867D4189C492", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323185, "uuid": "ae291f71-cf26-414a-bc24-bed1aae4bf32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323185, "uuid": "7223f7e8-8ec5-4237-8326-e036a686ecce", "value": "12288:GFsjs8mStV1bDyPmJeVW0/5p4mITK+L6Cxu1DZ6JF1NF6HU3RK/:aOJGPmJiimI2CxusF1Nek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323185, "uuid": "06c88e92-5a97-4a89-bd5f-27dfa1037be3", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323185, "uuid": "ae842eb2-2850-4e0c-a71f-4cbc04aa795a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323185, "uuid": "69754653-1840-4fcc-825b-e7df000e0d80", "value": "(PO) No.W2201091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd22a115-e2b7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682351483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682351483, "uuid": "cf796d4f-0676-473c-89d6-b05bb2c7c760", "comment": "Malware payload", "value": "6c4bbfee903e60a7b43aa66162b031a7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682351483, "uuid": "8072400b-8213-4e49-867a-338c3c70110e", "comment": "Malware payload", "value": "d4053dd5e65d83ffddb054a89aa08ba986623e6337f1b20683e89987959fa53c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682351483, "uuid": "6d857ea8-64e3-493d-8475-a44337dbb499", "comment": "Malware payload", "value": "0acc75875f25d347f1c2702bd3de5d8b5703ec90", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682351483, "uuid": "d87adc42-78c7-4e9a-b4a6-6c0a1b98b007", "comment": "Malware payload", "value": "aa8744eaa18baff269b902697b53c1e57098ff6876bfa14c9fcb58feb3f299c95051c1c2745a219ecfee26c4347845b1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682351483, "uuid": "8074b509-f40c-4117-91cf-eb8e26a2699c", "value": "T129F433B8223631EFF76DDC317751ACCE1F8BA7691C052991487E9AF89399C904C8F44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682351483, "uuid": "0e954382-3369-4726-8ed4-61cbf7447dca", "value": "12288:4ML7nvXmv6+DK7swfBRuSDPeCRuZWv9IL0WWe+DrFw/5NueXss3QcmK+Qlz9xHUe:1mv6OAdf7jebWHmcrI5EecsveQjx0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682351483, "uuid": "0402d01c-c54b-4b6e-b4de-ef0554b11ef3", "value": 753263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682351483, "uuid": "ddadf07a-2829-473b-a8d0-6211c205f29f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682351483, "uuid": "f0798c12-dd84-46b2-bac7-693c65d23c6f", "value": "Documentos_Bancarios.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcfde3b-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333442, "uuid": "08221e1a-e299-481a-94ff-8db2ad775c7f", "comment": "Malware payload (Mirai)", "value": "c3df5ca91f504fd56db035ddedafe48f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333442, "uuid": "4ee1e895-0a17-4e69-9112-240b096e9d46", "comment": "Malware payload (Mirai)", "value": "d42aadd3e9092b77f6944c78f48df15fc6d9545443172e962fdd52a770b0396c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333442, "uuid": "3cfd9934-3012-4181-9761-e1011cce0ddc", "comment": "Malware payload (Mirai)", "value": "5e7a09ca054678bb42e73c69022d7a5cf1bb0978", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333442, "uuid": "8d179b0e-e6dd-425a-84bc-875b35471a05", "comment": "Malware payload (Mirai)", "value": "446d2c0a9f95ce3ec24f076155bcdfcac10c96a04c34958d42ea4453eaa01cf7eafc7f305e8be060c6c3ad4011ff86e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333442, "uuid": "5213473e-815e-440b-8ab8-f85eb8e478dd", "value": "T1BD730856B8814B12C5D5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333442, "uuid": "192dc611-0128-4e93-8c86-771bf5a45eff", "value": "1536:mln25xPBXk1wnnkL7+KE007wUZ86aSd0TIqidNzsvHTGsV5GYIW/:rxpXCMkM/vjaUNzsvHqsVERG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333442, "uuid": "c3fc1832-ab45-41a0-8c22-5564b9a36fca", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333442, "uuid": "f29b6dc9-18f7-4f4e-ad05-55a1cac8357e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333442, "uuid": "f38c2723-c8a3-42cd-a244-1f237acef888", "value": "c3df5ca91f504fd56db035ddedafe48f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517ef182-e28b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682332351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332351, "uuid": "5f7628f7-c697-44e8-91c4-3aaab78a9204", "comment": "Malware payload (Mirai)", "value": "e47421e8d2d896d4f23d366e026c3864", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332351, "uuid": "32d9dad5-89e8-437e-8f18-2918f60ef843", "comment": "Malware payload (Mirai)", "value": "d4ae6fc653ae18756523dd96cb92f0c9b213b15ddaf665b106d61a809945d256", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332351, "uuid": "28820093-f1b6-4d54-8898-ba1e73c1de5d", "comment": "Malware payload (Mirai)", "value": "9c8e1af914edc954992dfd536cdcdf1ae409bd3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332351, "uuid": "60dab5ec-72ef-4bce-8e3d-0a4be42da02e", "comment": "Malware payload (Mirai)", "value": "8c65279f9eaf2f69aecfcdd8ee753f567b9c8caec8834ff495457652430e85de7e1b2c43e338898b2ae4ceced8bbda75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332351, "uuid": "a9bbc931-fd6c-4d01-92c2-fab435ac9f18", "value": "T195633A21BA761E1BC4C1947621F74B25B2F143CA26ECCA0A3DB20D9EFF71A446543AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332351, "uuid": "413606aa-a5a8-459e-861b-2efc2e25ba42", "value": "1536:lGBVg7AOotXhGIAsQXt3A7Q5Qm75YH/tatqV:lSCzxBVQmVNkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682332351, "uuid": "76bb1bac-67db-453c-8f12-75be3c36a003", "value": 67312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682332351, "uuid": "c9c076eb-8514-49d2-94b3-daaa6a398b2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332351, "uuid": "346ae0f6-88d6-4452-95f3-729faacdb49a", "value": "e47421e8d2d896d4f23d366e026c3864", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9530118f-e29c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682339766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339766, "uuid": "37478ce3-09b1-40ae-ad3e-925cf5729edb", "comment": "Malware payload (Formbook)", "value": "bbdee2251cb043a5934e0158999e5352", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339766, "uuid": "c8f453b4-7605-4ddf-9bfd-444ba1ecfe6d", "comment": "Malware payload (Formbook)", "value": "d52990c3733f37b8d26a05d7db3864d5815bdfe6ecbaade840b81402e3cc29e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339766, "uuid": "ae689f7b-0e1d-4a48-b7c4-b21b2ecc1d6b", "comment": "Malware payload (Formbook)", "value": "6d4557d1b67a9bb3626ddc6a8bd474fc53bd9887", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682339766, "uuid": "859606c6-dd75-45eb-a653-fb6b352b01f5", "comment": "Malware payload (Formbook)", "value": "7ab923708363ad9b2f735a7a5fe0d954f96f61c2e4e1de2282f65662cbfab710dac01307ec162341dad33660e18af045", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339766, "uuid": "4aff318c-d86e-4b85-a415-42651047f29b", "value": "T178E4E079B1279B57C7BECAF00248224527F63BA7757CF1ACAF4E30D416B678009685A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339766, "uuid": "a86eeed1-8677-4f79-8c7b-10d862a6283a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339766, "uuid": "73b88609-3c52-47e2-9605-164a7275b17d", "value": "12288:S1y2iN3RrtfMuL7GJhYBzLXDOGFu+OOhZMNCP6Bk6HSt:J11Rrd/Qh8zLXDz5OOPCCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682339766, "uuid": "40317650-3478-44fb-a878-2ad55b1b8236", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682339766, "uuid": "f787fbb4-cef8-4d1e-9064-78d87aef861f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682339766, "uuid": "bf0656af-9ec1-4f90-954a-5c65285a05ff", "value": "\u53d1\u7968\u548c\u5e10\u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6452c417-e2b9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Socelars)", "timestamp": 1682352139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352139, "uuid": "a0bd5cd2-c9e9-406e-95ca-0f7b761f3bfe", "comment": "Malware payload (Socelars)", "value": "d2a6aa2b8821faa94e05ff9d8d4731b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352139, "uuid": "0cec6df0-500c-4b53-8569-2bf63c05e48e", "comment": "Malware payload (Socelars)", "value": "d65dab12757773835bd716a75cd40f06cd5435ead71ddedbe7ee377d1c29532f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352139, "uuid": "abc4c85e-f20e-4cfa-893a-9581b9b74c2a", "comment": "Malware payload (Socelars)", "value": "4a514f96b09d4f252477bc95f7e5b2e1bb77b33e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352139, "uuid": "854ca2ec-34dd-43cc-841f-673743fad352", "comment": "Malware payload (Socelars)", "value": "1446e56da49c4ae9a021f19bdf5a6770cbd6b8d6a547d473ab09bad26076baeacdcf1bf73951ad90602dd3aa5987d3ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352139, "uuid": "d4ddf40d-ed92-4497-8283-3f16b0c86092", "value": "T1C8841252F7E14878D073CEB05C90EA62483B79655C7CA40877ECAD8F9F3B681825A793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352139, "uuid": "aaeb52c0-879f-4f14-918f-c10594a92ee1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352139, "uuid": "591ef806-354e-42e8-87e9-bed7821807ab", "value": "6144:x/QiQXC1Jm+ksmpk3U9jW1U4P9bzJVOGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZ4:pQi31s6m6URA3PhzPlL//plmW9bTXeVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682352139, "uuid": "25b29370-3905-4842-b669-dcfdb85d6ab3", "value": 390096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682352139, "uuid": "eaf5a012-9fc2-4e88-9e25-9ca6acf95b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352139, "uuid": "ae5ca1ec-a9ec-4f80-aaf8-e2a7d8fca7c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd2fada-e265-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SystemBC)", "timestamp": 1682316130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316130, "uuid": "3f2106b1-2e06-4229-b649-90a9f517b011", "comment": "Malware payload (SystemBC)", "value": "6c04ea279fe9be8143546f933cfc62b4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316130, "uuid": "39dd5be8-5eb5-4102-8e8e-4b7d8eaff759", "comment": "Malware payload (SystemBC)", "value": "d6a1e00751999d2e03f717c83d28a17e57be56ac076e0a65f37b4c7c54558182", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316130, "uuid": "de509a38-c7c2-4c46-8eb1-74cba1db45d9", "comment": "Malware payload (SystemBC)", "value": "f390a4a6bb1f6ff8fe2aade6aef338228952aace", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316130, "uuid": "60edfd33-1fa5-4164-a009-4fe36239890b", "comment": "Malware payload (SystemBC)", "value": "58a31d94439e3efb8305887970432ea7551d5303dd6ff668613f965a6cce07a85bac7af84c0d4d4676ca7dc63cb72a25", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316130, "uuid": "ecfc250e-6fcc-445b-8ab9-934e9b0d64ec", "value": "T1A455F0732D442951D1A4853458B69BB261AEAE0BF51EDE2DFF46F76807FA0C2BD83801", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316130, "uuid": "e2976cf2-7c78-4815-8999-50b7b9ed18c6", "value": "d6b409ddabcd8c1960090382973e1891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316130, "uuid": "4171d06e-7b3b-470a-abed-cb1042ca17fa", "value": "24576:TqN2ZgQJC24bHwAVob0jDsL5Dv59JzBXffcOLUnb7z/wQzXMIgfmbaZ1q3QIbBTA:TqN2ZgQJC9bHvGbrzJzBXffcOLUnb7zA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682316130, "uuid": "997d457a-d088-4f14-9365-868bc2cc7483", "value": 1293416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682316130, "uuid": "c8e78ebc-bf73-4376-91c4-9ab97191103a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316130, "uuid": "9dbeeff0-9a06-4d0b-8025-c0cd58b6abda", "value": "6c04ea279fe9be8143546f933cfc62b4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ace2ab6-e256-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1682309711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682309711, "uuid": "d206710d-e7b3-45df-9916-6de4c5e85b03", "comment": "Malware payload (RecordBreaker)", "value": "ac51dec9100c94c3c9314ce23b77059e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682309711, "uuid": "23776e7b-e4df-431a-ba80-744d18b13407", "comment": "Malware payload (RecordBreaker)", "value": "d6a3a9addf9afff62cee54803001abf1ff79a205a4df1967429235eb5375bdc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682309711, "uuid": "4ace5fd6-23b7-4f59-8dc3-06797d95cc7b", "comment": "Malware payload (RecordBreaker)", "value": "2231639c4bd55eaa18859d2ddd9f59709ac2f2b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682309711, "uuid": "7a549d9b-cb70-42f0-a445-073ac530cdf8", "comment": "Malware payload (RecordBreaker)", "value": "2556638f151f69a958680e00f03229b54715e471458b8313c8a502c5a2c1af8a9d6218a0f55104c3cd9fae5964eaa30b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682309711, "uuid": "642ff0f0-ee7c-43cd-91c6-df11b55a4385", "value": "T147E633F671F850CAE3E38D387FEA7D24B1F5711641C19B3D348529A12B63B50710EAAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682309711, "uuid": "fb0b7e45-b1dd-4dcb-8e6f-ba5cecbded38", "value": "1b3911321150a9662fa1b0f22689c572", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682309711, "uuid": "de6c2f33-a75d-4083-b89b-26523007d38c", "value": "393216:55bUbMEtLjwQOhwLXacTOaZvDaY9j2/cVzxga:55bmvwT8qcmY96sxga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682309711, "uuid": "75864271-74ce-40a7-9a0f-17b4a9d554c6", "value": 15128064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682309711, "uuid": "6d0dcad9-efe7-461a-92b0-a649b897ecbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682309711, "uuid": "b2304a60-31a6-48d9-b361-8596ab5eefac", "value": "ac51dec9100c94c3c9314ce23b77059e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2868fa5-e284-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682329588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329588, "uuid": "372dcecf-a815-4b27-ad02-4fdd36edd5c8", "comment": "Malware payload (Mirai)", "value": "9feb05738617b00ff30f298848322c7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329588, "uuid": "23cf73bf-e055-4bda-a70e-e76f8876e56d", "comment": "Malware payload (Mirai)", "value": "d6ebc130dbabbfd85f3dcdd123807acfb90148747fea274b02c0415e61581740", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329588, "uuid": "83def8dd-3fb6-462f-8b97-649db2486e27", "comment": "Malware payload (Mirai)", "value": "625ba7e9a2284de592f838872d1dd59f2f09115b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329588, "uuid": "c8300913-7279-4867-88ff-84c5763edd96", "comment": "Malware payload (Mirai)", "value": "bebb1d4db3217d81bc331d959708a42848f56eea3930d2a36717fb1ce14236e8de3a7b1df9c14bfa491bdf77006595fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329588, "uuid": "7cf7e89d-7363-4d7f-a0e2-094c4d95a3d9", "value": "T119830746B8C28E15C6D413BAFA1E118D332767B8D2DF7222CD105F2573CA86F0E6B965", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329588, "uuid": "27f4fddb-5ceb-483d-b9ff-ad84b419fc76", "value": "1536:3RnUh+uDOCfBGxMqzhycPtxPzLDbn1gF+NrpriTl3zj2IO85Btx33:qhMyBGxvhHP/Db1ql3zj2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682329588, "uuid": "13559472-1c31-4cfb-a30d-ac4e8b4151ab", "value": 83244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682329588, "uuid": "2bbbee66-3902-44e2-a651-1f6843c344f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329588, "uuid": "6231990b-5689-447a-b277-098c0ce47ee9", "value": "9feb05738617b00ff30f298848322c7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8edc8c4-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682323156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323156, "uuid": "1f34840b-334c-426b-b452-edef988a88e6", "comment": "Malware payload (AgentTesla)", "value": "c714cf120220c48dbe54298b07514b77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323156, "uuid": "7e504fc8-01fc-4b36-8bb7-c996ebdc3e5e", "comment": "Malware payload (AgentTesla)", "value": "d70c92d827418d2ad9b016e79b9e244218a8f9aa87061eb0a53b0c680dd73608", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323156, "uuid": "fc896693-b660-4c89-a78a-99cb37429098", "comment": "Malware payload (AgentTesla)", "value": "465094a431221581ddcaee575c59dbc66328ae1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323156, "uuid": "c12b253c-c14d-49f4-bf52-126de6ed346b", "comment": "Malware payload (AgentTesla)", "value": "bc1497606bd6ff07f804fa2b991ae300d9051b6f2ba57fd544d4ba4e6b2598827f728059bd4a444258181375798e0840", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323156, "uuid": "904c574c-13fb-4f72-a336-7a2d5b78aaf3", "value": "T163F3186892894931F3EE40F5C5BC311C07B2F1464617E75D2EA0ACEB3F467C3762A9A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323156, "uuid": "ba45f63e-91e2-4f38-b00d-a8f96d899209", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323156, "uuid": "1be50773-d8e0-416c-a21d-18bd2bfd04ad", "value": "3072:byw6vLF2N8h2MFmVFv2e+qA3ctYFXzqosCGHXG5AXq:z6kW9g1UcmDUHWmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323156, "uuid": "88663e45-c51f-4193-888d-fd274d27bd3e", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323156, "uuid": "704d0266-6719-45ce-a6bf-e4e331e5d84d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323156, "uuid": "ca98e13e-ded9-4396-802a-5affb393b76b", "value": "d70c92d827418d2ad9b016e79b9e244218a8f9aa87061eb0a53b0c680dd73608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d4c3bb-e26d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682319389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319389, "uuid": "662e4f8b-26fc-46ca-81d5-1b8f6aa4db8b", "comment": "Malware payload (SnakeKeylogger)", "value": "32ac9ae2414087af9851c92f1bf8aac3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319389, "uuid": "59dcf6b6-a9d9-4f95-8d26-ff5be1f94178", "comment": "Malware payload (SnakeKeylogger)", "value": "d74b7b3c23e3280b35cd8c6730912b8d04412c0ed4dbc13d06182a44f38e4a69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319389, "uuid": "1f9b7463-bf50-4031-9b0d-18f6ed0440bb", "comment": "Malware payload (SnakeKeylogger)", "value": "9be212b969e3f60262f354b9c756093c5e51d5a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682319389, "uuid": "961a63c4-01b5-4214-88b0-be1e13f7c911", "comment": "Malware payload (SnakeKeylogger)", "value": "c0d566f7e0363d4f0120f6ca55431b8412c8a65af15fccb379461ecdca5c34d9b248bc4dc0bf4c4d324cc5ef61fff454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319389, "uuid": "394168a9-35b5-40b9-acf3-ea72613be4c7", "value": "T14E152B93A150C8B6E85F05F2E8EA56731C9E6E8DDCB4400D169D7FD632B3372219ED0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319389, "uuid": "cd79cb80-5259-45ce-8603-0d391ced6f7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319389, "uuid": "e617bdbb-365c-43ec-b8fb-895abd27165e", "value": "6144:yCFPEr1p2AhX02OkF5efVEQ0KJkLuvv9OXfIio6Euqqmu2SvpH+7xCwAeywmdI1g:ysP6uvsXfIUz04p+RNaI1IKZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682319389, "uuid": "93e3822c-c165-43f9-b85f-c1e5382d45e0", "value": 935424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682319389, "uuid": "0c772f18-0906-4251-b625-0651aa5313fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682319389, "uuid": "8575f5f2-97df-4a2f-9eb7-30e3cd153a49", "value": "00158007309125259.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f4c0c0-e2ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682346242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346242, "uuid": "77de7fa6-5a3f-4eb0-9169-0afa26bb37cb", "comment": "Malware payload (Gafgyt)", "value": "1736ba4ab53c2ee37604bd7077084b34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346242, "uuid": "8aa11545-47e9-48d5-ad65-6eb79e79e7b0", "comment": "Malware payload (Gafgyt)", "value": "d8006e512b589571e6a2a0acfc7b8a47a09b7d64077c3d6ddd2d53ee866d7f8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346242, "uuid": "4620ebe9-1d6e-4888-86eb-21b348d7aa03", "comment": "Malware payload (Gafgyt)", "value": "c8c0e5038d346ba2e14d7a1021f4f31a42fe235d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346242, "uuid": "37404869-4191-4159-bfd1-ea6c2c243cfd", "comment": "Malware payload (Gafgyt)", "value": "ffa97dbc4c580f741a299ca69e62d0943202832fada7e5dda42c52d8f36f20ab834902d5531c1f0860f8337785132da7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346242, "uuid": "45d94706-f4e1-49e2-a447-445dfe8dff1a", "value": "T1CC632A02A741CAB3D0831AFA06E75B250633F83A1E16DF56F32D7CF45B15188B62B769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346242, "uuid": "30d9e06a-c8d6-42aa-98eb-e7f58502fbe0", "value": "1536:zLVYPCpH1jUdOn4JymPWBSgSh1MtNSr/NbHBDSDmd+l2OZ/fufYEZ:zLUCpH1gdikrEHM1I0rVbJSDmMl2OZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346242, "uuid": "85214a32-e05a-4c07-aec9-4a0b09130f7e", "value": 68252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346242, "uuid": "ca640884-3ce3-43de-b4df-220ccca1244a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346242, "uuid": "2513e4ec-b903-475f-9931-7efeae09b13d", "value": "1736ba4ab53c2ee37604bd7077084b34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04b6862-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682323168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323168, "uuid": "b1866627-f122-4c3b-a675-56a75039954d", "comment": "Malware payload", "value": "8ef73356f326f14caaa0c10061820710", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323168, "uuid": "8f71d69a-49ae-423c-921e-5eb8ef6dcaa5", "comment": "Malware payload", "value": "d803ccd58f389b36cf553917ff3d1412de93661ef662028909cbbee9a5938768", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323168, "uuid": "59cf1dd8-2775-4f06-8967-14975953f5f7", "comment": "Malware payload", "value": "4eccbfbb167e13f9024324ca9fa60412c21985d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323168, "uuid": "8847bd59-0173-412e-868b-206c2854b57f", "comment": "Malware payload", "value": "7b2d25096b45fcbbe6da01d80ea5aaa7ae3ff938129a71caaa63118b34a4e5aff00564f0a29e9d0b0459ceafb850e270", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323168, "uuid": "6f5d782e-85fb-4081-b365-2e656d2f4806", "value": "T132D4D8BE719B250AFE125C707FECE721CB97197ECAABD6F05592E0702D24092EC85817", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323168, "uuid": "bccec4ce-2ef3-4331-a6ff-c152cae7cd35", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323168, "uuid": "9cc704fc-5be4-40b7-a9ef-bc061da0229c", "value": "12288:OpX79uXMkzyGGfrfeq/txSvs5PW+TKI9FiMA4nin8qf1t:m7d9etvs5nZ9kJ4nYhtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323168, "uuid": "77f7683c-5392-47ff-97ca-7d1c1ddc7520", "value": 642400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323168, "uuid": "5d37e3e8-fe4d-4d27-87b8-548da6185e5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323168, "uuid": "7e2cf838-053e-46b1-a181-77c5eb767675", "value": "FACTURA_EVOLVECENTER.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937dd3c2-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303256, "uuid": "605dcdcf-9736-4f25-8c2c-b22aa79277c1", "comment": "Malware payload", "value": "486c8c6c18dfdffc8fc15399ff8a7432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303256, "uuid": "9483d1da-1189-4de4-881d-87986b51cb96", "comment": "Malware payload", "value": "d8c1dd184f63c3527dc89812a86f298119bf8054a1b63eeece3a8dde9cfc8240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303256, "uuid": "98c9f874-46f0-4653-81c2-e814a3a19533", "comment": "Malware payload", "value": "d7a8c305d85de8bd8697ef996cae7767bf53efbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303256, "uuid": "09b93fb1-f91a-4479-99ac-865a1201f76d", "comment": "Malware payload", "value": "1f3067016beda5ea0af4eff6c406c2ba421016ca8319b3d22b5fbd1a73fc25547762ca92bd18389e1f14f95e12a75279", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303256, "uuid": "adbe7d0f-14b2-403c-8d1a-309f6cc31b59", "value": "T15623D619A6D02A1EF5F21A7115F48C292A69FE32AB7CD2AFDA10142E5D74710CC71337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303256, "uuid": "391faf1b-f18a-45f2-9839-a5438ce0c694", "value": "384:+MlrJduDo4lAJCElv30poKLZ0+/IEUhWu+8y3YgbJtAsLiAB5qX:+EjuzVExuNLZ0gZUh28w/F23A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303256, "uuid": "afc97cde-c742-47f9-8ef2-cc8237fda3ea", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303256, "uuid": "3a10ca6e-dd5a-4c5c-ab0a-f90d65bbd87d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303256, "uuid": "35aee705-8715-458c-acb6-4bf6033957f1", "value": "SecuriteInfo.com.Win32.Malware-gen.22876.28380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95710c9b-e297-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682337619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337619, "uuid": "83a33624-f6c1-42da-a3bb-1f4ddeb9cbb8", "comment": "Malware payload (Formbook)", "value": "34e7d74898fbe7db76ebaf4d8932fdf9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337619, "uuid": "2d8df35f-48b1-4196-9cb3-e87f1b4ebcb2", "comment": "Malware payload (Formbook)", "value": "d92d24490a96b1ae551185867cb27ddfdc6aa0c9ea70d66acfef764d9d425253", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337619, "uuid": "67567081-c053-4b3f-ad34-05fe625d7cc7", "comment": "Malware payload (Formbook)", "value": "4de0bd563df722ce117431e48eca3a81348db4bc", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682337619, "uuid": "867a8a27-f828-475c-894c-8d1eeaf0e298", "comment": "Malware payload (Formbook)", "value": "428061e7c62f778df11d93dd39e76745ccc19122d4779340701295eca6694bb70701aeacb991b2e2d03602495ece74ce", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337619, "uuid": "1bed4711-1233-4556-98b3-0e4f8d5422b8", "value": "T1FC05AFB876047DD62A6F576BDE96ADDC03B627239ACBA4CC4064B7C30563376FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337619, "uuid": "54db6ffc-6ec0-42f9-a1c9-5b11a5ded7ed", "value": "24576:WhvxYL8Vwc++Xy2vgfbPEabKCE72k3lDWGfG:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682337619, "uuid": "a6853a74-9666-4673-840b-896e88406eab", "value": 842617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682337619, "uuid": "ac088ed9-c79c-4f3c-8b6c-c07d6d380547", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682337619, "uuid": "0dd46e9f-912a-46bf-ae61-a07836506993", "value": "PO 383822.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfd6a2f-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303243, "uuid": "0158fc17-e88c-406c-bea0-80fb638f6b24", "comment": "Malware payload", "value": "410e4b63fe3285e310e4b69d76de0d94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303243, "uuid": "ea40ce1f-2441-4eae-8989-2d15249e38c0", "comment": "Malware payload", "value": "d96814705e1faa0f06c822713346ca8b1a83b1b310a1db5762e4202461af09e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303243, "uuid": "1cae5d20-60c6-4f10-8480-ec2a8cc965ad", "comment": "Malware payload", "value": "6674a374ed0a373b18cf59c92a806174f3c47089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303243, "uuid": "24747432-39a0-44db-a7e2-523ea1405306", "comment": "Malware payload", "value": "c30cd2cc3605e3328f7576d32dca08ed24c51e1bfd5c5fb123c83568901e9fda9ba9728d3510479858c9ddbbb6fa9d88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303243, "uuid": "42a5e4e7-8b5e-4d08-9266-cfdea5bebe0f", "value": "T1BBF46C02BA92C0B6C6251C3009AA67B6DB7ADE160F15CBC79357FE1D1D322A19C362F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303243, "uuid": "46a9fdf5-02c5-41d7-8d56-f845bc9a37c8", "value": "c2c5dae0f835cea8d1b0458584df80de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303243, "uuid": "ec9775e6-c28f-4627-9d04-9a81b9ee9998", "value": "6144:owIGuwh0P3+K5TUcqDYS/aFf04TWqx25YpDcEGIGhcslM0AY7rAA+Za/HwNFVLK0:xVUWLES/aFscyEUcEM0AVA+ZIQFV+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303243, "uuid": "a23d5542-e57d-49d6-bdb7-5460ca40f217", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303243, "uuid": "f00f3bc1-18e1-4b58-b0dc-99ffded97399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303243, "uuid": "90dbfdbd-8038-49c9-a029-339284c57bb5", "value": "SecuriteInfo.com.FileRepMetagen.25534.3855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58eb358d-e2b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682348684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348684, "uuid": "870ea7f0-8347-4131-889c-267c886a89a0", "comment": "Malware payload (Mirai)", "value": "782ca28abdc64604be1225d5756b929d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348684, "uuid": "91f7b9c0-7267-4bb2-b2dd-6c072512c228", "comment": "Malware payload (Mirai)", "value": "da0d508867d66bd67ecdd82e84cd4af777b3f1b5ba58a83c1b12b0a0fb5da80f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348684, "uuid": "490d0417-8730-491d-ac33-19ae8e0de208", "comment": "Malware payload (Mirai)", "value": "9d0efd9780262b3987fb58743ffc5cc6109dbb13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348684, "uuid": "7a7792d3-0813-4181-80a4-36c428272829", "comment": "Malware payload (Mirai)", "value": "0887a832f8d9cf2a036e6e95b545a303fde5c025554dcc4bdec9fb288602d972513f4febd23cce547b891052d3ac3b80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348684, "uuid": "942f0919-902d-4597-86c3-468635e69cd7", "value": "T1CA532A03A742CA77E1431AF512E7DB210531F93B5B269E06E32D6CF4DF611887266BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348684, "uuid": "59992066-f845-4432-b065-4e719bac97e7", "value": "1536:QhdXOcx6MccLNr0SytEYL/FKplGjgK1JY4MNWMC37JnWQuE:Qo8LNoSySiAGkK1JYFUl3FnWQuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682348684, "uuid": "c4db341d-537b-4afc-812b-97d5ecb2d156", "value": 62562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682348684, "uuid": "3e28e4c0-e01d-40db-81ec-aee1c18740a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348684, "uuid": "fe7f10c4-195a-49e7-9a5f-e6a13c84ac68", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2af15e-e285-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682329656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329656, "uuid": "5a092133-55e1-42c6-af60-666bede3836e", "comment": "Malware payload (Mirai)", "value": "c6cf8077499b1796b4f3e63acdaabc4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329656, "uuid": "8bd8136e-9758-47e0-9fcc-0aab1c53ca68", "comment": "Malware payload (Mirai)", "value": "dae4d9af8465eb2634e75f4276415fe6b4d7be0d8b778f3c5913b6a6eb079e05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329656, "uuid": "de965d3b-4bf7-4143-8d03-747383359ef1", "comment": "Malware payload (Mirai)", "value": "9667ad0b62f5a406fdffe200bfd8d76b001ad89b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329656, "uuid": "2cd2bb59-1f60-4a8a-9d80-d66c34d5095e", "comment": "Malware payload (Mirai)", "value": "ed9e14d74f048604c16037fc3c3d4d7754e79f146adc9d8b87742cff8ee9d2a720b199ab3a0ab960f282d9454ec28c23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329656, "uuid": "06d7ce16-18b8-4809-803d-56fc4e7f3fd3", "value": "T1A873F685BCC19A13CAD423BBFA6E418D372523A8E2EF3217DD115F10778A82F0D67656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329656, "uuid": "168f6a69-003e-49b7-8a4b-7445db8286c3", "value": "1536:jlqW3059RsVhh8XwcG0qTHsOsclDs7G7pMUPe9WPndlof85BtN33:jl/305umG0qTHs9TS7pNe9WPHoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682329656, "uuid": "a261157b-9fd1-4331-98c3-f48e6377bd1c", "value": 75856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682329656, "uuid": "b3f6d9bf-d84e-42cd-ab42-cb6b69201637", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329656, "uuid": "6bdaa4e4-b5c0-4567-a989-752bec0531dd", "value": "c6cf8077499b1796b4f3e63acdaabc4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb9256f-e26f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682320616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320616, "uuid": "44e289ec-9da6-4628-9aeb-ee766572a8d9", "comment": "Malware payload (Mirai)", "value": "d133caf3454db4c646bc82b58f5a98fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320616, "uuid": "dc2b0a02-5849-4604-89c0-c636c5f646b4", "comment": "Malware payload (Mirai)", "value": "db2d1cd54601098da4d36d293c52c3a709f5a7994ef59a906b1d21d7e6718c80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320616, "uuid": "f33175b3-9ec6-4c57-a78f-bfa81c58dbac", "comment": "Malware payload (Mirai)", "value": "d321ecf0ac94c6d7758fccb55dd1e24e6283ca56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320616, "uuid": "1416b5ce-3de3-4df6-98fc-a32cc48c5d53", "comment": "Malware payload (Mirai)", "value": "5b63ddcc40c860e1b7d260cf71db931faebdd49b1e13a40c1229dfa92628aebb3b5594ef1487017719e171b75ed1a818", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320616, "uuid": "6cfa03b4-c8ca-4baf-863e-4175fca59cf1", "value": "T19363830ABF654FB7EC6BCC3749A91746258C641A21A93B39BD34D828F24B24F15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320616, "uuid": "56c78ff7-acfc-4eae-842a-f8ac2b503249", "value": "768:LZVoM3EYlDPhu9+3DxL3gPcYwu0L5c8eDerIeWHtoNgpkw+tXiWMIU3q:LZVoM0YlLxj2cLLp+KIRHapJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682320616, "uuid": "a52ba08e-f196-4fb3-acfd-16e91fa1bdf9", "value": 67692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682320616, "uuid": "062f4224-2142-464a-bfb5-9a5097ca0874", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320616, "uuid": "6539a0a7-9991-4d71-afab-a7cc8b05ee26", "value": "d133caf3454db4c646bc82b58f5a98fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548e7062-e2d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682363280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363280, "uuid": "7bb506d0-d15b-4ee6-9454-4215db596b6c", "comment": "Malware payload (Mirai)", "value": "dbbc0fc11e64ad3a374ec45a659634a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363280, "uuid": "c066b418-665f-4411-a9d4-1800abc45c6d", "comment": "Malware payload (Mirai)", "value": "db63460572324b398bae53fc299b0ba7d32ebc10ab7d494efee52f57019591a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363280, "uuid": "1ea065e1-1e08-412f-a2c2-fd5c03801e82", "comment": "Malware payload (Mirai)", "value": "d965c60767242f6951ff3a17f4be3369c7323227", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363280, "uuid": "70007647-b93a-4a85-90d4-5bec9c9d2024", "comment": "Malware payload (Mirai)", "value": "9f7cfa795ad418a00f4881c0ca7b9920a88f6d0a3b13219e405e82792b8b1bf0d13eabcf6618d9e4406593b974ef2f15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682363280, "uuid": "d55c5779-2bb0-40ea-a538-99b08fa56c13", "value": "T1E9636DC4EA83D4F2E86306756177F7335B32E43E1029DA87E7A9AD32AC16501971739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682363280, "uuid": "861cc07e-e0a5-4bd2-a042-2b35d24e5f9f", "value": "1536:i7iGrdbVdc0f2qeJpB7CEzZc+kukB0tHsm8g2CGm1lg:4lbV5f2q2BC3BfBCMmfrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682363280, "uuid": "dec084a4-558b-4d8b-be6f-fdad9ef57530", "value": 70696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682363280, "uuid": "e66ae57a-266d-49f0-816f-b98d15fb6f7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682363280, "uuid": "af50798d-9659-4d3a-a928-029c8e17f9d2", "value": "dbbc0fc11e64ad3a374ec45a659634a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a862e25-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682346915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346915, "uuid": "7cd2d88c-8a99-431c-b64e-5457a1d9a5c2", "comment": "Malware payload", "value": "f058e33ea9de734596ee82b80806eef5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346915, "uuid": "3aa17c04-0e96-4182-a061-87cdeeaf7ea0", "comment": "Malware payload", "value": "db88c0fad58337588ab4639df2a67b3cdec1d806962529561e2b4a2718c3986f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346915, "uuid": "342a8808-6c9b-479e-b5d9-1492011626cf", "comment": "Malware payload", "value": "f6b6fd6e46ec2b3c6687065ac1dc4ed0572c15df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346915, "uuid": "8c5b40e8-9c80-465b-b606-a1c315d402cd", "comment": "Malware payload", "value": "22b2c984175925ebf2963ffb55fdf71b27d38ddf58c0fc431b671279ec5f41f3e9a04a5b7a611e7cf6f30e529cfe6218", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346915, "uuid": "839d9fe8-fc78-4d51-8c91-5281f46479fb", "value": "T12B15D0F724C6E2EDC449D9378753FCAF868FB8364419A6F3E05CA2264D26D407653E0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346915, "uuid": "201cc605-81b7-4561-8eec-35e5d9c9df94", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346915, "uuid": "eb5a47df-61c3-422c-b182-c20dd5634c04", "value": "24576:S8a22upMe1xiUvdiyzUdXXHNCU3l0R1kTup:SZWMqic3obV0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346915, "uuid": "98167899-8789-4c72-9b72-4eecc4296ee7", "value": 926761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346915, "uuid": "d4a65e38-2ecd-4611-ae67-2b8178a9ffef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346915, "uuid": "358616a7-eb03-4392-838e-44b39b2f8141", "value": "f058e33ea9de734596ee82b80806eef5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68aa1158-e2b9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682352147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352147, "uuid": "4781d9d1-bcc4-4338-9847-47735e5ac0b3", "comment": "Malware payload (RedLineStealer)", "value": "b6cace91e5660f2ca57f53fa92728f52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352147, "uuid": "465b084a-c678-4b6e-8eb8-d0746103d2de", "comment": "Malware payload (RedLineStealer)", "value": "dbe83950fd493fb4349eec5027132ddd9689c5fe03987d2f4a82a46d940718f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352147, "uuid": "8feaa6a0-ae20-40b1-bcc7-be8e862af811", "comment": "Malware payload (RedLineStealer)", "value": "2d26d646834b0c33c3c7071fe888c660898476fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682352147, "uuid": "b662d591-da6a-47cc-b8f8-9ac09689b426", "comment": "Malware payload (RedLineStealer)", "value": "12c254c7f86934aa99e4480c2dc24b513f285c6c6f44e9cd7c78e3dae38f896b17169c5cd6665f1f51cd76b2f707d5d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352147, "uuid": "4d1d73be-87fc-4131-9425-2e6f080d657c", "value": "T1CAA48D9263D07837E2269B728D2ECAF4372EB1534F167ADB66589A7F0A701F1C132345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352147, "uuid": "f8c0a206-2d5f-4a43-88ed-a82bcd5b62d1", "value": "c263ea9fa71edd34b56a166511864643", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352147, "uuid": "fa6f5d7b-3126-40f5-83c9-60c8a8c49a34", "value": "12288:HLzOjr2mtatCk232/+8Tv5nx0v2gcvjgq:HvOjrzotX2GmGFx0v21jt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682352147, "uuid": "1c134f7c-e0e0-41e9-b950-d6b5ceb33aa2", "value": 470528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682352147, "uuid": "775c1d3b-c166-4f84-ac6f-e19008de6e5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682352147, "uuid": "a4204b5b-146f-42a5-a77d-203c2a3d1139", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8192225-e290-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682334644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682334644, "uuid": "8c7ee46a-287c-4f14-90b1-351b2bb88a0d", "comment": "Malware payload", "value": "143948a6d45ca6497010e0772324ffed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682334644, "uuid": "69315701-3823-49a5-8546-17e97f6ef0ec", "comment": "Malware payload", "value": "ddae5f6763ea020d057d447c02cd235be4fd7333a8f31a65320072a2706b07bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682334644, "uuid": "05091c5d-79ac-4264-a9a6-48ea788b80c1", "comment": "Malware payload", "value": "fb285ae1044ec902e5827bc1a5804468483a06b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682334644, "uuid": "92a83c12-2b4d-4557-be88-882ea55bd9de", "comment": "Malware payload", "value": "5372a2b4a7d014787b3b858d396cc55b6ff8b1762c8e05254f73101131aff475a0900368bb0a65983a4bf6af32e434ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682334644, "uuid": "7b64bd3f-2a77-4540-a32b-d5ab490510e9", "value": "T1A665AE0E77AA923AD9B36534CB7582256E6BBD400B1587D3E3D03A494F34DE17D322A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682334644, "uuid": "82c16128-07cf-4192-80d2-b531576dc9ef", "value": "547ad02314534f2e74315cc85352825c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682334644, "uuid": "cc7ad3bd-7d41-4cd9-867b-7c32fd0a5514", "value": "24576:YD1YS7FpyUxT3DC2C1zj1SqdAGFQZIxSC45UJoeXA:rQ5xT3DDazjYq+ZIcL5UJoew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682334644, "uuid": "5949e7c9-dbe3-4955-aa9d-666d6fbd8a14", "value": 1524456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682334644, "uuid": "7035455d-2ab6-4164-80dc-dcc28f5685d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682334644, "uuid": "ff497a3d-a050-4495-ac7e-e5c756640f8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f575b6-e284-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682329573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329573, "uuid": "a2b30270-5aae-463f-9b8c-9bd8e4391b2e", "comment": "Malware payload (Mirai)", "value": "46719ae4c4f1768b3f4d07a9f10859f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329573, "uuid": "7c042f73-67dc-44c9-80f3-89a7a2f37b97", "comment": "Malware payload (Mirai)", "value": "ddc0638302f7e766c38c1a8a18f8031274f1cf9215c32e7682d8f075ac952189", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329573, "uuid": "9649419a-7b0b-4f75-9fe7-f1f06ee00119", "comment": "Malware payload (Mirai)", "value": "693ff38ee734bad5029e65786994040d54b09242", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329573, "uuid": "d3908357-c78d-4cd4-adea-a5967c4d582e", "comment": "Malware payload (Mirai)", "value": "6ff27d3b6c35161e9149816e52cc7ccab48e040e32b8ae64dfd936d9f39284b16f1937f64c2925e01fbca1b433f466c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329573, "uuid": "f5accd66-1ce4-41fd-901e-21e8459f57ae", "value": "T15653F882BCC29A6AC6D063BAFA6F519D332163F8C1EF7627DC100B04778A51F5D63A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329573, "uuid": "5a7260c7-c577-4c29-b331-d9b4dc815bd9", "value": "1536:1J6Gi6UsfI17j9SUWpcoEKKbOwlDs7JYpQaUqDM085BtN33:1Jhi6YWpcoEKKKntYpsqDMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682329573, "uuid": "758b30c4-1405-4dc1-9f19-1e23180c3ac3", "value": 60928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682329573, "uuid": "c84831b1-abd4-42ff-8668-04f68f8fe967", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329573, "uuid": "cd2c5372-ac99-405b-8c6b-d241ea633193", "value": "46719ae4c4f1768b3f4d07a9f10859f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d777f578-e2ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1682346320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346320, "uuid": "c4de5996-4c58-4d01-9572-6679e8bfa0c5", "comment": "Malware payload (AveMariaRAT)", "value": "dfa2691d56a8ff0c37b42d6afaba7f98", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346320, "uuid": "6c5f5026-0e47-46da-8cc0-1d1e7ff9573f", "comment": "Malware payload (AveMariaRAT)", "value": "ddc7c1ff2ef0f6881e292bed1fdd9f9eb503c9b2bf7d7960919b459012d572b1", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346320, "uuid": "c338b98c-7817-4cb2-b9c1-8a89ca8a4ea0", "comment": "Malware payload (AveMariaRAT)", "value": "af82242fdbf9c9b9bef1337c6175e7931e8ecd49", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346320, "uuid": "322ade3b-9859-4775-a98d-ec341a92f4b2", "comment": "Malware payload (AveMariaRAT)", "value": "14ea04785b11b80920dfc4e7418f12183568a7f53b41eca2b4f3c309420f27c8e915797696b14dbfd66b125a9856ca42", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346320, "uuid": "9f5e55f7-4a9e-469f-b727-19f22a59a783", "value": "T133D4AE1B222AD5B6D55E56B3D0E617FB0F6C2ECAEE79908317A87CD831723BD1B08441", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346320, "uuid": "7b3b1886-44cd-44d3-9c37-9e4fb97de795", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346320, "uuid": "fa7e692b-1312-4634-8345-43cb0a10212f", "value": "12288:0s28nrn6n53m4Sa8dEfvhX72fUMEP7R8krI8Es1j:04nr6n53m08dEfvt2Di7LZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346320, "uuid": "afe6e892-a342-4ac7-a05b-6d5174bc30ba", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346320, "uuid": "e26bae63-2ac0-40eb-8ff5-edb57f7c9bcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346320, "uuid": "61f93bce-6897-4bf8-ab8d-c6bf124ed202", "value": "Swift_240423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a286af3-e2b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682348633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348633, "uuid": "c8783890-cbb0-48f4-bbf6-2467ea10c995", "comment": "Malware payload (Mirai)", "value": "5d384ea701b1b5995b1a835e6b938829", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348633, "uuid": "7f836272-b491-4b50-ae6e-505be53d84f3", "comment": "Malware payload (Mirai)", "value": "de02473934ec1dd2b2c3ee2cec5fff0c66df5a12e3849633d7faf8acf939df42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348633, "uuid": "48a9ba17-a612-4c58-b685-dde94eea2b6f", "comment": "Malware payload (Mirai)", "value": "ffcfb26434b41086785f13a35764771d9086a87e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348633, "uuid": "33508d1f-49ba-4265-bf97-5203f72d9ecb", "comment": "Malware payload (Mirai)", "value": "0875e75731f03c6b4e6f6ee4f83cf7982002c5a378d7d9ac09b571c3475de8c2a545b28202fd843e32465f7de2a4fb93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348633, "uuid": "7079e505-be3d-4de6-a818-88c92612018d", "value": "T1DED37C87F6079DA2D8910BF58B83478C6FA351008FABD7E37D0E16784E91ADE5D1A780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348633, "uuid": "5ef5e144-110a-4faa-9527-d5305c4d876f", "value": "1536:g1ZxNsysJRGvd98MiwraJhcQvNl2FgIKpvj/LWbMr821A8PaFlcmhSB:IgysJRo3XVeksN4FgDjqIrPHmhSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682348633, "uuid": "18774e57-c29d-43ba-9063-c8a050755e09", "value": 133804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682348633, "uuid": "09b24284-8a7c-4400-a354-82d2620b762c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348633, "uuid": "349143d4-dc0b-4ebb-ae44-123432a4cd80", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad99362-e28b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682332340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332340, "uuid": "9a78aa7f-30a2-4d07-8873-7f100301462a", "comment": "Malware payload (Mirai)", "value": "24144eea9e3257eeb03701ea59f5cc50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332340, "uuid": "561b6277-5412-4529-9af1-17fc880b156e", "comment": "Malware payload (Mirai)", "value": "def7e2bdec50d7131e1d0cf6ef7589892378620f6e2b0cab8b8d93d0ce8004c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332340, "uuid": "0602e1bd-5a2e-4523-a6d0-116f078f62ab", "comment": "Malware payload (Mirai)", "value": "01920e0c68be1eefe6acaaa809d8c4be21805012", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332340, "uuid": "0eae55b0-a82d-4c1f-87d5-d22d17172e0d", "comment": "Malware payload (Mirai)", "value": "eccc945c584901831ca64bd3d46d064fa67b26d5364d3bf893580fe8bd4969744ec08301a2a539aa973fe3f0e4dba901", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332340, "uuid": "c133b623-73eb-465e-9fe8-972502e1dfd9", "value": "T1CBD2E0B0C1DB78E1EAB41436E2E557C317972631D2FF38635B2815A92CE428875F12A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332340, "uuid": "29e8c31e-6d66-44f3-9623-4e8acffc28f2", "value": "768:wA4uBc0TyiYxgfiDRm2TlRNNI7iBNs3UozZ:wPuB7zULRHgzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682332340, "uuid": "b5cecfa4-abed-444b-b53a-58ffca8b0db9", "value": 29952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682332340, "uuid": "cfa115e6-35e7-42fb-aa2d-39742f29e018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332340, "uuid": "570bf927-f3fd-461a-84ff-534246d65c18", "value": "24144eea9e3257eeb03701ea59f5cc50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788718a7-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330269, "uuid": "3d5f3aa9-3f37-4253-8b09-211fe47ffad6", "comment": "Malware payload", "value": "e85485f15115853d979fbb61d3d3be40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330269, "uuid": "e055d13e-32a4-41f1-872e-0d51da341abb", "comment": "Malware payload", "value": "df99a29a0fd7f62e3798260b2068c711a5356346b7b0c0477e30643138345fba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330269, "uuid": "b6110c3d-e177-4dbd-b9e0-ea238615c3a0", "comment": "Malware payload", "value": "2a70d4662ba377f823099b36c467f5f954a0d5b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330269, "uuid": "d1c54b1f-d75e-479e-8faf-cda1eda3665c", "comment": "Malware payload", "value": "0261fbe95bfd2df6a4108f6084bcc7e033bcfd297884fbf0767e6e56fbad88e18d85303ddd34a51651b4d5eda4f0debc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330269, "uuid": "b094a304-9195-4371-ab74-0d3805ca8e55", "value": "T15D36CFEFA4046B38C129E271C08F9732C837F3951B27C34A9A90D5626F9D5B44F6FA61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330269, "uuid": "1839719a-6147-49e2-a794-6b4c1e55c3d0", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330269, "uuid": "3231f37a-c2b0-472b-a5f5-b189f28d3296", "value": "49152:hoxh6VGeSoP8OsV7LQMrm8plR7BoRB4CyNDJ/7IugZXyrDdpQSolTxoFdnGc/6i4:yhKX66yZd7jgK4SMxmdnGc/6iA0htLqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330269, "uuid": "32a04f73-b042-4ee8-b758-02407b90a05d", "value": 5143864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330269, "uuid": "e986e6cc-85c3-4728-8d7c-22d91b6211ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330269, "uuid": "61b51e41-84e0-4f49-a477-7814be385def", "value": "df99a29a0fd7f62e3798260b2068c711a5356346b7b0c0477e30643138345fba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8784ef43-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303236, "uuid": "48773955-b308-4fae-a0c1-fc939cff4e05", "comment": "Malware payload", "value": "18cce99be5464da27d0e3e90f12ed87d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303236, "uuid": "42a3c34c-1ac1-4aa6-87cb-7f2721923b3b", "comment": "Malware payload", "value": "e0120f44c719a33652b213515bc91d85d09481236e27bb4463a8528088a96df1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303236, "uuid": "11f6952d-0d10-4a84-a2a8-aa4fb5d086aa", "comment": "Malware payload", "value": "69ceec352f6611597fdaa3d795bf83e8383ddbc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303236, "uuid": "4cf75319-6eb3-45e1-973f-cb6ec835869a", "comment": "Malware payload", "value": "bf12c7803838f8e9996937e0e81405fa05e45f2e5a5ac589984665d2509f60dfb6103ff51cdf0fb6f2eb02017a480af7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303236, "uuid": "65d58909-549f-42bb-b17f-f86b8fabe4cd", "value": "T17A138E17AA94082EE4BE00354D675EB89E95FC31AC22933BC2F06D8EBD717807E515BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303236, "uuid": "b642050d-e32e-4ea1-96b9-db80bbf244f6", "value": "d61a02577ca812e4e12ae94a969ebffc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303236, "uuid": "ae21d116-cfd8-4476-a213-931b387a156d", "value": "768:0LJ/caFhIZWfbM3uQA3S3h7mtKpa6s9b1nYuooIaWX7:0GaEZWfIeQqSl8fooIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303236, "uuid": "cc42749b-9b5a-4208-ad6c-5fa112dfd0d7", "value": 44612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303236, "uuid": "9a6df945-80bd-454e-92b6-5ad74bb694de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303236, "uuid": "5472e3c1-2f46-40cf-ba2d-b74e128764a4", "value": "SecuriteInfo.com.Trojan.Kazy.391.12632", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78845d73-e2ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682346590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346590, "uuid": "3d50f84c-30fe-493c-9fb6-ebda24d311d9", "comment": "Malware payload (Loki)", "value": "d8f752aa33c54bc076295cc4917e5b6c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346590, "uuid": "1ac3f4a6-b7e6-4cbc-821f-a4b254cc91a3", "comment": "Malware payload (Loki)", "value": "e052206ce8d4fc1107000f06a8267d47f44cdabb3207b5adfc5626e0150d8dda", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346590, "uuid": "d1b64da6-0769-405e-99ba-03e406d208da", "comment": "Malware payload (Loki)", "value": "a031400dcd64829a1486c2806c266e94432cce01", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346590, "uuid": "dff68995-bf58-466a-8809-09944ea8dee7", "comment": "Malware payload (Loki)", "value": "11199aff30b8c825c677cb0e2e25a27a475b10c9c735241bc1bb81bec7af26052cee0497830295c7cdd01105c30b1462", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346590, "uuid": "1705f519-5bc9-44be-afde-b89d4bbbd3e2", "value": "T1EEF2B26ED34F02A4CF566376931B4E4946BCB22EB30551B234AC533433EEC2D8A6667D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346590, "uuid": "43fde7cf-4413-4fad-a6f8-63f6ae8b08bb", "value": "768:4wAbZSQY7JtLt8eLQd7aZDT8EaLWqQv/pM:4wAlvWtJ8eLQd2ZDopLtQv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346590, "uuid": "a5e7f272-2ed8-43df-9aba-cfd811e845e6", "value": 34937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346590, "uuid": "c47ba2dd-b482-43be-8baf-f5e1532354fe", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346590, "uuid": "87d27e95-02b5-4313-8920-5239d360a689", "value": "scan-payment-advice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c92e2c-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682330122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330122, "uuid": "6595a018-dedc-469a-8642-46afb1f23594", "comment": "Malware payload (Mirai)", "value": "36a370d43c77ea9cf0f422f8672ef592", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330122, "uuid": "e2d53625-a660-40ed-9864-446b379dc709", "comment": "Malware payload (Mirai)", "value": "e08c4f39850310636af8f13225fd0cdd18c226eb74f7bc21cf9a05791c26fde4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330122, "uuid": "b98579b3-b5d0-4fd7-991a-02f2ea00ec7b", "comment": "Malware payload (Mirai)", "value": "a8dad21a7be9cfa8379029838ceb69da54f93a1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330122, "uuid": "cf6f12c5-5fc0-46cf-b88e-1a98c85415bb", "comment": "Malware payload (Mirai)", "value": "22d0a706e0fbe7505ad993cc2ae43160219c4c0e9961e4ceb1027fb896f505e0c495b8b509ecbb4c2feb0357f6267690", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330122, "uuid": "8a082056-d28d-42a5-81cb-d5693b308c19", "value": "T1E3D2F1F0FDAC0A9AC04C67384EBE9DD72A8CBB736B7548080B410652703ADD5ABE4DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330122, "uuid": "ab584103-cafe-47ef-a209-a7ff64b42684", "value": "384:MbMzN8f05Rpjk5Yfo2xZUTKmQAHHOvgm0vtsgV/E/Qi3iDeGOn6zetV2FI4V3AtU:xN8fWlfoQmQAXV/E/QciiL6KtyNaqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330122, "uuid": "c90ca6cc-bdce-4bd6-a3b5-7d056d04ecc7", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330122, "uuid": "900295cc-907f-42bc-92ce-a5777de3b232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330122, "uuid": "a9fa27db-4e88-4b47-92ee-8b93fcfc19aa", "value": "xd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a3a325-e265-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682315961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682315961, "uuid": "bb6d4ad1-ecdd-4100-98a0-56cd1ad43dc6", "comment": "Malware payload", "value": "6cdd4d4e4b84e6d4b288d80919041774", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682315961, "uuid": "f9b3e8f5-b4f6-4274-936f-da40f5b57a67", "comment": "Malware payload", "value": "e0b373ea091d39f72f7af7534560beecd5d32a473f62d4cf1e6e0149ac9c65cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682315961, "uuid": "e3ef1a57-c60b-45fb-943f-902172d729ec", "comment": "Malware payload", "value": "c6cbdf69685191fab04f62a387fa1144adb95285", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682315961, "uuid": "658883f6-78b2-4b31-aac3-9048bc6efa15", "comment": "Malware payload", "value": "960bf66ca4d7d0624d57a48527533176deb7be6ff715662d3a4a05061346cfea83b59b60f5da7f63a48b102c861083ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682315961, "uuid": "37ce3b2e-d6b3-40d0-9018-3afab621afa6", "value": "T10C34D012BD80D473C443117144B9D7B96B7EA96057728A8B37682BBE3F313C26F7924A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682315961, "uuid": "7ecb2c2e-4e7d-4528-8bd0-dba9dde96933", "value": "d3c7a24c19f12a796b6b821f5d28152e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682315961, "uuid": "8805e731-ebee-4a96-9d7c-4b7cc5775c18", "value": "3072:utYQptzpF9KKq4xIx+Aqlo42oMz/sVJ5Yxdw7n:EjpdcyQ+RliFsefwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682315961, "uuid": "6148ed54-d3c6-4f01-baae-a42c12499b49", "value": 242808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682315961, "uuid": "e376c25c-1057-4ba5-ad46-d38c12bf2093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682315961, "uuid": "e0622f43-70d0-404c-aa9f-b22150d502d5", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40ac5ac-e284-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682329617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329617, "uuid": "2d40571f-df23-445c-9d71-75fa0761b00b", "comment": "Malware payload (Mirai)", "value": "f35c7a3c5d91cc8e88a415daea7ecf0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329617, "uuid": "82a68d22-45b3-47ac-9ad4-325b044d4c80", "comment": "Malware payload (Mirai)", "value": "e0bdb8620d06fd1223ad82ced4c29b57dd2116b2bdb222f45b733d6df4180168", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329617, "uuid": "d678f8a2-da25-40f3-bd88-9411b793c055", "comment": "Malware payload (Mirai)", "value": "02284307430227051165a3f14db0d0c1a2ff183f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682329617, "uuid": "b201f014-0fad-44ea-93ec-4bc9c2de724d", "comment": "Malware payload (Mirai)", "value": "c1b194e34468b05119a1d59ff214a5e4ccf81edec6fbf748673e98db734e20bb62d0af49b0f2ed5bba6ce1bbd511a857", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329617, "uuid": "e098ee1b-8486-4cd7-a5c8-b864da9081d6", "value": "T117732A4233180B07E5931EF06D3F17E183BEE99062E4B689690FEB568675E77504AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329617, "uuid": "987f25bf-1cb5-441c-8f1b-b28c31852d32", "value": "1536:j6AOsDRhnjATISF5KT1RkTzNUljRLoz6SN3785BtQ33Z:j6wRhjwTyRRLTMnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682329617, "uuid": "62341437-4dc9-41a7-bc2a-7bf367500f70", "value": 75160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682329617, "uuid": "58be2fe1-9b7b-4f57-a0f8-53b9fef9d36f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682329617, "uuid": "34abb559-183f-4cad-9f4b-0c63873b9703", "value": "f35c7a3c5d91cc8e88a415daea7ecf0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f0a4bd-e2a4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1682343230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343230, "uuid": "6e310ddf-4406-4759-9ddb-117cfaf2ab3c", "comment": "Malware payload (AZORult)", "value": "543ba1f56b0641e627094437c752d0eb", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343230, "uuid": "a952c7a8-f407-457c-87dd-2d0fa0b505fe", "comment": "Malware payload (AZORult)", "value": "e0d97c344e76281a2e5e9f1f2a05072dd5c258d3ec8333bcd5acfb28baff4a43", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343230, "uuid": "adc89b1e-7893-4abe-b90f-c916d53298e2", "comment": "Malware payload (AZORult)", "value": "17e43727ca85dd4f524020c099eb62ebcfc1820c", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343230, "uuid": "38b274aa-8c2c-453e-bd7d-5ddbd0c7d252", "comment": "Malware payload (AZORult)", "value": "7c0e7ccaf3ee75880cf79e5995bed4318b284aa511ee4c045d274768d30dd3f78a24f54d84e137df522a17ba82f08e38", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343230, "uuid": "1bddff07-0cc2-4559-8078-df4a39d43ddc", "value": "T16F747A23A17CC0E2F89D3EF04A2987266AB52D420275F547D61FBED9F873523C2096D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343230, "uuid": "6a627645-6a69-4006-844a-c31784b6252b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343230, "uuid": "86961112-d029-4782-a788-c2b36ffae056", "value": "6144:cYa6faGRbXBqJz9iG3D09MBPdzT90L3cQ7W/GGXws:cYVrRbXBqlFesvIcN/LX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682343230, "uuid": "5e65aad3-465e-46f1-9a21-c3149073e72f", "value": 370477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682343230, "uuid": "02225d02-acb6-487b-8c2a-b2e43e321d2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343230, "uuid": "7a033d91-b533-4a6e-92b2-479acf446afc", "value": "12250127738_20230406_055598900_HesapOzeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7b8a84-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682323160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323160, "uuid": "9b108216-cc87-4d39-95b5-886f5e90c774", "comment": "Malware payload (Formbook)", "value": "164e4d8d84fc7cfcf405785615f0b94b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323160, "uuid": "2bff5e0f-90df-4d6c-ab82-aea5f369205f", "comment": "Malware payload (Formbook)", "value": "e177f043fa2508aba819bf99d6082c9ae23b65af54de7347ed1ae53285ad7cff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323160, "uuid": "aa31b380-6bed-4afc-9a15-f6d3a3a2ccef", "comment": "Malware payload (Formbook)", "value": "9623510b5a099d23f9ec3167204625bff9bbb937", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323160, "uuid": "e557a5e3-0352-4d05-8825-130313a5fe7a", "comment": "Malware payload (Formbook)", "value": "c020af348b16c4d8ab6d19b3e06219644047f0ac8cf647f741315a7da7354dea448772a8949f47f60e0f60b2eb83fa45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323160, "uuid": "5dc1cdd0-e701-4a44-98a6-65af258e0a06", "value": "T14904AE32DA42C431F2B252B5B2BD1B7B883D0E353295A4E9A3F115E06EA19D5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323160, "uuid": "b97fc240-773d-4788-a719-7c21d0eeb4ec", "value": "3072:qGcUkxSHP3Er83AYT8NGSYW67OycJpITU+ucNRPvCwlUKw:eysyAq6x6KycnUucNRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323160, "uuid": "dcd130cf-14db-405a-a357-8f11d7144cdb", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323160, "uuid": "641bab1a-55aa-4117-b0f3-be566e841292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323160, "uuid": "993a7c59-7b38-4c27-b22f-20250266063b", "value": "e177f043fa2508aba819bf99d6082c9ae23b65af54de7347ed1ae53285ad7cff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c16f78c-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330275, "uuid": "c7f6d777-0f4a-4103-b6c0-f46ab7b318bd", "comment": "Malware payload", "value": "8622656f44442a415b8b3d021d3db59a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330275, "uuid": "cd81d8e9-fd9a-441e-a141-e0eb20e480c2", "comment": "Malware payload", "value": "e18455804b8a6a008a2b357265802ad35f6441bbcc359ab5bd5df994f201ab36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330275, "uuid": "39199f2e-86a4-47d0-9a9e-68c09a10d4b9", "comment": "Malware payload", "value": "49ce56c3f1b4d786d6554c7c539f6e9d0174c7ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330275, "uuid": "8c313a29-baa0-4f1d-b86a-6e844324db93", "comment": "Malware payload", "value": "4047e1c56076dab6b653b34b7eec1c5a5559afae27994b26effd2a1d6a4caf75a47baea0b07e61cd02c1caf708215750", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330275, "uuid": "5f27fc45-1da6-4cfa-9391-ff4b0c1e6ee1", "value": "T1F736D0BF6095C279C106D37590AB9931E633E89C48B7C15D99E0C1A2AF7A8F44F6F720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330275, "uuid": "24de989b-3fb7-4d93-80f1-7c8662feab6b", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330275, "uuid": "c36a5a53-cc5d-451b-9f7b-16d9e171b281", "value": "98304:weZdxwcqKRFGm/IxbbywpV4YRbNDegeyj:welwcqKRj/IpywpVLRdegeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330275, "uuid": "d9356ad8-eac5-47ef-99a2-60181bd457de", "value": 5091768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330275, "uuid": "8cbf2607-2a71-4e42-9a23-b2872608c9d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330275, "uuid": "f048700c-cfad-4301-a932-07e36ca6a716", "value": "e18455804b8a6a008a2b357265802ad35f6441bbcc359ab5bd5df994f201ab36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf40350-e2d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682363267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363267, "uuid": "90321e84-b448-4b4d-a5e4-d29dcaa2fee6", "comment": "Malware payload", "value": "63ce15485ae3af15892f017324288d7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363267, "uuid": "1f747adc-932b-40fb-a26d-bf07401d4b4b", "comment": "Malware payload", "value": "e1bc6d3db47deb43a8c6c1a3c9d9d1ba7e336d1e6e5f63843b8450c8029bc3af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363267, "uuid": "aa43c687-3caf-4b0b-9e61-36e122df0d9d", "comment": "Malware payload", "value": "bfd6223e9890e33828853cd85809fb35fdcf2e32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682363267, "uuid": "b964f456-9c6c-42fa-8e7e-1bd2261de220", "comment": "Malware payload", "value": "98cd4179cb6eb86a43292852966cdb53b9a5d94f1d048186eae20cfa5bc92ab54d4b888662e20dc742ef497e97bc6dd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682363267, "uuid": "7aafccb7-0fd0-4cad-9b1f-34052dce362f", "value": "T1B503624A2A229FECF37A873507B74A20A75C23E522E1D689D67CD5100FB014D259FBF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682363267, "uuid": "a57e1ad5-d1d6-4f14-8807-bb4001bbe965", "value": "768:qGtIcTcRSNBKYH7Zldg0nr/Fbk/qyNsT59S4:qeIlRSNBfPR4sTHS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682363267, "uuid": "3de38d37-399d-4bbc-abe9-5155ecc02afe", "value": 38384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682363267, "uuid": "289482b6-11b5-406f-ad5b-1debd01c6cbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682363267, "uuid": "c7f1ddd9-edce-4617-9d6e-05faccdef0f3", "value": "63ce15485ae3af15892f017324288d7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0897e9de-e272-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682321491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321491, "uuid": "a3b9df78-c94b-467c-9711-0d9d16f4419e", "comment": "Malware payload", "value": "834a1c8fee9952b0b0bf614910f70754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321491, "uuid": "dc5abdba-dd62-4fd5-9769-3522faef514d", "comment": "Malware payload", "value": "e2707a671b7119d23e5f8c6b2492270b3b1e3e77ebb16fe7445ef1ce005bb2db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321491, "uuid": "24c64f49-9f11-4e86-9d34-e698da274f90", "comment": "Malware payload", "value": "c14f78c216f398464542b5d1dbc856a9f4cb9465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682321491, "uuid": "c7d3c681-82bc-4fef-b5c6-f1ae3a40294a", "comment": "Malware payload", "value": "5783a8d7cf1598c7f941a10975798e3fec26b17f1bb07277661275438f35c7e0d0280a83e181ec8d1b197fd009640e1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321491, "uuid": "c5c8fa0c-2b4d-4bb2-bb82-6b784dcd17f9", "value": "T1413623ED6658339CC00AC8749433F944F1F1A61E19F6D5FEB2CB7BD027A6421E642B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321491, "uuid": "8ba04e55-b3a8-44dc-9893-c56594c0c49e", "value": "aa054521eee0f3012b8a297cae93e6e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321491, "uuid": "2e6e1ef2-1a9d-4eeb-9e14-13bcd318601d", "value": "98304:bf0W5qvOFN+5ho3K4aZLMSS0QM4AM/L2/TKFfyx7W97QBk7vbqMd1:T9qvOFNghqK9Li0QMfM/L2/WKx7WVZT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682321491, "uuid": "dac5c7bd-4809-4c4a-bbf4-944c9c285764", "value": 4973514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682321491, "uuid": "8407198c-f5d7-48e5-9c48-15a9dc4b7b75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682321491, "uuid": "5e5187db-3a92-444f-84b3-24366647857d", "value": "834a1c8fee9952b0b0bf614910f70754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25cf5840-e26a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682318104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318104, "uuid": "2e14bb56-d46c-4ce3-817f-8c8c5e4af1d0", "comment": "Malware payload (AgentTesla)", "value": "1295b87bf38bc123a2e33ef8b6e8ec4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318104, "uuid": "286b6820-07a8-4c8d-aced-4a8ceab72e21", "comment": "Malware payload (AgentTesla)", "value": "e277d4d202a45f3805efd46144923d33537767cda0510db4b9e756e25ac8dbd6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318104, "uuid": "203201eb-50d4-46d0-9024-05a4109d43e3", "comment": "Malware payload (AgentTesla)", "value": "b478ac5fbbc9fd410d34c569d6315466748fd839", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318104, "uuid": "b570e9eb-11c3-49ec-abc0-f9ab2420abe7", "comment": "Malware payload (AgentTesla)", "value": "6ee6dac88f95e90a225f5f1a594074524c474cfdf149e4e2cf6ea3dcfae9b2c36627ffcaae89ee32663de5492f5f7fbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318104, "uuid": "c681ad35-2d33-47df-8be3-bd4cf87a5070", "value": "T1A3C402A0533A76EADDCD237B0A68255E47727043B019A73C97D449898E42B87FF0A17F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318104, "uuid": "fc7bf654-2c79-4fb3-b66b-cddaf389d23b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318104, "uuid": "6c912f96-0006-4227-8f83-5825bd080e5d", "value": "12288:pZKaQ+fbsVVoMjQJGNe5a5Rzw76m8UxCXe0Ynt8vMlo:pZKB+fQIgNe5avU7LxN0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682318104, "uuid": "a7479ec7-c78b-4036-aa63-9a728c76dedd", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682318104, "uuid": "e59b7aec-4026-495d-b4b2-338c47bf9ec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318104, "uuid": "66b48209-9596-4e67-a2db-f970beac170c", "value": "DHL-AWB 53426748.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d9d3be-e26a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682318134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318134, "uuid": "a220fd68-dcf4-45a5-b25a-80d388591533", "comment": "Malware payload (AgentTesla)", "value": "dacf8bc925bfa707f91ffaf9a024e612", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318134, "uuid": "41820684-2ccd-44d2-b3ce-9b6ae189480a", "comment": "Malware payload (AgentTesla)", "value": "e2afb0ee160899e7d800b01db654f6f65876510d7fa1c5d1318b97aa61ae289c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318134, "uuid": "8d84d0c9-9f67-4328-8c01-9282221dd2f2", "comment": "Malware payload (AgentTesla)", "value": "b74231ea74353d0483055554f7ee977c4afbfe79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682318134, "uuid": "bd1479df-cf4d-48e8-adb3-3367b6c000b8", "comment": "Malware payload (AgentTesla)", "value": "fa79b4ee2eea00f399eb0e35d2675e441ebf9d8aa8dedf44b8345a772043e7a4d84e4154b69c35a14a76761f38eb31e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318134, "uuid": "92a998df-d94e-4c7f-bb17-4bd1b36dd3a1", "value": "T19E341268B530C0D7C87B15708A3F8F1919F96926E1F19A1F2392BB7C74B2591C41F7A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318134, "uuid": "67f3d123-5ffe-44aa-b7a0-0d2fa2e6677f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318134, "uuid": "3bb9e3de-b2fd-4cc8-a209-09d4c2a8c885", "value": "6144:JYa6YTIQFLDn0g9/kKwrMjnVttAGr6icM0Db0HoPGg:JYqUQdD00k7rMr/t9mPNDbNPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682318134, "uuid": "017612b6-3535-49f2-8c8b-133f1ea3470f", "value": 239085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682318134, "uuid": "a9b583df-0cc3-4403-b94f-19f298ece23c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682318134, "uuid": "f6f86fe1-944b-409a-b19c-0cf104ca0c24", "value": "ORIGINA0876545678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec33abd5-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682323162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323162, "uuid": "7e928210-26b1-4a72-8fa0-c30393820a2c", "comment": "Malware payload (SnakeKeylogger)", "value": "2ace3fe2cb033a797bfd6749dfba2c2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323162, "uuid": "8502181a-a8c8-4121-95bf-abf5f4af1045", "comment": "Malware payload (SnakeKeylogger)", "value": "e3d6bf1ce9fea9bd1248afa6e927a1d763a3e0e899be2f0c0c77d12de4870654", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323162, "uuid": "6adfcda1-820f-4b20-a5d7-6b745e305bfd", "comment": "Malware payload (SnakeKeylogger)", "value": "e2ba08dbdba347cee4f3a14b6531032d6c35c9f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323162, "uuid": "38d43896-440c-4805-9277-9e601cbdacda", "comment": "Malware payload (SnakeKeylogger)", "value": "aedc6565b76bd0d7c6ac10d48eeb31f9a1bf592ecaaff028af2553b384efe3b9670edc0cee47e6f6bcf8460b9124979e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323162, "uuid": "6ec66ab4-917d-4249-b5fe-e3d181bc89fd", "value": "T161C3174D2BF88900F1FF9A7306B16112C375BC12152ACE1C4AD2F65A2A3D690CD1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323162, "uuid": "f1c6d9a3-74e4-45f0-9157-806c8d90ac93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323162, "uuid": "079f04eb-17a4-4a86-8c9f-afc0f209748a", "value": "1536:wtMpEvqHEIsanj0ly+G0/nE+vBUFrlY9DZKkAMFFxgfPpAbKuNJtbfpyJI0piOW0:wtMKH7/tDZv2abfmJIewBnFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323162, "uuid": "8371d625-a7ad-4e31-963b-9e69e08ef1f1", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323162, "uuid": "0822710c-7d7b-4e9e-ad38-196233046fbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323162, "uuid": "c78fed2b-f180-478a-add6-3f525e5055b9", "value": "e3d6bf1ce9fea9bd1248afa6e927a1d763a3e0e899be2f0c0c77d12de4870654", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3161678e-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1682346900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346900, "uuid": "c0a0faed-9e7e-4f28-90e5-0ae109fa2780", "comment": "Malware payload (LgoogLoader)", "value": "8c9e184323c1067391db30439d42309f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346900, "uuid": "9f389b47-637b-4448-a35f-426e6e73b61d", "comment": "Malware payload (LgoogLoader)", "value": "e405f3facfec4741b7a25d5490bf7fe55ba525f4d17706a6e3d8b00b2a725025", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346900, "uuid": "dcb8e016-8b10-42ba-895b-c48fe53dafbf", "comment": "Malware payload (LgoogLoader)", "value": "6fbe4c6ec78ba5976f0c3a760bf560bcadec5544", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346900, "uuid": "fc3eefe6-957c-4626-bc2f-0013c916e89b", "comment": "Malware payload (LgoogLoader)", "value": "af3e6fad2ef56995fa8b1521e8b8830e4d895aebe2841fef0e1a4ee77c744c34d6a813d071bf2a2da2154f5b4a0d91fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346900, "uuid": "b35ab234-f58e-49bd-95ed-1349c2d01112", "value": "T1355539343DFA902AB173EEAA5BE478DADA6FB7333B07645D109003864613981DED153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346900, "uuid": "df147d08-cf60-4844-9036-7e659772dcb3", "value": "12288:EVEHF11PvAeHV/K4dQwDoJvvQ6/XQUtF/8eNcXD1EzAqsoykRNmx09Lp0KGjr2+C:ESDGntl+ICZWxkD9SR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346900, "uuid": "76ebb994-18ec-4a88-89df-dd8409f87c52", "value": 1300344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346900, "uuid": "c80e4cc2-d348-4fb2-a041-5f4e83180221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346900, "uuid": "9610f283-c343-4d54-8348-eb0409e65cf8", "value": "8c9e184323c1067391db30439d42309f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849a3027-e247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682303231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303231, "uuid": "ab59cc55-9504-4b63-83d4-cddcbe3f7344", "comment": "Malware payload", "value": "0b2f0597401a59ae4034836ba453863f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303231, "uuid": "da432a43-050a-45a1-8738-979c4e367870", "comment": "Malware payload", "value": "e417846f722e304e5a1d2af46e3c5e2d3dc93a110b9a4ab96fde8360ad9d6f6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303231, "uuid": "1a8b3c5f-ff83-496d-b527-fa2de2a11971", "comment": "Malware payload", "value": "60b72da0aab0bd65ba82c1ad8162eb03af81ad6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682303231, "uuid": "5389a0db-d1ac-4798-8bba-be44438b9c44", "comment": "Malware payload", "value": "d55ba225610269883e39ba4bda2a68e133adc1ec95a0f8ff0a76d9ba5121462a1afc94c8b78a55aa87b28533a60e94d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303231, "uuid": "8ffa757b-92e0-4227-9571-0d6c3e7f5972", "value": "T1DF33F8C7D8B2E1D3D351F3F27EBD769095AF6CA12EF5AA046874F82128334056F0A54A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303231, "uuid": "c441852b-66d4-42a4-a142-292a88388e4e", "value": "768:kn6TIdMDMm6gn0v7swmYqahagE7SIjN/UDR2:kn6TIM6gn0ouq8EusNq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682303231, "uuid": "c7fa04ae-ff1e-4a2f-aead-58d49c69e8c4", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682303231, "uuid": "18e1a886-ec15-48d3-a438-4ed2a1b0b411", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682303231, "uuid": "d2042d6b-3afb-4a99-93c3-91a2fd5b4079", "value": "SecuriteInfo.com.FileRepMalware.29407.20467", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138fa05a-e2b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682348997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348997, "uuid": "af253e99-f259-4de6-a8cc-6ccd090f3d69", "comment": "Malware payload (Formbook)", "value": "c2193488994db0c99893eb8d336874e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348997, "uuid": "08c90f9d-569f-4341-9860-cd0e9888625d", "comment": "Malware payload (Formbook)", "value": "e492e308b1967fc1dcd6cef3ad6f20d1a77ca5953460162d1d1ee71b000d66f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348997, "uuid": "68781401-0296-43ec-90db-a63676b0c631", "comment": "Malware payload (Formbook)", "value": "8a7051052284a255a37ac91f64aeb20da23ed557", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682348997, "uuid": "dea8d86f-7f06-4eb4-ba4f-7824c187539e", "comment": "Malware payload (Formbook)", "value": "7a56659dba2a4f8c4e29d274932fc20e4cdb0389a4749e663e1de9e7ac2ab5c8c50cc123de033cb4f05e95218194174f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348997, "uuid": "7ffc2740-3b9c-4e41-9c58-07fc644e3bc4", "value": "T183541214A9F0A5F7FC720F312E79C2367ED2962235F2964B2710619976331C9E64FB82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348997, "uuid": "a5477ef8-6fb8-427b-af67-30b3152de8c6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348997, "uuid": "1fa22c50-3a4e-403e-9a12-aa6a4113750b", "value": "6144:/Ya6kZ/qTiW9GQW+e6YmWInO3PXE9hnAK620WIQsNAFF1iEhXvD0P9baR:/YSZ/qOWUrIOf09R90IsNAFF13D0PIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682348997, "uuid": "38f4da6b-27c3-4a89-93bf-693f440352f6", "value": 285764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682348997, "uuid": "d24f4134-16e3-4859-b305-64dcac2815b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682348997, "uuid": "18893349-f269-487f-93c6-4ec2d2a282ff", "value": "c2193488994db0c99893eb8d336874e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d19fbc-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333460, "uuid": "83587e77-275c-40d2-a658-70fdba0b4324", "comment": "Malware payload (Mirai)", "value": "af01fb88f1b18b86088d7ae33e7701cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333460, "uuid": "711307a4-8fc2-4c94-99e5-18ef211e26b3", "comment": "Malware payload (Mirai)", "value": "e4fe2d2c57158a23f97b277e9ac25db18e5947aa9f22a15b33461ad079f5a084", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333460, "uuid": "e8c2aa86-0b44-4b80-a21a-a149136cd648", "comment": "Malware payload (Mirai)", "value": "73ce3bf53a1f9c25e2dc3d5bbde5e3e238891d3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333460, "uuid": "7bba02a2-e8d9-419b-9208-14f8e560c5dd", "comment": "Malware payload (Mirai)", "value": "c79ebaa12bd33a61ea544a569ad575420ed1729e55fee81ec55040e0e581088da757d7b8dba8cffc3f4b89b5275d2e68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333460, "uuid": "70a514d5-1b47-48e2-9549-c3830daef816", "value": "T182E32B56EA418B13C0D61779B6DF42453323ABA493DB73069928BFB43F8279F4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333460, "uuid": "85b93a17-2037-43c7-921f-05ecd5bedb7e", "value": "3072:qJLce3pC5mC7ltaLHbz4NhCQJctYJ1F54mXkkTM/9MxMY:qJLceultaLHbz4NEQJJH5nXkYM/9yMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333460, "uuid": "c19e3d64-b8b3-4dd2-9a04-2aa040a26e3e", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333460, "uuid": "f18f95aa-b137-4adc-baed-96fdaa5a7b39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333460, "uuid": "27ee3cb1-525a-4ebd-87a4-95d81b917c5f", "value": "af01fb88f1b18b86088d7ae33e7701cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa90aaa-e266-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682316591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316591, "uuid": "992045c8-0fea-432a-a65e-782c82060cc4", "comment": "Malware payload (RedLineStealer)", "value": "a776f7628a30069da62f3322ef7fe20b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316591, "uuid": "22d46409-d781-4141-a8a4-d2607474da32", "comment": "Malware payload (RedLineStealer)", "value": "e66ab624caa1f64db7452ded5e16679ec3c2ae7e11d6673606aa2e4b4f7e5aee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316591, "uuid": "335848d0-b154-40e1-beb2-08aeff1f0260", "comment": "Malware payload (RedLineStealer)", "value": "971ecd1763bf6f1db2257aac8dcdd0c37fb612ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316591, "uuid": "66d4c5f4-0fd8-481f-aa15-24c6e186e35b", "comment": "Malware payload (RedLineStealer)", "value": "250a81aec14dc36fa5c9ea41ddfe54d7815a73a0f56c5cae7f568ff6ab24397592a590f676fcddb3ce8a72fc91713dc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316591, "uuid": "06e2e6e8-0efa-48e7-9097-03b6399267e9", "value": "T18EE41252BFE88032D9B917B455FA02830B36BCB17B79939F2255AE8E4C714C4E43176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316591, "uuid": "de015535-1348-4bd1-b3cc-54ee3bc01d15", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316591, "uuid": "5306bf0b-6e52-44a5-94ef-1cf0238a33dc", "value": "12288:My90ECFGpRT3YnZNnkJUHDOyOr9P2x/RR6XCfXt0rmeakiAPbrldMb2:MyX+YIPkyjTa2x/RR6yfcJAAPnE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682316591, "uuid": "4f064e1c-8a44-4867-a59b-7b294005f9a2", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682316591, "uuid": "da20f8c0-9560-4105-bda8-48ffe8ebd70b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316591, "uuid": "929c9534-5278-450d-b2d1-eb02c28d1b22", "value": "a776f7628a30069da62f3322ef7fe20b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51281e90-e29d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682340081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340081, "uuid": "910baa80-8f30-4193-80c1-08489141f755", "comment": "Malware payload (AgentTesla)", "value": "7937243e92bc32cddb2296e535ee3704", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340081, "uuid": "d5847309-5224-43fd-8740-ce947eca82e2", "comment": "Malware payload (AgentTesla)", "value": "e75f916587121289c17d86217ad82c94a8c4a1f8921e5311147e5c090e9671ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340081, "uuid": "389d669f-5b6b-49b4-81b0-5502af19fe7b", "comment": "Malware payload (AgentTesla)", "value": "3244014797e3c14505970112dade673a8fe59737", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682340081, "uuid": "6bebd32c-1fb7-48af-a0fa-c42304af1b13", "comment": "Malware payload (AgentTesla)", "value": "79e10f97eddf8a6062b995fc240076400968a531e0c89844fff6a2cd0fb99214e1f13d112db84c8dcf4ee384c519e0c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682340081, "uuid": "dfb8d8c6-ffb6-4aca-ba54-d12c1b0bf5be", "value": "T1569423DC225F7C859419752C1AF895647A4D3A47C213255B82DBE20CC22FCF7CA7B2EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682340081, "uuid": "ac883e62-dd42-415a-9af0-7b146eb98f71", "value": "12288:/PuMtlc9blsT9GVOXdCfn0Xp6tMA0zex1mu8:/mMPc9blAmOCf0Xp6tUax1mu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682340081, "uuid": "43d7a52f-1fa8-4d3c-ad71-ac55626f5cc7", "value": 435569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682340081, "uuid": "1219cb59-cff4-47f6-aaf2-96e301b30c7d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682340081, "uuid": "4ae25f39-898e-442b-ac20-175c216bec71", "value": "Purchase Order.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81334400-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330283, "uuid": "4e0cc4e4-03fb-4d3e-b5d8-60d5d1b53f52", "comment": "Malware payload", "value": "5108d8a48971e0a15b2b3fd4a8ee7366", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330283, "uuid": "4ebc1cc6-fe82-43f8-af45-595083fd1898", "comment": "Malware payload", "value": "e827cde3646048c9e09a61eeb45cc37f1d8a20190762c513ddf1e9dc13e4b897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330283, "uuid": "a25b1dbf-c149-4f23-b080-3fc3d5f77d79", "comment": "Malware payload", "value": "2a67e5218011e78e5ae8d8fb7971139b7d99df57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330283, "uuid": "796c898f-294e-49ce-8788-ac25b5f532bf", "comment": "Malware payload", "value": "8b13f2421a78a4bdf5139e7a04b596d2ab89b223f4f289997f2da17aeb132d29cd615d76667f289b341ab7d09683c9df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330283, "uuid": "e4615a53-227e-4475-ae38-8f43e0f6f44b", "value": "T12B66CF7E31B4C6BDC66F84FE8A6E9B32A131E2543E33C665149CE9612B4E4134DBC358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330283, "uuid": "60c40493-f202-4d2f-8546-ba30178ddaa3", "value": "e6f3bddbdba4f732419f757e55891a80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330283, "uuid": "8d8cffa3-386f-473f-9288-16d0a6af0f70", "value": "98304:P8oDQhepHdKm9tHoGOHjU8GDo9oQyqrGFZv54UvC0EzbCyUOPOjYT+sJ:P8ochepnk2siwUZh4UvMi2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330283, "uuid": "07d4b232-b336-484e-bef4-94f6ddc13c44", "value": 6631288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330283, "uuid": "231013da-b569-4160-ab20-9e37d6731b5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330283, "uuid": "80af3fc0-df44-47df-8c0d-8427d1b05c1b", "value": "e827cde3646048c9e09a61eeb45cc37f1d8a20190762c513ddf1e9dc13e4b897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8678030d-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330292, "uuid": "5d9d96c0-45ae-40bb-a9bf-1af304350f93", "comment": "Malware payload", "value": "6882e47ae24ea1f6f8fb4e3b03ee79ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330292, "uuid": "dd8b6d10-d1bd-44b8-9c18-5b78ae522f72", "comment": "Malware payload", "value": "e8cccc9f9b124826c0e43897f0e21124b4b0cd7991f434b0dd7838bed7e361b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330292, "uuid": "09362c17-04a9-4b9a-b128-67200936ba8a", "comment": "Malware payload", "value": "210bf0139477ae23fdc61ce14d87e53a843a3652", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330292, "uuid": "144caf15-39b1-4572-94aa-ce5a6cdfe6e3", "comment": "Malware payload", "value": "8dae77047c91238394245fd952be75145048e7cb85ed9a977d51adf5f5681f4e846f2b1ea70be111fbabe48bfeafebbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330292, "uuid": "db22d309-cf89-4821-88c4-88bf2e4d87eb", "value": "T17266E0DE20688D6CC2451A75C5962E31FA337CEC1FF3B64446E9F7C99EA8E408D8E941", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330292, "uuid": "f0b3360a-a245-48b5-b880-f4e71edc34a7", "value": "537d4e9c56af07c12b8d0e947bd45d56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330292, "uuid": "cf150d6a-37da-4ee4-8855-0bfa37324b07", "value": "98304:mVicYvJbLiJMvk60DZ7XMC+09Ag2U2Gju0vT+YXit58HI300xK7:mVBcSJMvYa09L2UHtvT+DtNx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330292, "uuid": "5761dcbd-d080-427e-a9b9-38dce8ae9b43", "value": 6819752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330292, "uuid": "a88ee74a-7daf-4690-b5b5-5c8ee3782a26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330292, "uuid": "f4015442-00e4-4e89-a1ca-fe207c7c1426", "value": "e8cccc9f9b124826c0e43897f0e21124b4b0cd7991f434b0dd7838bed7e361b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece36964-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682323163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323163, "uuid": "b7210ebb-b8da-4d2a-bab3-923cf7283bb4", "comment": "Malware payload", "value": "ef5b0883ce259b66c09db3aa295460d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323163, "uuid": "c38b7424-9fa8-4dc1-8087-0c15f1204a83", "comment": "Malware payload", "value": "e92910c0435781042e2e7445c9aec60589022c405af236738a733943e4693f40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323163, "uuid": "fbda73a5-acfb-466b-9e96-90037d3d23f7", "comment": "Malware payload", "value": "651793838c19545e5cb54c2021cecdab37d232b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323163, "uuid": "6336105b-3254-413b-a418-b7f6d1d15964", "comment": "Malware payload", "value": "b2fc0a4ba17cec945b0eaa396f194b2094bd95af13edcd8ebb2afa3ea7625eb4264161638d20d25529e631732d537101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323163, "uuid": "afafe0ab-1d66-4fb2-923f-759a36c057f9", "value": "T11502D903BAE8B425F0F61B3519BE9511AC2D79309FA5C2CB318D268E1F241D3C8B17A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323163, "uuid": "6f3a1b07-214a-4e31-8984-6e90faa20b6a", "value": "192:YkiIhyWGXO3tqyRGj3buuJEzoc2D7k8W36cWPU:YkiiyvQpUuuqL8W36cWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323163, "uuid": "b788ea06-7c2b-4aa7-90b4-a2f54745043c", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323163, "uuid": "bf926fe6-1815-422b-bdca-e2177b84bee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323163, "uuid": "370dac48-2cda-423d-a22f-7ca815f546bc", "value": "e92910c0435781042e2e7445c9aec60589022c405af236738a733943e4693f40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda26190-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682323164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323164, "uuid": "932849d7-1273-4009-9437-546e77815620", "comment": "Malware payload (Formbook)", "value": "f1d020cd788584ca82dd0b8c66fdf85d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323164, "uuid": "198e6930-4f8d-40d0-aab0-a5d56763383f", "comment": "Malware payload (Formbook)", "value": "ea2bca0128d9498a9905b3408ceb8edecefbc96891ae4bf4403739d21fc98c52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323164, "uuid": "9beb4a37-a362-46d9-b207-ae8f3802f568", "comment": "Malware payload (Formbook)", "value": "6119d960a91417bfd814400287d9237308de579c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323164, "uuid": "e2716abb-27af-4b1c-9933-dff43635f2ae", "comment": "Malware payload (Formbook)", "value": "cba54411628376e94a2934ab77ff88fbe102c65ef558fa5b1c1fe1b47bc980eb6eb18b144fd69b29cb6ffe11afd26308", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323164, "uuid": "fdd07cf4-a022-4d5a-98c7-0a1924723317", "value": "T10A04AE32DA41C035F2B251B5F6BD1B7B883D4D353294A4E6A3E216E06FE09A5B43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323164, "uuid": "909abbaa-ec60-4e2a-adf1-43d787f05efa", "value": "3072:6BfukkpsKtV73CliVM5Zal1ZGjAtvsGk/XpwM0yjZzHPoz:RHTCkSZal1ZGiUGSZzHPoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323164, "uuid": "1a11c51a-76d8-4f6b-bb7b-c32c460f44b5", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323164, "uuid": "e6785b7b-e447-4d9b-bc3b-bea5cc0bc2a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323164, "uuid": "bae99877-c361-4552-9254-724e7b07e592", "value": "ea2bca0128d9498a9905b3408ceb8edecefbc96891ae4bf4403739d21fc98c52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947fa451-e2a0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682341483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341483, "uuid": "469c9716-ff32-4736-bf40-df18c56adbe4", "comment": "Malware payload (Formbook)", "value": "ffb0eef5a2b8f68e83be733377879dbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341483, "uuid": "ac60db1c-6f15-4611-96f7-cca36c5c27c5", "comment": "Malware payload (Formbook)", "value": "ea863e37d6bfae2d663099dd67ac34fe4b66c92da255d50fd5896143e2764021", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341483, "uuid": "1d8fc93a-0fcf-4c06-9a38-92e773ef508a", "comment": "Malware payload (Formbook)", "value": "303b06d542861b294410dea8b66e4c91e9ccb58a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682341483, "uuid": "3c206d5a-dd4d-455b-a5f3-5eefb1b61575", "comment": "Malware payload (Formbook)", "value": "1643c27fe746d9dc6aac9737fc4b37227f30c678ce8ac9e6c245ba4bf0e5969c8d2dcf6c4a7acfae1fbf818101cc64e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341483, "uuid": "c13a6b83-b551-4502-b961-1cb2a563e7cf", "value": "T1C174F1A23847D8FFD9BF02F1142D7964A912BC35C81B1A0F63E7F64997782A0D927391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341483, "uuid": "855e9bda-3596-443b-887a-17d4b855f4b6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341483, "uuid": "45a4579d-8306-41d9-acbf-3e5ffe6de1c6", "value": "6144:GYa6S2DqJnGTOFlmT0HhB5UgZ7kuWDYfUhckEmNwQt7HzuGP33wDfMB0HPW:GYkNGTOXJHhDcDYfkckEmD531gW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682341483, "uuid": "fb9771fc-d7fa-451a-bd03-165e7ac58037", "value": 338282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682341483, "uuid": "31b2ea94-4e3b-49d0-b05f-3a0e4756aad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682341483, "uuid": "15733232-8fa7-4280-b733-4d2352082821", "value": "z35INV-A66G-B100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7f35b6-e2a4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682343348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343348, "uuid": "4a62ee5b-aef0-4b37-b32c-ccc80dc4a83f", "comment": "Malware payload (Mirai)", "value": "3fb8850af9e9249fd70c26932c773846", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343348, "uuid": "5a22143c-bc81-45fd-bb36-a9da9d28d9f6", "comment": "Malware payload (Mirai)", "value": "ebcdc1e5488205aa306d3a1b05d1af709dc656f48cf41851279aabce1a2984d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343348, "uuid": "3af80d08-c5c8-4a71-81db-2f6c3f843e87", "comment": "Malware payload (Mirai)", "value": "6357179b38cfcfad3ec3773bb292d3e579f67f02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682343348, "uuid": "e5241a16-9f5a-4658-a2ed-be6c9a8b4285", "comment": "Malware payload (Mirai)", "value": "334687fcd5ffe84203858bd447d0597786a3f469a722ca866d962033374067a1569f161842c6fd30e7e023c6c74a32bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343348, "uuid": "2780da9b-b634-4fca-be14-adace7686341", "value": "T1EA735C136991CB7BC4C747F92FDB952144A3F83E1B32620A73D8BDA92B1A9D82D5D301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343348, "uuid": "ad5bfb0a-bfcf-445d-9959-d5671440e28a", "value": "1536:87IZuiaH+1iDnD+Q8bQ8O32Ls0FnswNZzvmA+JbOm/coZ3ymj:ySae1ItqQH2LDnsEZzvm/JbOmEoZimj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682343348, "uuid": "adb1612f-b666-47cd-a08b-6531b041ac53", "value": 80455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682343348, "uuid": "a014c954-6b6a-4e77-a701-0a03320ecb67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682343348, "uuid": "8e195856-b93b-4b62-ad52-fe54b5fa9434", "value": "Demon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd806c56-e2a2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682342437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682342437, "uuid": "79ec17be-a936-4891-b45d-f260db0a5ad4", "comment": "Malware payload (AgentTesla)", "value": "9c6d28a13466e3c50a203190a6bce9a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682342437, "uuid": "b17cf053-1eaa-430e-ab0c-2e31ba90cca4", "comment": "Malware payload (AgentTesla)", "value": "ebe78c5b5c43e135929a0e4d64b63a8707f90e9c1de2fd46ae36d67098d2a559", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682342437, "uuid": "cb3b9d40-f9cf-48c6-95be-8b7d4dda798b", "comment": "Malware payload (AgentTesla)", "value": "589c030d5769976dd5dad267f4230936af1099f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682342437, "uuid": "4680a6ce-02d2-4635-88ac-e65535ab93ef", "comment": "Malware payload (AgentTesla)", "value": "8981b00376a092711793070bc0ae0194ca4846957343033df54581cf3667b7a2e384c3bf89a0a91adad664ed12e20938", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682342437, "uuid": "728fe437-3618-455a-a2dd-640447b664ac", "value": "T130E4E078B123AFA7D7BEC9F01248625117E63BA7763CF1AC5F1E30D906B67800968593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682342437, "uuid": "9b0b5c06-1248-41db-8044-52dd4694ec57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682342437, "uuid": "273f851b-9c93-45df-82b4-407a0f37f33b", "value": "12288:WSc2iNq+CwC6Yff1pSE3nMN1t7Eym5pciVL+loAXiSt:k1fZV+fMZc57VLyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682342437, "uuid": "453abba9-902a-4280-8bcb-809a14c5d55c", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682342437, "uuid": "ce690658-45d8-449c-a1ca-e85b1ef25fd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682342437, "uuid": "89839634-bdec-4d7e-b767-475d0459222d", "value": "Invoice 182LH431_shipment document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ab037e-e265-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682316141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316141, "uuid": "8b5e653f-9572-4691-a220-583f1bdae2f5", "comment": "Malware payload (SnakeKeylogger)", "value": "027cf6e569a60e7540ebe74ecf2bdb54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316141, "uuid": "b33562db-f060-4868-a30d-36fbe0b128db", "comment": "Malware payload (SnakeKeylogger)", "value": "ede7c3298192739d0c3188ca21b1377bffae0d2a5e7f3ce88ac10f2da8858483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316141, "uuid": "8ac696fd-a850-44a4-9e3a-9bb2d0776d19", "comment": "Malware payload (SnakeKeylogger)", "value": "e6490e989d2603e3715a812a9cd762cd9ff92d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682316141, "uuid": "80915ffe-a500-4cdc-a118-ed266e1daf3f", "comment": "Malware payload (SnakeKeylogger)", "value": "6445a0bbe6520605a73097051bc2c98a67dc88541887020b9cd31d8349a597eb38797fa354d25a1058c25479b21f8e6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316141, "uuid": "1a762da0-3559-42c2-987c-439ec1ce0173", "value": "T1BA054CD1F190C8DAED5B0AF1AD2AA43014A37E9D94A4410C569DBB1B6EF3342349FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316141, "uuid": "1eee28ff-3c9b-4d15-b1b9-b199fb783d71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316141, "uuid": "fc8365f8-a0ac-4375-bd1b-d88529f06c4e", "value": "12288:dgQaMiyfqSUyexkYRKe4/hwpb9Ccl9ke1VKW:dgQ06JEDRV4ipbf31g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682316141, "uuid": "1232045b-4da0-44ff-bc4e-0344f62029c3", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682316141, "uuid": "ed6941c0-1835-4120-917d-f915d6ebc12c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682316141, "uuid": "27fafcf3-1fdc-4df8-baa2-29fbfdb609da", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac805e22-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333363, "uuid": "b1e5b833-48b5-4b26-b8cb-cf0a711d53ae", "comment": "Malware payload (Mirai)", "value": "525a894174de253fad3d91f27793d681", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333363, "uuid": "da586515-af55-43b1-a54c-a109c593ce92", "comment": "Malware payload (Mirai)", "value": "f09905aac4c3ee81b0e39a9a7a333027151512766dc31a9680f7cb9dd228181c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333363, "uuid": "136f0ef0-df36-4ba3-938a-47558a53bde2", "comment": "Malware payload (Mirai)", "value": "fde59f94269fffb0fd65cbc99ac916730a593b63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333363, "uuid": "b639f1c8-3ca4-4356-aae1-7ba7aca430f5", "comment": "Malware payload (Mirai)", "value": "ae549c7e70aa5d46e8030c4e63d4cdc53692e9dbc4865f6f9ca0db56bcf9c10e33719e3a7d06e297604781c59bb3016f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333363, "uuid": "a73bdfe7-b3de-4f62-80b4-9ead81c26ed8", "value": "T114332A8A64112E6DE9DA5CB981764F0ACE541210B093171FB3BBFDC33933368FE66949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333363, "uuid": "c4adec88-383a-4b71-9fdc-74ae9520b609", "value": "768:UaRTre1lS2oueg2me2nPQCHEM/ArPwqLWnG2TqOhRol7gSu9+f1prZadIX0eNia:Ua0zoRg2mew4ChAVLjF7gSyg1pVa6Oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333363, "uuid": "55a4c805-acf8-499b-9b01-b5de04923f9d", "value": 52820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333363, "uuid": "2e6484c0-f3cb-4622-9422-0cff1f41aabd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333363, "uuid": "77870ebf-6a61-4546-ac4b-3f1e53d2008f", "value": "525a894174de253fad3d91f27793d681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebf3a68-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682323166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323166, "uuid": "ba681138-0ce8-4da2-802e-1046934f7b5a", "comment": "Malware payload (Formbook)", "value": "c9edc417f5b0ed988993f3eaf75da667", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323166, "uuid": "63d08de0-3354-4cf1-8938-96c6c9e93788", "comment": "Malware payload (Formbook)", "value": "f153dbff060014738d4acb9dd79afd626d82abc59202a6d1d6754fd7f343774d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323166, "uuid": "63c9bb68-a294-4adc-9a49-286a911f0cea", "comment": "Malware payload (Formbook)", "value": "c5423a30a16ef336e90f61ed8e424b19d0ac5439", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323166, "uuid": "6c56795e-a459-4550-88ab-100d31cbf7ed", "comment": "Malware payload (Formbook)", "value": "78c798ce0e68f39c675db659f19cd279fe03b074f9f12ae10c31ee961764a3a1880e391b03cc48aa4d59fa378564f8e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323166, "uuid": "f2db6837-299b-499c-85b3-46e0fbd6c408", "value": "T1B404AE32D601C070E2B252B5B67D0B7B883E0D347295A1AAA3F51AE16FE45D6F13931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323166, "uuid": "39035040-fb4e-4496-b324-61372683cd12", "value": "3072:LC7EFo1oFns3phSpEoqYOqbHjzGDHb+ZtbIvCJXrqs255JtVM:NPipspHqYOqbHjiD7iRI6pqsq5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323166, "uuid": "32034187-93ec-4437-aa4f-4c28c7087faf", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323166, "uuid": "6efc2f40-cb6a-4890-a4d3-20da9f75d1da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323166, "uuid": "6797d41e-baa5-4958-b772-0b189d30a717", "value": "f153dbff060014738d4acb9dd79afd626d82abc59202a6d1d6754fd7f343774d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3f4df7-e2ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682345984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345984, "uuid": "6dfb91e0-88e8-4880-b163-7dc4dc938637", "comment": "Malware payload (SnakeKeylogger)", "value": "722688b0c3707dd1e0c3fb5ca42bf2de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345984, "uuid": "8616fc86-7c36-4038-bd05-e0c860bf0862", "comment": "Malware payload (SnakeKeylogger)", "value": "f3930872b28e5b08c22af5b2714e5295d2fd7a2573b9e01444dbf93dfc723420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345984, "uuid": "3976e76e-b7ca-4017-8c3a-5a6d4e52bf1a", "comment": "Malware payload (SnakeKeylogger)", "value": "515a191d3154efa4920c33a1609819cb39bfbef7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682345984, "uuid": "d2058c6f-4c83-45a4-a991-84c0486be09d", "comment": "Malware payload (SnakeKeylogger)", "value": "509197f2532432f799a53b3271fbf6131a9aa8728a21eb112925cc3b0b9d08f3624e28f53ed84318a91cd112cacb24f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345984, "uuid": "4ec81431-143a-496d-abe1-67e62412eb32", "value": "T1A9E4BD17221AD5F6D16E56B3E0E617FB0E2C2ECAEE79A0574BAC7DD4317237A0B48401", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345984, "uuid": "931354b8-4872-4d87-a5b9-52f72195cb56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345984, "uuid": "846a1fe4-c3e0-437a-8ffa-1420ceea77b9", "value": "6144:BCl4ErDp2YhX02OkF5efVEVV9WcPVorxZfl+b1RalyX+ikJMYAlafaBxPd8R2rO5:ByShcfa8KMWYPrODodMMi6Bine2ahG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682345984, "uuid": "934e1c5b-5a70-45d4-aed1-0cfe8a9c7682", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682345984, "uuid": "f79b36fd-e791-41a2-9bf6-7ddcca4ce10c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682345984, "uuid": "6e6b75e1-cbb8-4e1a-993a-af14932fc113", "value": "PO ETYFG54H.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6060f93a-e276-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682323356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323356, "uuid": "03d9470f-0dd6-4f56-bd28-df5c2aaa1069", "comment": "Malware payload (Formbook)", "value": "2f06c2aaaad39dfb480607710e1169e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323356, "uuid": "3199cb0e-9e20-4e4c-8426-99ef86c9fddb", "comment": "Malware payload (Formbook)", "value": "f3aa635a38f6737c7250e72a15aa596ca55d1cf31398bdcb7c5c6254cadbabf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323356, "uuid": "2ae8f47d-e8d6-4730-b16e-ccbb52a26954", "comment": "Malware payload (Formbook)", "value": "1613ad841ec7290329e3bdf4495b71de9cd220da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323356, "uuid": "172bb183-7544-494c-b7f4-2f07159adf6d", "comment": "Malware payload (Formbook)", "value": "431d1e6b0dffdda3d690aee39a21b88699042bc0c38416c4071a2a4fba0f40b32a614bad5bbcc837d990f4ebfe703672", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323356, "uuid": "fba75369-dc3d-448f-a8ee-17aa5e7cc8e8", "value": "T1EBE4CF2B226AD5B6D14E56B3E0E527FB0F6C2ECAEE7590430BAC7DD431727B91B08411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323356, "uuid": "c19ad64f-2212-4be0-a29c-d2dfd47e1d0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323356, "uuid": "4c80597d-d7fd-4ff2-ab0a-b045a2a0ac61", "value": "12288:9DiG7H1Cgu/1OL+X1jjtEaIrgA9i/RSaeXv:9DFVgdOL+X1foNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323356, "uuid": "c55f0804-4797-4400-abc1-c2fb01389f83", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323356, "uuid": "31bed03e-2e71-4736-9c68-483ce434cff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323356, "uuid": "eb2ac0ed-3580-4fc9-9615-939cd64129ea", "value": "32426387455_W5373883.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3dc297-e2d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Pony)", "timestamp": 1682364014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682364014, "uuid": "15be2587-6ecc-4ba9-b2db-48c08019d1eb", "comment": "Malware payload (Pony)", "value": "05aa77273fbe5efb245560f519cddded", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682364014, "uuid": "1ff3e250-710d-4c9a-a6a5-06d1877edbcf", "comment": "Malware payload (Pony)", "value": "f3b60b9fb81de5df1dad130e2f384654f4cfc532bfe38f9719b6e43647334dc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682364014, "uuid": "bfc8002b-2155-49fb-978b-c201f282e63d", "comment": "Malware payload (Pony)", "value": "15ad11fb49503dbd6c0d2f793532dab50a9d228c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682364014, "uuid": "0ebb09d1-ae5b-4580-a111-3bb511ff07ca", "comment": "Malware payload (Pony)", "value": "9cbb919e455aea3ae672422361f4116db8bb84114b81c9ed84e84a1f95555f1225fef854e9761dee5daac865fec166b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682364014, "uuid": "0d2b15f4-c43f-4302-b634-628d25f7f282", "value": "T193B3F195F1A2617FD8E0BD387EAA7F727C67742E8259534C204ACD012279663837DBC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682364014, "uuid": "a4426dc5-2bb7-4a36-94fd-b607798911b9", "value": "65bf5cfe10d8c98f9683c9cde4453332", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682364014, "uuid": "89b620c2-3d98-4500-96ff-0a6a5e6e1b0f", "value": "3072:eaGd0JWGpj28eQ/KR2i6hPPGf9fdLi7Ulq0SN:Y0JWGlpeQiR2fPSfdNlq00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682364014, "uuid": "893bcdbe-d290-4098-ac36-f9333bf0c6c9", "value": 116736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682364014, "uuid": "74fb5135-b3b3-4a56-9ceb-6c3b5083a689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682364014, "uuid": "db2641e5-2057-49b4-824e-097782c20b2d", "value": "05aa77273fbe5efb245560f519cddded.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50bf4f34-e28f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682334068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682334068, "uuid": "ea2fbbc3-38ce-4514-b003-e16bc063c2d8", "comment": "Malware payload (SnakeKeylogger)", "value": "862838fa4db8d553de90067f76c670c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682334068, "uuid": "9cbdc7d7-b46e-4ccc-959e-659b904570f3", "comment": "Malware payload (SnakeKeylogger)", "value": "f3d464c84f092c9d130b476fabc09c6224fb9e4a006c186a0c622d0b6b300c1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682334068, "uuid": "93022cdf-db37-4e63-8343-6eb35ecdfb90", "comment": "Malware payload (SnakeKeylogger)", "value": "2f0d576a3cb58b82e40685d4342f783195f7eb55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682334068, "uuid": "18b9db7a-5795-41ba-bfcb-3f806eddaeee", "comment": "Malware payload (SnakeKeylogger)", "value": "b8ee21b4661436d62e7becaebd6b4bc5ea611aa2f1967119380fc88686b035b6bba7a4c7edf7b3aef052cfa32abc48de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682334068, "uuid": "700988fb-6de6-4656-b41c-0751acce399c", "value": "T159154B93A154C8B6E85F05F2ECAA56731C9E6E8CDCB4400D169D7FD632B3372219ED0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682334068, "uuid": "c71411fc-6d06-4fbc-b627-7d43c8ccec67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682334068, "uuid": "93000af8-648e-4247-a60b-50e7dea7e7d2", "value": "6144:OCtgErcp2ChX02OkF5efVEQMq7BlTHZU34Wq+3mD/NIbVy6W/p6SPVO01E3LBq7D:On6NHh6fW/cFlq7NAkPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682334068, "uuid": "8f63b70a-9525-4976-9bac-296b6f904711", "value": 933888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682334068, "uuid": "c274a88b-e525-409e-a794-cf17f3c7dc78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682334068, "uuid": "cac7bf89-7695-44b1-8d9c-633c1b647354", "value": "PO_20230424.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43376ef2-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682346930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346930, "uuid": "55b51fd8-592d-461e-9fb4-c6a26c817619", "comment": "Malware payload (AgentTesla)", "value": "c339bc586c83d1b770c9493fe29269e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346930, "uuid": "a7ddc81b-1495-4240-b3e7-e4a80869b054", "comment": "Malware payload (AgentTesla)", "value": "f41e8435ed94d40a0225a5f411991f630f1db80fb2df805da76449bf52889ad1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346930, "uuid": "94ae1fcd-c748-4b59-8ff8-8db7c427a507", "comment": "Malware payload (AgentTesla)", "value": "a1dd723c1de72ff3146017a789cbd6a56ea533d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346930, "uuid": "17740192-d918-494d-a718-1ad64d2e7251", "comment": "Malware payload (AgentTesla)", "value": "b04950b251551fcabe49267474cf5e1cc3f0494892080810ca75863d518a5b6f0842a3b6c33d1b8358e957535518be18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346930, "uuid": "14be68db-8439-4278-a08b-bdeef3dfbfc4", "value": "T1CEE4E164F2092CE2D68B95F2091A63672A1973CE6D3C65947B79B5E121B33CF1F89C03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346930, "uuid": "04ede341-3882-49c4-a837-de3bc5709a9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346930, "uuid": "78b491c1-f9b6-4932-b23a-e67555252b6a", "value": "12288:b0gjjnkCS3987z6A6zdfxMInd5QUgq+uPdleJ3pbZV:b0gjjnkCStM6A6zFG5bZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346930, "uuid": "af825c35-e893-4633-9e18-2e0f246303ec", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346930, "uuid": "56ec3871-1f0c-403b-aafe-285211e79565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346930, "uuid": "01ec17a7-e7e0-4687-a43b-9c91c1221230", "value": "c339bc586c83d1b770c9493fe29269e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af12324e-e233-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682294712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294712, "uuid": "97700fcd-7cba-47a2-bbc8-60f48a9fdd10", "comment": "Malware payload (RedLineStealer)", "value": "be663565c433ee9cb64da52e896d6dc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294712, "uuid": "d646ed16-b21f-45bf-908a-76389c64d6ed", "comment": "Malware payload (RedLineStealer)", "value": "f78ad9e5332d2a8937fe890fcd2c6bfeb4d7487f2fbe3827a75efe510467348b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294712, "uuid": "b99fa8da-7b03-4bf9-8adb-03f6c044b2c2", "comment": "Malware payload (RedLineStealer)", "value": "33c7c6145b0b8de7e742998b0e1485a336c8a6b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682294712, "uuid": "6987881c-35f8-4c0c-a8a6-793a6460cb18", "comment": "Malware payload (RedLineStealer)", "value": "e02a0397a1655e8afee732bdbd47e156013c585e7c8ae7e39f7d03ecb24884e54ef1711794896587d585226685a5a187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294712, "uuid": "29dbbceb-30ac-442f-b0ef-6d99db5c84e5", "value": "T10E252362A7D88436ECBA17B008FA11930B3B7C8356B083E76A51D94E1D739ACF131767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294712, "uuid": "edcb42cb-6ce3-42c4-8e6f-7e86720a1ea7", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294712, "uuid": "1a330722-5ccb-4bf7-935d-baf342a41967", "value": "24576:xyXAIDBUXMx1bgXtQhkI3n2+hIKUapjcCxGU:kXA4UX21gCh/9hIKvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682294712, "uuid": "ee23b4de-87f0-4b23-a716-1ce47302f18f", "value": 980992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682294712, "uuid": "a4dcb12b-018d-4580-b6a5-53b81cbb05d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682294712, "uuid": "04d78143-d4ee-4f44-be29-7f278b4f3c73", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36448dff-e2ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682346908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346908, "uuid": "33695e29-5c66-45e6-b09f-f74d4ecaf286", "comment": "Malware payload (Formbook)", "value": "33b08a6f291d2d62ce11bc349ed3487d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346908, "uuid": "7c23fded-782b-496d-ac7a-08e4a0c2987d", "comment": "Malware payload (Formbook)", "value": "f877daae32612cf737745b22467c63f63e1961a6135289125dd228604fa0c29e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346908, "uuid": "ef48c95d-59e7-4ee4-aa3d-d235d1b7fc62", "comment": "Malware payload (Formbook)", "value": "a06c3031d3098a51160179458f604b0382c26a16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346908, "uuid": "5b2ed9fe-9832-4336-8e7d-bde1188b1527", "comment": "Malware payload (Formbook)", "value": "1c25a726a59dd772db90592eaa24c28def0c82f10a20521123b055713fc92d0138cce20655d347b60ac727e4bddb4d25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346908, "uuid": "406da08c-75f1-4318-ae9c-92046f5d0a5c", "value": "T1E3E4BF2B226ED4B6D15E66B3D0E917FB0F6C2ECAED3990430BA87DD431727B91B48411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346908, "uuid": "754a40ab-4424-4992-8214-d21053bc0181", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346908, "uuid": "7388dd83-413e-4413-9326-3db3fd51c98e", "value": "12288:YWda76TLGyuxNYZaOWiOBR7Eb1VW7YRkV42mEFdCH:YW3SVx2ZaqOB9W1qFXFUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346908, "uuid": "ccd62c5e-3b53-47a8-a1b7-9e2f610cdb63", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346908, "uuid": "4655024d-536e-45fb-a312-8daf57268bb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346908, "uuid": "52ce48c8-82e5-449d-96fd-bad723c0abe8", "value": "33b08a6f291d2d62ce11bc349ed3487d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f0dd26-e262-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1682314781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682314781, "uuid": "c00e0021-9123-4238-aad0-31fd44845d9c", "comment": "Malware payload (GCleaner)", "value": "f7fde7947578965cc58bea9dcf0aaa9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682314781, "uuid": "48694f80-e608-44e6-a8f6-b726c87e75e3", "comment": "Malware payload (GCleaner)", "value": "f88b778d7c3819667ad835b83140d188c47d6897be4aa0ec7fc8ba16eb5490bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682314781, "uuid": "602ac2f5-26e9-489f-be45-6711f8c0d27b", "comment": "Malware payload (GCleaner)", "value": "d892a79c0ce6e13c7de423044835b6e64a948bf4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682314781, "uuid": "67f3a08f-7014-4399-8304-228149d42b2e", "comment": "Malware payload (GCleaner)", "value": "d6f847162cfd44197455410647c52e232b6e3722baa19771cd649a98c15f2eb43dd5e0b9ff84eacd44879dee765ca38c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682314781, "uuid": "b6f262cf-ee57-4177-880d-29580c6bf67c", "value": "T18D64F151BCE1DC76E97A317488378A962A7FBCD10A158946B2BC378B6D323C15E31387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682314781, "uuid": "c37e8799-dd11-43f1-bfe0-e9d6364159c4", "value": "83f7b03b4e2f4d598c9968669b5cc91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682314781, "uuid": "68f27d20-09cc-4a5d-9344-8b9ccfec8057", "value": "3072:qOGy3s8ny3sfXz4GlXSwmjhJA6IuJ8AqXrkydWaqSx53tKe4KTFhZOrV:JGShcsfszVh7IuJnqX3dJbtKePYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682314781, "uuid": "d8c5ec7b-41e5-4550-90e3-409c17d77909", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682314781, "uuid": "b4969666-3685-4440-8ba0-9332e5c1a188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682314781, "uuid": "ddb5631b-1549-4f02-8e83-7c5160defbd9", "value": "f7fde7947578965cc58bea9dcf0aaa9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad478675-e2ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1682346678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346678, "uuid": "15a45bd5-0612-4b9d-8b7b-1f680b823633", "comment": "Malware payload (STRRAT)", "value": "55ceae2a86b4f6a68f2ad1f755406298", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346678, "uuid": "75058115-b884-439c-b87e-b6de7bbe862c", "comment": "Malware payload (STRRAT)", "value": "f8a0b74e3cc85640536fe22899f029661020895fa31aa28eb1b05ad623ae83e5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346678, "uuid": "93ac9cb4-856d-4eef-8e11-ed35d0ef49a1", "comment": "Malware payload (STRRAT)", "value": "69c43ad9d1ca37cba17273c849f434d69ad7f326", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346678, "uuid": "5ca16697-b45c-4822-9068-f5ac4c363368", "comment": "Malware payload (STRRAT)", "value": "b6379e26a963e30ae3f8b225911edc794ea652aec92b4502139eb3a85a43d6e9ddd5484cb9974d2f2f645f8341349bac", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346678, "uuid": "d5d26358-8bc5-4ec8-a85b-bd254f22ff4a", "value": "T19824012BFD9D85E8E157453621086AB1B67E42E4C48A92BF21FC045E0C35C8F1756BEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346678, "uuid": "f0d2cde7-642b-42a0-b504-68dd7d5bc6a3", "value": "6144:5yuyGcBXwPs9XBgx1kivvGMkMBiatvgc7VWS2n0:5yuyrJ9zivvZkeNVWS2n0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346678, "uuid": "d1cb8436-034a-41d8-9623-6acb206fd1ef", "value": 225080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346678, "uuid": "fe1b03e4-0d82-4eeb-b152-7fd4e5e1bf86", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346678, "uuid": "71b34d23-d229-434b-afd4-483fe7968bf6", "value": "img QUOTATION PO# 2023524 001_jpeg.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef804442-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682323167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323167, "uuid": "5229f320-5ed7-409a-874b-dedfb3a76e04", "comment": "Malware payload (Formbook)", "value": "212a3f6b5f7e38227a4762810b2145e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323167, "uuid": "f016fe12-4d07-4438-a6d3-6b02ef4c60e1", "comment": "Malware payload (Formbook)", "value": "f8b1ba811be8ffc9b87d3f55b5c8c0a10b3d468f119eaf1d5c36d5664b940a84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323167, "uuid": "2f3898d6-7040-4a50-bfc3-9ab2cde8a914", "comment": "Malware payload (Formbook)", "value": "1c315c069d79bb6cc7713f150133d9ae9a90802c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323167, "uuid": "be914efa-ce2f-4148-bb6d-046e572ee073", "comment": "Malware payload (Formbook)", "value": "989a0cd36d2a1568f4d27f7c7760b82d489f2f7533aa4ecd745e5051cf7025a2a0fda0af0dd04e092dede34e12cb575e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323167, "uuid": "319297e2-da8a-428f-9f51-279e8f883ec0", "value": "T1C404AE32DA42C431F2B252B5B2BD1B7B883D0E353295A4E9A3F115E06EA19D5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323167, "uuid": "6894d9bb-4f9b-4ad0-83b3-8e43215103fb", "value": "3072:eGcUkxSHP3Er83AYT8NGSYW67OycFpITU+ucNRPvCwlUKw:qysyAq6x6KycTUucNRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323167, "uuid": "ac98c781-13ab-410a-a6bc-d352cfd6f7b2", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323167, "uuid": "f5f3d707-6752-401b-8b8b-4e41d3e39fb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323167, "uuid": "8f5008f2-ff90-4188-9468-3e353a78644a", "value": "f8b1ba811be8ffc9b87d3f55b5c8c0a10b3d468f119eaf1d5c36d5664b940a84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fec185d-e2ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682346226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346226, "uuid": "91b1374f-6a6c-4628-b095-ec3c520a2ad4", "comment": "Malware payload", "value": "abe89236c3c78d7a24c778caaaf8ce1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346226, "uuid": "4da5a396-8dfc-4355-8d4f-63a3f07cabd0", "comment": "Malware payload", "value": "fa0f3999676e7f663063c9399f7034e34efe7e369b870cb280e88adb25a4eca2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346226, "uuid": "202f741a-b9d7-481c-86a5-aa09a6c793d5", "comment": "Malware payload", "value": "bc74cad585885fa4aa7940a53924d90a0f75bd96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682346226, "uuid": "1b7732b5-1524-4a61-a9a8-c856b4e4bb87", "comment": "Malware payload", "value": "64c4531ad29a903f97b6522698d943ec6256fcd2b46d7d75bbffe7536a153aef9d2bcfaec3e6565c14f3c4e4e94b6b75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346226, "uuid": "e9e54607-2a6b-48a2-9138-6547ac2b4a69", "value": "T1ACA33802D5508B57C1D2177ABB9F426D37332B68979B3321AA247FB82BC279D1E3D121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346226, "uuid": "231a508d-6e16-442d-9dd4-109423c358bf", "value": "3072:iHobm0w+aSP+w2sGZmDYgTE+mBQO/IXZFW:iHo6+aG2sGJEE+mBQO/OZFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682346226, "uuid": "1291fc80-ece7-4a6e-afb1-2b1b076f21d2", "value": 106529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682346226, "uuid": "ad7ace57-5c54-4257-9720-b3bc65d2f2c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682346226, "uuid": "a51ef9ca-6722-4879-afe3-192a86f9e38b", "value": "abe89236c3c78d7a24c778caaaf8ce1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a81b9fd-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330299, "uuid": "75a9b92e-4967-481d-b4aa-e1ffa877b349", "comment": "Malware payload", "value": "ba783b98fc6275612ee6ff3b366d7616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330299, "uuid": "b4a0ad48-ff53-437e-bc4d-e261376ce60e", "comment": "Malware payload", "value": "fa2cfb4b76c38ab4cef4592ed703a8866ffffec67adbe9ea057882b47a4bd7b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330299, "uuid": "039908b8-0267-47a8-b996-8bd749645dde", "comment": "Malware payload", "value": "59620ac529ff5b6543ee564400bfad97c2cf4516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330299, "uuid": "c02fbf5d-0541-408f-b44f-1af98d17dcc3", "comment": "Malware payload", "value": "d555892af05c02d46c2946653330475bf7854ac6c51a12c9d0bf196f5d939779479a0473fcc83b319640c2f0ae96223e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330299, "uuid": "cfd71355-b204-406d-ae88-d8342a43f3d7", "value": "T16766D1DEA044826ECA5F07B9E4C68E72E431E1F11FBED36A5964C0E41B974A44F1FE60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330299, "uuid": "0969bd89-3cea-4a0c-9fad-b58fd230e605", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330299, "uuid": "b0e39394-a421-4507-8df8-d792b83cfcfb", "value": "98304:u21PeRxnp14RpcySxOwxU01lp5dT70RdJ6APzEkks1d3ZqazpUuq:u21WeRp5wx91xSR+qXAVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330299, "uuid": "19aba121-54f6-4053-a453-9b2198780628", "value": 6665728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330299, "uuid": "1dcac59f-8b20-4ac0-bc45-60f51f4ebfc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330299, "uuid": "332b1d18-4c67-4b88-965c-de9f16d9e9f4", "value": "fa2cfb4b76c38ab4cef4592ed703a8866ffffec67adbe9ea057882b47a4bd7b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389bda4e-e2cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682359797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682359797, "uuid": "53959506-26ff-4afe-813a-58d558b72ec6", "comment": "Malware payload (AsyncRAT)", "value": "82939ee2605a46e68018d5b075ef8e7a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682359797, "uuid": "7fc42b94-0cd7-4edd-8aa1-040b713be74b", "comment": "Malware payload (AsyncRAT)", "value": "fb11be4f9b79350a9b1e70ef3e835d0c066f15ea84424bc639e0fc70227d05a3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682359797, "uuid": "8b308910-b265-4365-bc56-b3bde73362d2", "comment": "Malware payload (AsyncRAT)", "value": "6579b9eb62650df681b9ddc870d1012d23b85b09", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682359797, "uuid": "1a6b8a08-efc7-4bf6-8883-76ca646b6b52", "comment": "Malware payload (AsyncRAT)", "value": "04a0a6308895c230a2da1f152e11be35e294e8c4f077f89c040b5d314038b8a187389c8c3b0ed4b69edf819d28ad8ee5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682359797, "uuid": "54e68e2d-883b-45d2-b1e2-22d7fbcea6c9", "value": "T1B16308053BF9812AF3BE8F7469F6658546F6F5AF2D01C55D0C8810DA0622BC29942BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682359797, "uuid": "5e07f773-d53f-48b5-a508-67f94d1530b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682359797, "uuid": "1fbd566f-6276-492e-8692-d2c518c07e45", "value": "1536:v2UukvF1tkk/hEYRo2NQphePvUgcKu5UYF5KzUWudRj5sjsjObUu/+tfPQNnr/rR:v2JkvF1tkXKu5UYF5KzhuDj5sjIObUlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682359797, "uuid": "d332fed0-0b0a-4bdc-a603-b01a723b3a9c", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682359797, "uuid": "9688d162-4c3f-433e-87ed-57711984c3f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682359797, "uuid": "71db7843-ee92-4c1e-94e8-5001e52ce3b1", "value": "stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e0f04f-e2fb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682380522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380522, "uuid": "ecae6bdb-cd42-49d9-aa34-da1b943d8707", "comment": "Malware payload (RedLineStealer)", "value": "63410abc2515f8eaf129045d6b1e4e69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380522, "uuid": "beb34f7a-8d13-4ae6-acf7-b04a7998b741", "comment": "Malware payload (RedLineStealer)", "value": "fb3ddb460849000d62587ff386325e2b000af5deee166831eda4dd9645dfb6b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380522, "uuid": "0b023c8a-097d-4dfd-87be-e87a07733e9f", "comment": "Malware payload (RedLineStealer)", "value": "10dd7e59d7565f539e26ef1ab274db7bf86a0dc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682380522, "uuid": "a89fc24f-65c0-4b77-9502-2bdd55bdbdcd", "comment": "Malware payload (RedLineStealer)", "value": "c3b8c7187957f77a1663304958272eb6d793fdcce70f29196a6df543b06f453d41dd5005864eb568222162ef6c75c3fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380522, "uuid": "b3f0b063-383f-47cc-a9fe-044bf277df8a", "value": "T1BCD41243F7E84037CDB51BB059F64347073ABD62AB698B9B2796589E1CB21C4A03173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380522, "uuid": "15ee3251-89ad-4099-8a6e-258cd45ff4bc", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380522, "uuid": "636c9ecc-280f-4632-a21a-d9aebc839835", "value": "12288:Ly901+IEJL6YMcUsbv/2mdVZ5+4vweAqKwq2/mgp4zkwJz4lg:Lyq+IEJLtVymdpt1AqP5hpj/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682380522, "uuid": "d9b3835e-2a61-446d-a536-f74b1012d8fe", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682380522, "uuid": "bb06d3ad-f01c-49c7-8037-a109737ef7a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682380522, "uuid": "e66efefd-01e1-4bf9-8a1e-0296dad60467", "value": "63410abc2515f8eaf129045d6b1e4e69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371d6546-e28b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682332307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332307, "uuid": "01a1fdb3-cf67-4895-ac16-7293933237a2", "comment": "Malware payload (Mirai)", "value": "86f4847ec6357e05d7fb584ad86bcb91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332307, "uuid": "116bd00f-cf68-410b-885d-9471a7399bec", "comment": "Malware payload (Mirai)", "value": "fbcc8754cd9d80a796ab7d0048f39aeae4119be7daefe6f2240dad4a818f8c91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332307, "uuid": "36afa79f-8dd4-4646-a022-1f156a26da57", "comment": "Malware payload (Mirai)", "value": "490d2ce6cfe9961d0514517b92bbbe83f98a6dea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682332307, "uuid": "a19fd490-1775-4840-a4ca-197d8e17d04e", "comment": "Malware payload (Mirai)", "value": "ca9c84cdfd9af98fa13e8275e3d1e62acaaf8dd2d42c3fb1d7728ad823dec2099fc745b3630e175255483a1ee2f10ee0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332307, "uuid": "bf6fe67c-ccce-4e29-907c-df01fc484f10", "value": "T11D432925AD792E26C0D4B57A51F78714F2F2220E26B8C61E3CB21E4EFF04B4065577BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332307, "uuid": "d3d10e87-68d0-436a-9101-fac300900943", "value": "768:TXoo0IEq9wp3C+vuctfa1sDHDYAzsv6WswWSHoXdss63B/9JO+zC32:TXv0IESY3CauctfI6Dvzsv6vwcGJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682332307, "uuid": "3129f4bf-4c5c-4560-96e4-4b4e950fc1cb", "value": 60116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682332307, "uuid": "a4b3f615-dccf-44c7-a1a3-ed30dbd53ed5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682332307, "uuid": "f5518828-da49-4310-9162-32b924968896", "value": "86f4847ec6357e05d7fb584ad86bcb91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58d362d-e268-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682317594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682317594, "uuid": "47565a7a-3b43-43a2-aeab-0b93b0c86bf0", "comment": "Malware payload (AgentTesla)", "value": "3c88ec32f8490263f19e861fca809d1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682317594, "uuid": "a6353ced-20a3-46d9-9407-1db861b669fe", "comment": "Malware payload (AgentTesla)", "value": "fc5ea1c67d2177ba18b4465551fd8e07c8b3c223443d17a364f2b7b3078aa189", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682317594, "uuid": "1b9c9a88-7e0f-4711-acbe-31c08c752088", "comment": "Malware payload (AgentTesla)", "value": "7d9e071bcb1463e935a52f4296423dd37a8b4115", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682317594, "uuid": "2f0ca0b2-ec86-435a-9387-5977518449be", "comment": "Malware payload (AgentTesla)", "value": "709903e43e0c1b0d49292bb9eb9008a7f04ce5c1cd51d304592ab328a930cc89acaa02ce494d65aa33527d5ab8eca8be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682317594, "uuid": "2d3db0e7-43bc-48a9-a8bb-046d9f6752d4", "value": "T10DB47A2CA9ED49FAD435F2B5DFBA8821F5A7C52372508D38A5EB41484606DC336D02BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682317594, "uuid": "ba3c9324-f0a7-47a3-b402-b12241309a67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682317594, "uuid": "7f6a4e71-324b-44d6-b206-93b78eae3742", "value": "12288:Mn2iNXnjq6SEX0VqJQnOAZoN8dyhwzQ/nIKgQz1aX3:01J4IXAo+dyDIKgQzMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682317594, "uuid": "e1d3cc1a-1c37-439c-9984-2a602a6b14c7", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682317594, "uuid": "276e9a3e-31ea-44a1-9833-4599b704b19b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682317594, "uuid": "297c9857-5e80-4589-bafd-970c6b3b5ec0", "value": "TT copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac2546f-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682323186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323186, "uuid": "0c4ebc0d-aa5d-4802-88a3-2f943a2563ed", "comment": "Malware payload (Formbook)", "value": "86e0b314413fe434b365244865887ad9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323186, "uuid": "f5c2ac74-3c6f-4cbb-8321-358b78a6eed0", "comment": "Malware payload (Formbook)", "value": "fe7399693ffec861fff386b07855b2137ae3eb8784723a7816f78122c4c22c80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323186, "uuid": "82d6937d-3a81-41ef-9f9b-fb4722acd9cc", "comment": "Malware payload (Formbook)", "value": "dd5b9c8ae7d13b565beb99a9c4c168ced300fee9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323186, "uuid": "86f9a7c1-e0b4-439f-9aaa-daa128325edb", "comment": "Malware payload (Formbook)", "value": "d7c758aaa71a39bffdcdfd30be7200173258c5d554fac8a532cbec1c28aa19e7f661393bd75050a9eeb06d1276168b6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323186, "uuid": "15462ba4-febf-4561-b2fd-842bf8439234", "value": "T16AE4E0D96755D7D2C6253D7C222B717C3FB044DBEA5BDA26FD89205A3E327C80A4038A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323186, "uuid": "548f0ba6-7f4c-4b1d-b4e9-ddab87c43c05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323186, "uuid": "e3aa599c-3201-4dbd-bc84-57d55fd9e0bc", "value": "6144:jlmN3/2GhNJF/PlDJIbusQIAVzOGoxGX1yOLeVldW9Bcd7bf+oICuny8YGWLO2VP:c2iNJHCQUB7biBX5WL5wRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323186, "uuid": "b82a482a-b28f-49f4-bec9-d7669e35f859", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323186, "uuid": "53bf4f13-69a6-418d-8ce2-a0de436418c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323186, "uuid": "3ebd3071-4455-4853-9f3c-12cafce5718d", "value": "Product_2798679039798.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13cdb567-e2fa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682379922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682379922, "uuid": "c00a9406-93ae-4c5a-b3b4-6d64824ced2c", "comment": "Malware payload (RedLineStealer)", "value": "37888df004aa3046b1388383dd80adf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682379922, "uuid": "a9d01301-fef1-412f-b205-abf68ec59722", "comment": "Malware payload (RedLineStealer)", "value": "fee0a609f1554529890f1c56c3aa61734e8e36e69bbf1afa749ec7e3b90e5f96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682379922, "uuid": "c64c0d8b-13d7-4220-b1fe-aeb9b9ce1339", "comment": "Malware payload (RedLineStealer)", "value": "531177ae8a01b4e6e14f89ec045d44076081dea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682379922, "uuid": "3c257daa-d058-45e3-b7af-d8f59dbddc2d", "comment": "Malware payload (RedLineStealer)", "value": "ccf3f371569e23afa179fed3411033060de25a36c57e70670f4aedfdc2a36536845a12b72c9f3f757c2b1694e7280d68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682379922, "uuid": "1ecd4d29-af47-4f8d-8b0e-9b6f14566a31", "value": "T16FF4126296D68073CDB217F06DFA52C31B367CA18FB847DB228A198E4C731D5A53532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682379922, "uuid": "ac82e969-251a-4d2b-842a-ff083e2300a6", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682379922, "uuid": "b8f40d29-1597-4a9e-a852-9fd8e18abeae", "value": "12288:Iy90sqaJpsFCf9E/fH4ir30LGYzs4Bde7k+HZC1XbN4wJnuyG5tyNoC:IyNoYu//Hr2Zs4WpHZCBbNZJuyGnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682379922, "uuid": "0ef7c87e-9994-4874-a7d1-b6ae45223753", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682379922, "uuid": "3cc5e8f5-a66f-42a8-8a04-a8acbd697906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682379922, "uuid": "dbc73afa-7f8e-4079-8417-e3627d7ec0a0", "value": "37888df004aa3046b1388383dd80adf1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1485b780-e270-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682320652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320652, "uuid": "28f802a2-4d2f-4fd4-b823-fea79c77770e", "comment": "Malware payload", "value": "e7a4fc18d936639e7d9a316d2fa3a259", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320652, "uuid": "79d9f811-21b5-4b7e-a316-b14fdea976a0", "comment": "Malware payload", "value": "ff0383afdd375a44bed9781328dcedc705be370a8d999dde920be5f38ce03fa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320652, "uuid": "cbdc285f-0d12-46a8-b4a4-9e23aabd285e", "comment": "Malware payload", "value": "2c99e6bb01c0662064a87f580bfad92056939819", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682320652, "uuid": "d4b4b196-4a73-44f2-a2c5-e2c8f01a1cd5", "comment": "Malware payload", "value": "649d6cd4cc452c6896c85c04cf1f2abaae5d2650927c55df9d30e7727391cc110e67287dd06e3d430df0aa53c630ffb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320652, "uuid": "b51a1de4-0886-4fa2-89e4-91c044f0a6ac", "value": "T1722633E339D9BA21FD5179770E3839D545A30490BE600DD99AC42DF8BEFB2D41B98C06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320652, "uuid": "01ee30b0-c085-4152-ab3b-0afe2ba2e63b", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320652, "uuid": "bd15322d-414d-4a53-860b-f0b785e1e6cb", "value": "98304:YOZrKb90OZGJvOsAL2Nb4kCHqSjbMXizjAgTLHX:B5Kbzg001CKS/zEOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682320652, "uuid": "d2f7a86b-aa8c-47a3-ae00-c5312daf72f1", "value": 4514304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682320652, "uuid": "f4ccd592-6b43-4613-a3bd-2ea5e662e340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682320652, "uuid": "8a6eb4dc-02bf-47fd-8755-51dd4480366a", "value": "e7a4fc18d936639e7d9a316d2fa3a259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9560e6d4-e28d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682333324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333324, "uuid": "1e0ab4d6-982c-47fa-bf52-d967ffb55c10", "comment": "Malware payload (Mirai)", "value": "1440ce27a219ff1f0d9aa98f629af5f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333324, "uuid": "72494ce5-ce46-4588-9313-d065e173a856", "comment": "Malware payload (Mirai)", "value": "ff70d268fb9b7bd8f39ef5458d221fc8d9874b3cdd67924a31c4fa4e92aaad8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333324, "uuid": "232f4221-0d9c-45d2-89b9-9da383088cdb", "comment": "Malware payload (Mirai)", "value": "92f4a982ce84e9d51b4b357c9ab31938e01e4e1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682333324, "uuid": "0f2eab75-a9e9-41e0-8932-58d7b8b87cab", "comment": "Malware payload (Mirai)", "value": "85549127f46349e6ff4f02e05e94a4db07d2fa78d0cf563bdd5bc586aa3b5dfc2eb2008d6b8969c5bdae110cf60424e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333324, "uuid": "57a17802-b401-43f3-9f9e-a7a85d3d2c64", "value": "T1BE83A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333324, "uuid": "9517ccb0-5f97-40f9-a101-07720a4e7b53", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTT7ZDYovZ73x/nL8y8QF:Rakdn2Eo3ePu5GTTRYo99Be037WG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682333324, "uuid": "08dfe69f-b42f-473e-b5ef-31bf9670c13a", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682333324, "uuid": "4a9801d8-431b-485b-b51f-9ba2cfbca0de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682333324, "uuid": "23ef73f2-ed58-45cd-b318-e32152771532", "value": "1440ce27a219ff1f0d9aa98f629af5f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1047ae3-e275-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1682323170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323170, "uuid": "355edd18-bce7-4871-a914-6d3106b80e77", "comment": "Malware payload (zgRAT)", "value": "2e58932b8cd3a333b2554d13957e97ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323170, "uuid": "1cbe83f8-417d-4561-9f02-bee2d1a96cf6", "comment": "Malware payload (zgRAT)", "value": "ffa10f4c5af37a14534e6ec54252515c98cc03b114df0ad55b9c84e343aa5ab4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323170, "uuid": "2f739060-1dcd-4e2f-99ea-c9ce416941ae", "comment": "Malware payload (zgRAT)", "value": "8ec41bcc06c9d5b2aa74f59d155ce80b4441260c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682323170, "uuid": "90100774-d874-4a8a-90df-4969f063dfa3", "comment": "Malware payload (zgRAT)", "value": "924a0778e985cf53a5cd036799edcfb951db5b0f3b91bc8ff969993993e451c953fff7815fda52def1b9fa2de3601814", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323170, "uuid": "c0450605-b471-4eb8-9007-1b3d84dbfcef", "value": "T14E05129B73EB8B53D5394236A0F3256413E1D6D729B3E39E3A0052A64F413E9DE05BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323170, "uuid": "74eb132c-9b76-405b-ba37-7b471407c336", "value": "24576:znO+5f0NU8TfEai5mievlrFvwrMC04qK:OU8Yz5mQrMC04q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682323170, "uuid": "4b827e44-7e7e-4a74-9783-e2d4299aff31", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682323170, "uuid": "3c21aaf8-5555-47aa-b644-e8746adb9d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682323170, "uuid": "f2f29d56-3c54-4a5b-a5bd-6c50e003cbd0", "value": "ffa10f4c5af37a14534e6ec54252515c98cc03b114df0ad55b9c84e343aa5ab4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb58dd74-e286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682330381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330381, "uuid": "b09bff0a-e58d-443b-a5b7-bd754b8605ea", "comment": "Malware payload", "value": "4233a7e9957da5f0cd61866fc75ddfba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330381, "uuid": "af90e2b3-f1b8-439a-a8c6-efaf6683f5dc", "comment": "Malware payload", "value": "ffd1f682649507fd850a8faf76b4c3c498dbcbef70bd0202126b91f24d5c1408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330381, "uuid": "a793f005-8cdd-4f59-a633-3aae357df7cd", "comment": "Malware payload", "value": "41ecbdd24cd88361ae920c18253e2ec61360c5bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682330381, "uuid": "2b4b8c23-75bd-4b67-81f3-4c4e02a65e93", "comment": "Malware payload", "value": "94df7dbc7c80d5e5ac4882821875a9a1f8e509e0e39677a0c02d7626a4de795941b0472e700eb281f49a34155a8942ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "in2al5dp3in4er", "colour": "#780132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330381, "uuid": "cd86963c-0495-4498-942c-d6371722941f", "value": "T12336C0EFA4005A39C12DE2B1C18F8732C837F3A61A27C34A8AD0D5626F9D5744F5FA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330381, "uuid": "231641aa-6e8b-4afb-b7de-75154a34ed0f", "value": "4c995a25e43d7a1348a3b90521069786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330381, "uuid": "93f9cd7f-31bc-4cb6-aae5-861de6daf70a", "value": "49152:Coxh6VGeSoP8OsV7yQMrm8plR7BoRB4CyNDJ/7IugZXyrDdpvSolTxoFd0Gc/6ie:phhX66yZd7jgK3SMxmd0Gc/6iA0htFYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682330381, "uuid": "428e69d5-0823-4b8d-a90b-725b6997e713", "value": 5186696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682330381, "uuid": "7cac99a3-0017-4f16-9bcd-4e97171af78d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682330381, "uuid": "38658862-3038-4d0f-9e3b-0f98ae09c6aa", "value": "ffd1f682649507fd850a8faf76b4c3c498dbcbef70bd0202126b91f24d5c1408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }