{ "Event": { "published": true, "date": "2023-08-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-11", "timestamp": 1691798581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "553ef2c1-d7aa-4c81-94d7-e3d84dcdd1ac", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8906dc-380f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691734828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691734828, "uuid": "d95e8ecb-de56-4b6c-9afe-e845c5df03ab", "comment": "Malware payload (Loki)", "value": "a1a2a96687bfb32d2cf33f4d20dc9c9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691734828, "uuid": "fc0bba9c-255e-4d81-8dea-1fbd53e4d6cc", "comment": "Malware payload (Loki)", "value": "0080ce04186ec4c7492a676c80136e84006b1dac3558f741ef4b2822251b22f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691734828, "uuid": "cf5051a8-667e-4925-98aa-4eabfbdeafbc", "comment": "Malware payload (Loki)", "value": "8d52827cc70b7ff99ea3e53029d05eee058b6236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691734828, "uuid": "bb508966-a223-4d65-87fb-c37f2ad6ba96", "comment": "Malware payload (Loki)", "value": "e1a84592d2865563a4ce5ea7c71d3ca9672a3e40574f69192a2f216b0714025d7b5df301e6cd23e2b3b12f4255a79c38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691734828, "uuid": "64e479dd-adae-4b47-b02a-7205dd192f47", "value": "T1FAF4CF60EE7DDF86E56B4BB8004ED70E83725C5A3523C13A1AAA51C6D0937C106DB7AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691734828, "uuid": "69c24711-f0dd-41e1-b30e-09cb72f9aaa1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691734828, "uuid": "20edd87d-c069-4547-9c86-0ff005d5252f", "value": "12288:R1PDog+GvnlWy10ix9JpnuOT5TtpAqS2J84LTiqH8X64OkshflqTjR:Y2PlM+9rhtKqRC4LTiMLh8TjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691734828, "uuid": "6ba70728-d9db-498f-ba4d-b4b90cab13e8", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691734828, "uuid": "df372bd1-e536-4513-8ae1-e101a075fcf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691734828, "uuid": "680f4e6f-dcca-4375-9947-ea6b22d45e8a", "value": "BggH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fd243b-3825-11ee-a6f9-42010a9c0055", "comment": "Malware payload (a310Logger)", "timestamp": 1691744460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744460, "uuid": "0ea017f7-de68-4129-bbd4-15ae392396c7", "comment": "Malware payload (a310Logger)", "value": "2c3fbb2cee9b79530534e53064ff68a2", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744460, "uuid": "a60854ac-5031-4db4-8f9a-80dbdd4327af", "comment": "Malware payload (a310Logger)", "value": "0107b32e98dba4ef3826e16bd3d5e03a8b277a5bfe9bd20c5ee110596cf00f07", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744460, "uuid": "4ffe87f7-a421-40e4-aaad-6a2e44b090b6", "comment": "Malware payload (a310Logger)", "value": "0f8a016173e7202ec2abe46ae038016fcd1b7742", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744460, "uuid": "6745528f-180a-4cfd-9436-5956eff1aa6b", "comment": "Malware payload (a310Logger)", "value": "9ef046dad60e782df91ee17d6cf020c8884d8d73ef4ff97bb0917052ee4f8f77e640a9daa704b88916caf9c0bc81b313", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744460, "uuid": "294f0271-3026-4dea-a3d1-954701544bed", "value": "T114644A822B6DDBA6DF3887FDC29A11D127BF11AF5401F3505CA360DA0435FBA46A8D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744460, "uuid": "375de301-3704-4eb9-b339-a525d29b1aa2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744460, "uuid": "b354351b-9bae-44ce-bf82-f79eebc12395", "value": "3072:CL36cR9EKJjjTeRVMHDAc2ik58O0uE9QoRsCm5ndL3qNP6q7DFfDnB7EsetTGK4E:D8JnTyKEuDvQoR/mrLqNSynyh+yWki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691744460, "uuid": "f1da0be1-a15a-4185-9a7e-1b944009453b", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691744460, "uuid": "cea565c5-e659-49d1-b0ab-bc226d29b6d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744460, "uuid": "d45d0f6b-77f5-46b8-b68f-694584f96177", "value": "hesaphareketi-01.pdf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2af29f-383a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691753354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753354, "uuid": "01626beb-e66f-4d32-8ae8-1e02901cc722", "comment": "Malware payload (Amadey)", "value": "884250a0bb03d8524e1951fbdbdd6ee2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753354, "uuid": "9f4d18c8-81ca-4b22-8816-9c90fa54e4e6", "comment": "Malware payload (Amadey)", "value": "01437ec4da869262d500bf1d0889a1f7397bd5373374a6e82b8c89130cd0e240", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753354, "uuid": "51d985ea-8e7c-488f-9d40-67dfe961d1dc", "comment": "Malware payload (Amadey)", "value": "987407496bdc3907033430198110170692aa1619", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753354, "uuid": "a4e57d9a-5d97-443a-821f-ac1ecd5d8141", "comment": "Malware payload (Amadey)", "value": "e468a9e3b2a07f9f60c085ddcd9a97264effb10861513c1a600e75240bd5680929516102c8583ca09ceb328f3be819ac", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753354, "uuid": "da23138a-fa4a-4512-b734-37183ebf5d37", "value": "T1DFF42253A3E94032E8B627B418FA06D3263A7CE05D74873B3A51789E0D339D5B53672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753354, "uuid": "90cf34a3-67df-4e14-a114-9a8a9c261816", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753354, "uuid": "9c89fef8-7594-449f-8cec-bea8d794c7b6", "value": "12288:KMrky90ynwf02KbIv7sWATsrSwPLzhzFvLl/kj2ICPzXRgt0krJV:SyTwYbW7sWAor1NRDl/SaPzXut0krJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691753354, "uuid": "f2c77dd7-6b85-4b15-980a-9246cabd1709", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691753354, "uuid": "b0471972-02db-4d56-b759-8ac227df80b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753354, "uuid": "3dc0d7be-0ce6-4fd9-88e1-917298131ca6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a46969-389c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691795679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691795679, "uuid": "c3a92978-9931-4744-94f7-46d8923fe7ad", "comment": "Malware payload", "value": "2c4d18a89112e6c9b24f06da014519ae", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691795679, "uuid": "fc5a410a-8a6a-47d5-a0b0-c3f53c711e05", "comment": "Malware payload", "value": "02a1283427e0c240cf54b6705aaf4d02c4e92900772527e330e9e27aac7a261c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691795679, "uuid": "f0fac611-bc66-46d9-8054-f6e2de5570a6", "comment": "Malware payload", "value": "497544eedc4ded536ef39ed33b235ba69e8a8d7d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691795679, "uuid": "f6f380d7-e445-460a-a8a9-4e6421d2dba0", "comment": "Malware payload", "value": "25b780c30566db5508d479642248fd901e244430776c081628ac7839ac2178ec9ff683d4ed7d8ada6e02e13538e57370", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691795679, "uuid": "bbcf3415-93ee-462d-a41a-07954864e19e", "value": "T171F4CD043B64DC508B6C56E868DB57079B2B56ABEEEFFF0706A291701A1B86347503CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691795679, "uuid": "a8bae4fc-04e3-4583-aeb8-34af3e14e014", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691795679, "uuid": "2a57c775-2f55-42c3-ab65-bdaa10cbfb91", "value": "6144:f+Fec6+pwSlZp8YfSFA4+Bu2ykYljxmlPC8QNCwNXkJLdEO0QcKFy:WFT6+6mZpJO+8DljUMfUJeicsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691795679, "uuid": "cda19f81-9be1-4681-ab88-cd228c9c6676", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691795679, "uuid": "1efc354c-290a-482d-82be-020825f47536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691795679, "uuid": "c839d3a5-6272-4089-96a9-f506d9339e1a", "value": "YABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZgiLFGWCMMQB9AZvR98SNYKdQKVqMOHQI7SxhEUYP.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e573465-3847-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691758994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691758994, "uuid": "f627ecc8-716c-4a3e-9c4e-ed0a19cb3913", "comment": "Malware payload (GuLoader)", "value": "1ed2920ff8965dbac95d5793ccedb713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691758994, "uuid": "897481d3-bd4b-4849-bd9f-6050137343d5", "comment": "Malware payload (GuLoader)", "value": "055fa2f33ecd11726b3688a90b15e4c8a5e05ff280c434c9a86280af1e09fb18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691758994, "uuid": "6f4f973a-ae78-4a82-9ac8-7788ded8b61e", "comment": "Malware payload (GuLoader)", "value": "d4c8b543d501f6116ac6f857402b9e3fe650262d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691758994, "uuid": "f3e516ba-1034-46ca-9ff6-0f311e93acdf", "comment": "Malware payload (GuLoader)", "value": "41cd94b79d6890a3386fb2e3e6cc804e36228c0babda22fc630542d2f813aec209cfb92e48a254c05385b397f63570e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691758994, "uuid": "0ba8ee73-5089-4ec8-b12a-22485a24b7f5", "value": "T1068412664A85C11AFC125F305F725E4A07EBED1871B8554A2338767C3F7FB82980A36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691758994, "uuid": "d28779f4-b083-4c3a-a9a8-af54081b565e", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691758994, "uuid": "ccfb0765-558a-4cf5-b92f-aeae5af438ba", "value": "6144:CQA4P4MVNd1PtF2zGCvoOZtGfTpEPKJFy2Yr7/+LAxJVX+peoQRZboJGt0SkDoMK:THP4GCvootYdap3/YAx3upefRZb6Gos3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691758994, "uuid": "0f61d9d6-ab78-4b84-9b95-6177a326bef5", "value": 386264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691758994, "uuid": "9fdbf0de-8336-4231-977a-7de6da4f0a81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691758994, "uuid": "f5e254fb-312c-4e31-91f3-e2509256d364", "value": "Booking.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19afb31-37df-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691714519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691714519, "uuid": "d7b436ac-611e-40cb-a115-fdfe107391ef", "comment": "Malware payload", "value": "4e8f34a4c631073808c74481f456e357", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691714519, "uuid": "e9cf80ad-e1cd-4572-af13-22f1eec43919", "comment": "Malware payload", "value": "063419ad39803232344d8ce09ec417a9d99da6201daf92a8ba8f4c3787149784", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691714519, "uuid": "2320d86a-b239-4037-9463-95a81b3fcfac", "comment": "Malware payload", "value": "76dfea1112a558ef2f517f05c6dff9bd3302973e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691714519, "uuid": "fe5c4bee-c400-4936-a3cc-56431709d020", "comment": "Malware payload", "value": "ce71eb3f16ac142ebbb47e1db4faf57d80d530ae3dfb4844dab49e0dd553435dc66d8b1a4e8463103ef384e87352c65d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691714519, "uuid": "ead68b34-f858-45e9-922c-1dd96f495891", "value": "T196E65A07F89191E5C0AED170CA369266BA303C855F3037D73B24FAB92B72BE45A79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691714519, "uuid": "f7139d4b-4f92-43dd-a98b-81d24064c7bf", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691714519, "uuid": "fbce5c7e-713e-41ec-b54b-91a836afb5c7", "value": "98304:OPNKEDnvJIfs4MoeI0NWkEA/4X1BuTopsVey:OVJDvJI1MG0NQpX1Bs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691714519, "uuid": "64c4603b-a31f-400e-b9d1-53aa79e0ca09", "value": 14533120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691714519, "uuid": "e4cdcdda-3dc8-4018-a9ba-570a51ba30fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691714519, "uuid": "b2338e70-665c-4042-8216-f915affea984", "value": "4e8f34a4c631073808c74481f456e357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35bf177-3817-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691738601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691738601, "uuid": "8bd58901-02fe-48e3-be90-42755f2410bb", "comment": "Malware payload (SnakeKeylogger)", "value": "3e6b14d96bf7626543ec0df32c776aaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691738601, "uuid": "371cf5d7-ad04-4af3-8d7f-ba0be7b25742", "comment": "Malware payload (SnakeKeylogger)", "value": "063f0bd0b193f533e7909e0ec8a7cab36075e06c341b5bdeb1c13b2fd28a7638", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691738601, "uuid": "d7acba12-291a-42ff-9321-c23029870c38", "comment": "Malware payload (SnakeKeylogger)", "value": "6f47ceb374d04fa82762ff3622d0d897377835f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691738601, "uuid": "9205956c-76a0-43ae-9526-b863d56f0277", "comment": "Malware payload (SnakeKeylogger)", "value": "4e680584a4569ecb7448292e00c9498af97f396ad368afff5d78cb6f1bddf97c951faab5d88f3b144b3d0ac17d403d2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691738601, "uuid": "56588e19-0fcd-40c6-ab93-0b39d56dae40", "value": "T14904B503BB1B89F1C798A73AC6D701048375D6816E9FE60A79CE27E688437BF9D45207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691738601, "uuid": "b8e189e1-1091-42c9-8553-cee13e97142b", "value": "3072:nUbE1RVm4YTsdgtDcx5DBmkfDQyXZiONkb:tRw5WxzNQyXZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691738601, "uuid": "3bffaf26-028b-4234-b5a3-da99ae0d431c", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691738601, "uuid": "f43ca573-36f7-46ac-9def-681e805a2c91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691738601, "uuid": "0acb25e0-24db-4733-b1dc-d4dacfb08476", "value": "Cmemxu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc26e2c1-382e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691748387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691748387, "uuid": "8bc949b8-cfdb-4132-8d2e-4e216a650d9c", "comment": "Malware payload (GuLoader)", "value": "fae2e0a449bed4f6d2b0b0e79ca5df3c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691748387, "uuid": "c8cef996-9beb-4093-9ec0-ab17694b8158", "comment": "Malware payload (GuLoader)", "value": "066e912a337870ec99eff5c8eaffe49ff3ffe4d20838b892a76bc99d8496656a", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691748387, "uuid": "03337005-931f-4f89-a52a-a774e49eb68a", "comment": "Malware payload (GuLoader)", "value": "62ecc2313b5774fc1621cc8fbe830bbb96a975df", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691748387, "uuid": "b60d743c-3e63-4866-804c-ded05c787e92", "comment": "Malware payload (GuLoader)", "value": "dd6f6c64baee058ec41c5da262cd14fcf95a7c4b608abae8e77d91b54ee1cc098c5496c99275a10889ac4ebc95b1fc2d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691748387, "uuid": "befecd40-b75b-4fc5-9e11-28a3eec958b0", "value": "T1E0773322F98FC632F66D5136A978EB6A117A7EE2073184D7A3D43DDA4D708C15272F02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691748387, "uuid": "d2d99f95-a721-4627-9b8b-01019bb49def", "value": "786432:stMdPByhq/XkArjeb5MeJw1wxumuQuc6OOZB2pR6+97:stMd5T/XAtMeJmcvwH2pRl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691748387, "uuid": "e651e00b-0bec-4abf-8eef-fa9920e87a5e", "value": 34663424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691748387, "uuid": "8db2b2f4-beed-4a9a-864b-74e96b825f80", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691748387, "uuid": "a70826fe-a6bd-4793-8365-d548a2cefcb1", "value": "Driver.Booster.10.6.0.141.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b81d48f-3824-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691743795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743795, "uuid": "a7ac8ef9-9c2e-45d0-953a-d06d62908553", "comment": "Malware payload (Mirai)", "value": "7f871a144b8a3f7203fec0c8ec6ddf5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743795, "uuid": "6f07fc72-a8d4-4527-8dac-aabe0cbb4773", "comment": "Malware payload (Mirai)", "value": "06ad76f4b19be8706f98441d926142af824bd2983217f6c2c02201dbb07d0224", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743795, "uuid": "3a58af54-bae9-4e0f-bdab-f28250771621", "comment": "Malware payload (Mirai)", "value": "0fc66b23b25dae223542d9f5c5d5191eeee522ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743795, "uuid": "4cccaf24-814a-4f8e-8760-619a64e440d7", "comment": "Malware payload (Mirai)", "value": "59a472bf47eae9ee17dd962233c7fe8623753a1f930ace385ea64a9b1fe890f99eb6a64cdc0ba8bcc4c0b44acb9d0870", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743795, "uuid": "05b21263-aa20-4ccd-9a89-e2523cbfabe8", "value": "T164A30897F900EFB7F40AE67604D34B24B670BBE54F531622721739A6AE722D42823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743795, "uuid": "10652c1f-d860-40c7-b291-b6cf7fd46332", "value": "3072:HNKLGdUvuXwyKQlU8fzERmumuxVqDr78fz1e:HNKLGdUfyKl8IRmumuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691743795, "uuid": "02a0c41d-89e2-4def-afaf-c0919cb584c4", "value": 98923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691743795, "uuid": "e416d6dd-0fc5-4a60-b59e-da19d3d3a12d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743795, "uuid": "54017c96-4804-454a-a2db-ee244e7054c4", "value": "7f871a144b8a3f7203fec0c8ec6ddf5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021482fe-3896-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691792742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792742, "uuid": "8f36fb3a-a5df-4de8-b4f1-f9a65feb13c1", "comment": "Malware payload", "value": "f8aed12fabd0676313b7a109112a971a", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792742, "uuid": "1b81606f-042c-46c1-b63f-70b79cc9028d", "comment": "Malware payload", "value": "08659201c5f074e1c5fb79257ff25b14ad19b304e2cb267b63bdf73a183b220c", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792742, "uuid": "ecdfbc60-6b08-474d-8467-f8932004669b", "comment": "Malware payload", "value": "925ef7a0c74ff47c590010aab8cdaac6a64f50ba", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792742, "uuid": "63cf33ac-2649-4c02-bdcb-4b0c8e961ba8", "comment": "Malware payload", "value": "e59c931dd7294e16e31991f58f2353fb6b1321e6a11f1f302f6740718093c4efd4ce2906511410988d4e60e5829d7844", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691792742, "uuid": "5aea2ea2-1460-409c-8ccb-4c5d82f9380b", "value": "T1CA45DA38397A7C2443DBDA1334F14B961CE9564FD1703A3B199AD8239A346C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691792742, "uuid": "17631072-f401-48c5-bd59-bd4275813348", "value": "6144:0lGYpeZ0HT1OgkFdcy8B7uzyDts1S+jgVc:0lX1cB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691792742, "uuid": "51614b08-029c-4ebe-8805-8010b0464afb", "value": 1254604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691792742, "uuid": "bc55a675-0cc2-4298-970a-8363bb2fb8f7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691792742, "uuid": "ffebe007-ca00-4b87-a35b-a63186b6a254", "value": "xcvcxvxcvv.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168b9425-3824-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691743814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743814, "uuid": "a689e26d-3827-452e-b594-a7480d55526a", "comment": "Malware payload (Mirai)", "value": "384b1397e3d12da3aaee908d2f97e856", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743814, "uuid": "01ddcb31-506a-4591-9b6f-7cf7aaef9b10", "comment": "Malware payload (Mirai)", "value": "08d221d2d98a81d85e8bf0e8f3c8c4ddb35cc32c268a2cfe2cb2837e7f8fc731", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743814, "uuid": "cd39f330-4d61-45f2-8123-795a25aa6cb7", "comment": "Malware payload (Mirai)", "value": "8cef5ac6a2bb3e25e8b9a8bfddbcf6d9e1769005", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743814, "uuid": "4b5abbb5-122d-4776-8776-a48db23e1be0", "comment": "Malware payload (Mirai)", "value": "de04ce892ca7774b62384ee97302b1c4acf6b2b396075fab171709da0b1d5e1771d53a626b1f138194066d556c90c2e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743814, "uuid": "19e52fdc-7ac4-4921-8595-88c24f776c8a", "value": "T140833B01E643C6B3CC8307B2029BAE661931BDAA5E2ADF49F31D7DF49B128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743814, "uuid": "c47c84f9-8ff8-49ea-9d77-4c223971e334", "value": "1536:qr5b1ZU4d3J6lreu5r4hWj8L8GDloRmF+wVOz+sXcfW7k:wb1ZU4ZJ6liuq0Y4GoRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691743814, "uuid": "47549d5f-1132-4565-ad37-d3d90b56d465", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691743814, "uuid": "bb5e94a7-883a-43d0-8b8a-45e2dab6fa54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743814, "uuid": "7bc4cdbe-b959-4c22-ab63-3e77d23798e0", "value": "384b1397e3d12da3aaee908d2f97e856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdeffc80-380a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691733035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733035, "uuid": "f7490ca7-08f9-4a43-a47f-f158f02080d1", "comment": "Malware payload (DarkCloud)", "value": "e1e7c7ba1f910a2dc130321ff74040f9", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733035, "uuid": "09a460ff-2587-492a-b5f2-c2cb007eeccb", "comment": "Malware payload (DarkCloud)", "value": "09369024c94191a83d2cfa5bcac018aef525f46cff33c001dcfcd6bb78e1b520", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733035, "uuid": "c01bd5f6-98eb-4b15-81a8-0ac3d0bd6a2c", "comment": "Malware payload (DarkCloud)", "value": "9acc9aee9580485441f6f1fcbcfab8418127e097", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733035, "uuid": "7936e96a-94a2-4599-8b9c-e0abfcfddd8b", "comment": "Malware payload (DarkCloud)", "value": "be8f061fabe1f40fa246898c4ff9113ee4e88d6ff41c8a24992637c72bc972cd1d4553e7fb65fa16a63d1c760731273b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733035, "uuid": "0b9aef02-c5e9-425c-a18d-1e2e153f6aa9", "value": "T149252922E77B645AEF19A5E84E2F847238DADDC0F1B1C588A7E72C0385C23514D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733035, "uuid": "229f983b-1eea-4a0a-9dd4-db5905f422d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733035, "uuid": "0200b65c-0ecd-4764-8c57-dd469fb60164", "value": "24576:7pRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOYUFqUM7w3SYTeV+zsMdh7:7pRs6CE3jLbO9Rs6CE3jLbOYdU/SYbz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691733035, "uuid": "c7bd669e-a60e-45ef-9bbd-e9f925d0fcc9", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691733035, "uuid": "ab9c0e9b-c8fa-4233-b2b7-b7142092d5a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733035, "uuid": "3aff362f-6c55-4e80-9903-ef647d4b6062", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8fb1a9-388e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691789431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691789431, "uuid": "f7eb9eac-3e20-4347-a1da-67edd1cda361", "comment": "Malware payload", "value": "a69c6a9e48934df83669547a212a7f8a", "object_relation": "md5", "Tag": [ { "name": "27-124-3-171", "colour": "#F6EFC9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691789431, "uuid": "e595d910-ee84-43e2-8f85-bd6b7007fdfb", "comment": "Malware payload", "value": "0a4994578fd5c7ca13772e58751735c8d8a1b13faabfec75128c4d7454ba5c3c", "object_relation": "sha256", "Tag": [ { "name": "27-124-3-171", "colour": "#F6EFC9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691789431, "uuid": "2c68dceb-adca-4f23-8016-54d88d4c6f1c", "comment": "Malware payload", "value": "897db85ea4f2542d36426b13a160ca3a87d5212a", "object_relation": "sha1", "Tag": [ { "name": "27-124-3-171", "colour": "#F6EFC9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691789431, "uuid": "8611dae6-80d4-44cd-a96f-3c7d2837281a", "comment": "Malware payload", "value": "1e49c97cb5a4ca6107a8b76fe392e797a165dac664ef491964361e1a12b3f3e38d5bf0b63153932d010789bbc96567c6", "object_relation": "sha3-384", "Tag": [ { "name": "27-124-3-171", "colour": "#F6EFC9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691789431, "uuid": "5b88773a-b3e7-47fd-baee-81c9ae4f6287", "value": "T1C076DF13FF5167B6D9B292B712A243249C035C6A436793DBBD4436BC1FB72C09789AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691789431, "uuid": "1847228a-835d-4396-8b5c-bf19b40d50b0", "value": "24576:J59UjIxxbfy7/gIon3tQDGvmIo2uBmHM9sRrxxOa6:T9iIx9EHon93vmIodWV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691789431, "uuid": "91d41f6c-f35f-4298-a4dd-821a8f6604f2", "value": 7597027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691789431, "uuid": "817d6db7-fee6-4bcf-8409-253d7f819550", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691789431, "uuid": "45b8ec04-f2f0-4be2-bc59-e7aded069089", "value": "aliexpress.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff77f94d-3831-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691749788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749788, "uuid": "7627b68d-5b07-4b92-87ce-b6b62c4f8fea", "comment": "Malware payload (AgentTesla)", "value": "92bd114b65744f215566a42ca6b56e41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749788, "uuid": "1b931062-7ca7-4773-8b8e-e12a62098b8c", "comment": "Malware payload (AgentTesla)", "value": "0c4a8a1fd422f98ba907bd0ac73d937dda7bbfe8d9553dedc71f55c1bf0a9572", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749788, "uuid": "d2d7e1b4-15d5-46f4-8945-e2b960e6df2b", "comment": "Malware payload (AgentTesla)", "value": "db009c9d978cea618177f10bbf4e91942f310f91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749788, "uuid": "84c5e442-e159-455d-873d-d26874565ddf", "comment": "Malware payload (AgentTesla)", "value": "02951f8d509d50fea66305fd08bd1a5501995ee3a7ddd4787f8e5be8bdf1af0732d518b41345fb8cce949ab9f5d75208", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749788, "uuid": "c768938a-15de-481c-9bb2-842e5368dc9b", "value": "T194150725E77B645AEF29A1F85E2F807239D6DDC0F1B1C488A7E7280385C23514E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749788, "uuid": "122d21d4-f13e-426c-8529-bee9597d0886", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749788, "uuid": "1849dc49-fa74-4c90-83e6-9dc34d45503f", "value": "24576:GknRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOjUF8Gz9lvXXMQERz:GMRs6CE3jLbO9Rs6CE3jLbOjBETM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691749788, "uuid": "4e396b1c-017e-44a8-9440-cab356ab735e", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691749788, "uuid": "e83b166c-c424-4b83-b753-cbca2c8e0479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749788, "uuid": "fbdb3f57-35da-4235-8a40-8ba368cf1bc0", "value": "SecuriteInfo.com.Win32.PWSX-gen.943.4351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e10ef4f-3881-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691783743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691783743, "uuid": "117177a9-19b7-487e-bcc2-b522afbbf451", "comment": "Malware payload (Amadey)", "value": "0d71d30d21aa8646007e3541526e4bb9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691783743, "uuid": "0ecf6681-85fb-4d83-bfab-b91a7489eb14", "comment": "Malware payload (Amadey)", "value": "0d62281efaf71c5772f0ffd9339b44b2b39669cc00f07af5d1edaaed3bc374c8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691783743, "uuid": "2a9bd668-26f6-4960-b77e-d89babcacf92", "comment": "Malware payload (Amadey)", "value": "88dd58cdf4ab6e19733c649733ad9486e3e99806", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691783743, "uuid": "b8e75f44-7b97-417c-a1f0-13a8d667af68", "comment": "Malware payload (Amadey)", "value": "c58a3a405e5b97dbd81abac893b242315d34a8d00a86b9e431f9f163a22b7eb602f8b0e4ac2ef3c43033f39ae1341911", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691783743, "uuid": "0a0527a6-4f27-48da-9543-8cdf4960fadd", "value": "T12813F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691783743, "uuid": "7e562562-936e-412b-932c-8b012ab2434f", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691783743, "uuid": "b3f6c4dc-e435-4f3a-9402-620ef8482515", "value": 43363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691783743, "uuid": "13d004d7-1179-4ad2-8d4c-8abbc7d206fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691783743, "uuid": "9e69c11d-4946-44b5-8d20-4632a35e7b45", "value": "0d71d30d21aa8646007e3541526e4bb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a9b402-3809-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1691732192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691732192, "uuid": "914f165d-44e0-4a36-a94f-e21843506be0", "comment": "Malware payload (CoinMiner)", "value": "902b8b84ab8e77279f06d1fa4bb769a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691732192, "uuid": "d13a2c74-abdb-42a1-b757-11718cd27dfb", "comment": "Malware payload (CoinMiner)", "value": "0f0edb7f25b876773ac2318600e0a493edcb6ea3a0235a9b0a3141ff6247c4f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691732192, "uuid": "21dd704e-affc-4d10-8bdc-dae70e885c90", "comment": "Malware payload (CoinMiner)", "value": "c83a9e70b4649f3173b4df918a48e20a98b9cf3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691732192, "uuid": "31554e36-1e89-4c90-8216-d57b00ccc089", "comment": "Malware payload (CoinMiner)", "value": "c1ab1b9de425b15c26785a7881e76ec73bcdbdd7b63f497eddd54a2bba9f53c0fc0529b315b213fe4381eb808fea9c24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691732192, "uuid": "11c262d9-bc48-4c1f-8ba5-fa1ab0349ba7", "value": "T1B8A4C1C37EA1B860F512DE325D3ED2F6263DFD618E59675A2218FA2F04711E1D263B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691732192, "uuid": "6ac897d5-7c57-4865-9e5d-3e295f75c11c", "value": "652c7ff7afcc08a2e9c5186e380250b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691732192, "uuid": "d2acda30-e418-4dfc-9897-0a25c7ad1374", "value": "6144:oy2kubyQXGDbrqBJEvG72Um+VpCYGA4KCVkdpIQaf7PKh4KoC/JolOr0QU:pBYyQXGXrM72mpmvKCVWpXaWBJoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691732192, "uuid": "8f70a7d0-aa42-4945-8adc-ff03a54fc40f", "value": 459264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691732192, "uuid": "fe653b4a-6bbc-4901-9a4e-c5e1fea5e046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691732192, "uuid": "b3c4b1ae-753c-4997-b099-60aefc2f4418", "value": "902b8b84ab8e77279f06d1fa4bb769a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba9855f-3870-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691776840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691776840, "uuid": "83a286e2-d009-4fc3-9901-be70db22d05f", "comment": "Malware payload (RedLineStealer)", "value": "0d0d8b9098f6d545f7d6fc5f332bc17e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691776840, "uuid": "f0181d5e-dd27-4449-91c4-ff43c12ddda3", "comment": "Malware payload (RedLineStealer)", "value": "0f273602302ff487db5d0604e9c5f4f98025a06cb1ab04557a34dd1345646d6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691776840, "uuid": "b630de74-8d66-4fc2-976a-24a2ed6899c5", "comment": "Malware payload (RedLineStealer)", "value": "ac404502e1ab3b3cec83095592d277918485cc38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691776840, "uuid": "4ead96b1-ac9c-4b8d-a6d0-aeec3e271c9a", "comment": "Malware payload (RedLineStealer)", "value": "cf239777168eb95646279d0a8677daf112dcc882edbcb1012ece5763a2726a437bc13477bd9b7723d476a66bf9bc043d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691776840, "uuid": "4f58eb7f-ea37-4de0-8908-8edd4a3c94ed", "value": "T18213F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691776840, "uuid": "a9f80f09-9a54-4dd7-ae7b-f70f7d580ef8", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691776840, "uuid": "d53069c7-6f95-4bf2-8cc4-7e99057fcc70", "value": 43268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691776840, "uuid": "85283eb8-19d4-4a6a-93c6-970d990287c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691776840, "uuid": "afb1cd3a-e720-4006-8400-321ec12dc651", "value": "0d0d8b9098f6d545f7d6fc5f332bc17e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6adc217b-3843-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691757270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757270, "uuid": "d54bc699-0c45-41a1-aa66-0912755b545b", "comment": "Malware payload", "value": "4fe9e50388a75a34a6f4175dd3722c93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757270, "uuid": "88eca0ec-87c4-4027-b245-d975ce0c310e", "comment": "Malware payload", "value": "10317a3c3b5eff008800f4fa4f943ef3cbabbf4dfbf06f015f1039df60a7a82b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757270, "uuid": "4c2fd197-e331-4621-adf4-c88af179ff1a", "comment": "Malware payload", "value": "f9cb6826b38b84619e0d52987a13c4ad7f7ab39d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757270, "uuid": "43ce975a-6a7c-40bd-9862-cfdbb308e405", "comment": "Malware payload", "value": "aa168ffcd219e4a8ea4339360678159b2db06f7761021ca86cc7c8c4c73947b867af1426866ea2ef56b4b48193b95ca3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757270, "uuid": "bf0ebe6a-378f-4ce9-8a21-f9265cb5216e", "value": "T15FD4AD096655E1BFF6F08839473B82C0D94F8C94127AB78822C71A1E71D3966679FB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757270, "uuid": "4dc81417-b3b2-4d76-aef1-71424238335f", "value": "7577c33a86c21dd2d165adab73f0c4b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757270, "uuid": "06e458b5-9e1d-4a5e-9251-1730f63fe060", "value": "6144:hW65I2+UYMdUdM/h0mCZX9Gjh6QirySC2GDpE/JNmgoL3VwmLckcx6SUZbAEpZLc:fJ+2dRhCYgUrVwTklSURAIdZl2zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691757270, "uuid": "db2c6c55-5974-416c-aee2-862c095f1b41", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691757270, "uuid": "5f588c90-da55-4c65-a16e-6a52d6dc09dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757270, "uuid": "d4a1eb8c-42e1-47aa-8cc0-6d746bf49229", "value": "SecuriteInfo.com.Win32.PWSX-gen.22314.7518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ba860b-3860-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691769638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691769638, "uuid": "931a26aa-c0c9-4188-9090-a7e647fc5376", "comment": "Malware payload (Amadey)", "value": "b0492386bdaa3352fe770268a0578212", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691769638, "uuid": "e6a3c0ab-8103-4e74-80d2-2509c7f60a33", "comment": "Malware payload (Amadey)", "value": "10b7026a636878b773169f668c5b4f54f52e52799ce275ca17b5612a0764ea11", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691769638, "uuid": "92bb1528-cfbc-4183-a836-2ed213d0f1ab", "comment": "Malware payload (Amadey)", "value": "06731a2baa6d1dc0086d3f34b451229acb0117ff", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691769638, "uuid": "d4aaf7ef-a36c-4513-9b0c-ccbf727aff96", "comment": "Malware payload (Amadey)", "value": "d89d116682cfe6a5f489df9e9a13546258c3fbcdf23ecfbfe1e875a7ff50c12fe503be3d251d09ccb3fd38fa00290915", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691769638, "uuid": "a4c3ba4d-79a2-4207-8fd7-87f616d386e5", "value": "T116643A507916C032D960A5721BB5BFF2C59D6C15ABB04AEF6BC00E76DA212E37930F39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691769638, "uuid": "8b2b65f2-a213-4961-b3c4-03c08acb4e14", "value": "b5701a03716cd526591d6ce95c5326c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691769638, "uuid": "cc6d522b-0423-4398-86bd-9ab9b99c3443", "value": "6144:V8j0Bco5S1avwZB89siXXwlnnN1Rm/HoVwu00SALNVuubFDmFPhLAOWeK7Xc:ej0Wo4FiFXwlnN1R2ANVuubFKFPhL83s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691769638, "uuid": "a7466c0e-60b0-4996-8a14-93057eda9b00", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691769638, "uuid": "83fd9954-59bc-436c-91ae-8e3711d0444b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691769638, "uuid": "20470a41-a52f-4248-9161-fd66d3da395f", "value": "b0492386bdaa3352fe770268a0578212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7e9b1f-384a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691760120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760120, "uuid": "cb243037-30f6-485e-91b5-6c0206fa0f4f", "comment": "Malware payload (AgentTesla)", "value": "bdfd8d4d4f6e515036bc48adefdda098", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760120, "uuid": "454ef901-11ce-464c-b7ba-35ada4368041", "comment": "Malware payload (AgentTesla)", "value": "18d3011645c5f9432db3d23aca3ebfadb856684b28e1cadf2d11cb7e668ed67a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760120, "uuid": "fb98aef2-834a-477e-a8b0-5ec75fe155ef", "comment": "Malware payload (AgentTesla)", "value": "9ccd7076436e291905e48a297f1537ad672d2718", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760120, "uuid": "3a3f9d28-a543-4982-930a-24090bee95fe", "comment": "Malware payload (AgentTesla)", "value": "ca330ba11c0cde183bc2c12575ebc00a2a5e9a86d2c2ce482ee95f6d7a623436c5a792951a5945135501189002c74ef0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760120, "uuid": "300411a4-1a8f-464e-987d-df399fe56c20", "value": "T14704E783B64789B1C24A17B7F9DB23040B79D681B693D70A798E12E64943FF69D08F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760120, "uuid": "a78f3f49-6a56-4ee0-918b-7aae5eb43f5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760120, "uuid": "fba61adc-a39e-436c-a45b-085868c17de1", "value": "3072:6+iIr3j1KrqXbrMFp6xcXY0NekB16/QOhBKDnKXkB4cqFeHE3vmqzG:IIr3NSptI9kuPhBKDnKXkB4c4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691760120, "uuid": "4da6c9ad-f3d9-4490-a655-b924fcf8c788", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691760120, "uuid": "27815640-680f-4f28-ac74-42c88a98cbe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760120, "uuid": "debc2b51-0e30-464a-a09d-6acafe798354", "value": "Zokzni.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8019a5-37f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1691723236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723236, "uuid": "9c9572c8-a462-4db0-9193-42b0d3f137e3", "comment": "Malware payload (Stop)", "value": "1ecf5103b5a099824748cde9055cb4d9", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723236, "uuid": "84a6fa4a-6225-4398-be2a-94a573c3883f", "comment": "Malware payload (Stop)", "value": "19419b437c400939e496ad97da0e268735aa3513d77dc378662efe36324bdea9", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723236, "uuid": "e89272cc-e9d6-40aa-9fe2-20438005508c", "comment": "Malware payload (Stop)", "value": "f2a61b5a2bcd3be7a8c5db12b864a67b481d34c5", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723236, "uuid": "4e085857-e0cd-4d90-8b40-76db3a64737e", "comment": "Malware payload (Stop)", "value": "2f8c60ee88906a4871f29d858126785ca9df75b07733c05917491531021d3ad8e46a14a3359f81a336d9e609b155178a", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723236, "uuid": "af62a8d9-783f-4ee6-ac4c-b32e8a134726", "value": "T1F245AE02BB819171E5D341BA0DFE977E883AA9A0933A95C3D7E91C568E306D0673F3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723236, "uuid": "891ffd7c-a7d0-40c1-baec-3dec8e604f48", "value": "24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/VRPOO8eWvHUq7:F0dwAYZt6C31WeTdRPOheAUq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691723236, "uuid": "33995cef-38cd-470c-90c9-ae37ca8802ef", "value": 1273856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691723236, "uuid": "ee5a3884-9ed4-4e79-ba87-5086dbd05394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723236, "uuid": "290d7e57-0c23-4969-b6af-f9d368ef3d8c", "value": "2023-08-10_1ecf5103b5a099824748cde9055cb4d9_stop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75dadfe6-387b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691781340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691781340, "uuid": "c7d7f213-ffb1-4d7d-821a-5a207031a262", "comment": "Malware payload (RedLineStealer)", "value": "1cd4cdec4cc99d888220c0b39345254c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691781340, "uuid": "45b2924c-c114-4fd2-b5bf-b7cc845dc2e6", "comment": "Malware payload (RedLineStealer)", "value": "1c98592fa9eab96ea44e4c0ce32d41041e74c2e5273eef04a5114e37a45dae27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691781340, "uuid": "dfb1fdc1-3f60-412d-8d37-21ad260c45fc", "comment": "Malware payload (RedLineStealer)", "value": "59efacca64556b869355f1f3c4d8103b67188e6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691781340, "uuid": "d1768f4a-cec2-45e9-b98d-623dde4177cd", "comment": "Malware payload (RedLineStealer)", "value": "f61dd42d02a38b6d862168fd67c5de0321725477134accddfa927bd302dbdba4e69099297b7d04bc40b3a72a94b43637", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691781340, "uuid": "d99d97fb-a6eb-4dd8-a5b0-73e9d15d2820", "value": "T17413F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691781340, "uuid": "fcbd8a94-0266-4e3c-a60d-9cb502508621", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691781340, "uuid": "ee3d9d03-96d6-41f1-988a-4be4149d77ec", "value": 43211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691781340, "uuid": "20323a37-50b5-4d86-8ece-fdb4667e8ea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691781340, "uuid": "1f893c53-7a21-46e3-bf69-4ce0a95cca6f", "value": "1cd4cdec4cc99d888220c0b39345254c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d48e0f-3834-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691750956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750956, "uuid": "9bd24310-8884-4b12-b0a4-e9a55b0826f0", "comment": "Malware payload (AgentTesla)", "value": "05cb351d3aa3b45e63d8ac7cf9fe616c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750956, "uuid": "84c2c7b5-0184-4d47-a0b4-7533cc6e7c76", "comment": "Malware payload (AgentTesla)", "value": "1f53df7e897b9ccb0b8414d28bbcaf26b4365cab7ef746074d8a5a0b0ae11c40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750956, "uuid": "dc6b67f0-1006-4010-b044-8522b4727237", "comment": "Malware payload (AgentTesla)", "value": "8dbfc4a7cf4f81b0b33e2ab7785f4de2af0570e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750956, "uuid": "6c55e733-95af-4d69-b166-2ad36fe3e4c7", "comment": "Malware payload (AgentTesla)", "value": "7b5d6d3c6ea7fa6442567df03df1817ff70cf55ad37919c089ba3226ad485d55ab54745f676420625cafb954bd240e31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750956, "uuid": "219ba236-724f-4a76-8f77-389187bf1ddd", "value": "T11165CF60AD7DBA42F55F0A74008FD70D86738886353AC73A676F5186C7C32C516CBBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750956, "uuid": "5506355f-73ae-4566-b7e8-ab4e5cd9b128", "value": "24576:m1m0Qo3HWAOiDbNrBWWhDld+XF5eTjGR:mtLW6vBj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691750956, "uuid": "93347e97-26a6-4829-b8ba-054565993f36", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691750956, "uuid": "35a159e0-d2bb-492e-87bf-6f539b5bea72", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750956, "uuid": "82056f4a-e5d5-432e-8c8a-26fff889e567", "value": "230811_Ricevuta di pagamento - Banca Intesa Sanpaolo.pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a02361-3857-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691766089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691766089, "uuid": "2cb73854-6562-4d0f-b835-d6713353a922", "comment": "Malware payload (AgentTesla)", "value": "fa9e0069bc5d82f5b3cfbecff77953b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691766089, "uuid": "69776d1d-91cd-4b28-94d4-e8fabed66fee", "comment": "Malware payload (AgentTesla)", "value": "1fa93962324b633a83aaf3d42db0d03fdfadcd274f37108ac0fd78a4f9ead3e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691766089, "uuid": "031a3dd5-d180-440a-bee0-5897fbdcb89c", "comment": "Malware payload (AgentTesla)", "value": "d3101b998900517173aa1d992a6c6cb014f01750", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691766089, "uuid": "233fc73c-6621-4488-819c-e7da9b46b283", "comment": "Malware payload (AgentTesla)", "value": "016630ba4bd68c728e758f618f1ce5ce5773558e6a6b7e2f069d1cf63a74e6776cf67029a9c9dac2f4a9fe5077f9a579", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691766089, "uuid": "748d87cd-c051-4cb6-9da2-2dbf4be443de", "value": "T113D422B2436443F8D579A3B47542C30107329947E3E1E69ADECA94EF3EA6F040751BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691766089, "uuid": "0599dd4b-a6d5-49b2-b2b7-b62689012cd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691766089, "uuid": "d9fffc26-61c0-4619-adc3-54178b205c30", "value": "12288:Ri2iN8JJuSHmISwlMLbdys9M/m2H6xRJLRYKl4urpAbogP6:Ri1uJEDIDM8s9M/m2HePFl4urhgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691766089, "uuid": "44b29965-11a5-4635-8d7d-50fe3a451b5e", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691766089, "uuid": "ba566487-d77a-423d-bc43-69e00e2a8f08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691766089, "uuid": "ac6e632b-b3f5-4564-bcfc-ae62f2ce9419", "value": "1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9244cb0-3893-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691791841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791841, "uuid": "88bccd01-f0c2-4bed-a80b-11c4433997fc", "comment": "Malware payload (Amadey)", "value": "49247eff159a7fa16b712945acc51435", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791841, "uuid": "e28ca602-706b-4de1-97fd-0a70628433a8", "comment": "Malware payload (Amadey)", "value": "1fba98b98271a2382191aa4e48d7a668acbcf165176322916453d87101fa0c3a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791841, "uuid": "b44d12a9-f975-41ba-a0dc-364f56f34226", "comment": "Malware payload (Amadey)", "value": "895baf3687683f9abccfff9f22e99a36c4e7f007", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791841, "uuid": "b825a562-4fd8-4088-b120-b99667df829a", "comment": "Malware payload (Amadey)", "value": "dfc729b2867c290644172d0b12f18dbd7c80670ecf2824056760ecfaad4f79f0cd17d029644a70ed4fe7c69c8c536c16", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791841, "uuid": "6d2623df-2a47-4866-95d7-a761d1665ba8", "value": "T171F42213B6C94873DDB467742CF703830B36B8A5996D839B274A984A0D736D8B93533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791841, "uuid": "c1031137-aa51-49c6-81e9-03e05d99697c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791841, "uuid": "2589e662-f634-4fa2-b47e-4b5fd6d92be5", "value": "12288:aMr2y90mjBl7R5vDriWCF//c07BLxKaxe7o55KRprXop78tt06astjBfmJ:4yNr74BdLxVo7oXKjrQ8t9wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691791841, "uuid": "c56337d4-90f9-4472-9796-bd2e311fe5cb", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691791841, "uuid": "7342e6d4-db24-40a5-99e0-9fed2ab0fc99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791841, "uuid": "82806d26-734f-4ab7-bc9c-d6a2aa01de67", "value": "49247eff159a7fa16b712945acc51435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b89480e-3844-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691757593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757593, "uuid": "29c9961a-dd6e-4a83-b824-a4a94fde7435", "comment": "Malware payload (RedLineStealer)", "value": "a5bf5012d24b637537e3d88da1f63807", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757593, "uuid": "562b74a7-3f4e-44d4-ba8e-f6c8c9edb96c", "comment": "Malware payload (RedLineStealer)", "value": "20186f72de2f0571d762d6d253dc9d3193ceb8cd93a806c16383de02d08317e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757593, "uuid": "62c729bb-ab3a-4a94-bf2b-ff24d2cb7d8c", "comment": "Malware payload (RedLineStealer)", "value": "094d432a56f7cbec98516b90578415d1f0b138a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757593, "uuid": "abf131ed-24c1-4559-8661-651432e977df", "comment": "Malware payload (RedLineStealer)", "value": "cc7f1eb7408cba94608cf0abb70534f908f84ea0ae9fd525aa27f761a609dd59742e33d7baa0dd61951279a1fdda8de4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757593, "uuid": "c442af86-cef7-4576-bde5-d8dc80b35827", "value": "T1D5F41246AAD58072D9B23B7029F613C70B357CB24D78D39F33A5588A9C32784E676327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757593, "uuid": "e8be9158-8371-4515-be22-b2fb811795b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757593, "uuid": "bf9161b0-3d67-4fe7-97dc-7625ae21cc57", "value": "12288:GMr2y90fA9xLprOr4P2KGDal9HSOtci1rTazuW1PZ9YKFpSBYbVOS7l/6eqUt:MyjFB4GlZceXazZPZ9DFwBu57l/rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691757593, "uuid": "3cc1f572-de4e-4029-af3c-822aa5e2da38", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691757593, "uuid": "8eb01107-5419-45ad-a5e4-bc76e9146ab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757593, "uuid": "f31ed8c2-cb50-44e1-830e-f0a608360ac8", "value": "a5bf5012d24b637537e3d88da1f63807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa486f84-3823-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691743766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743766, "uuid": "c62f6be4-ae1f-48db-ae74-727ffa69dc0d", "comment": "Malware payload (Mirai)", "value": "e4dae1c244298c92d57aff0e9aa9c6a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743766, "uuid": "90280d84-bc29-47d0-9100-dcceb60e8a03", "comment": "Malware payload (Mirai)", "value": "20770419f79550e46c9bdc2dab792cc96792b7ec4dbd8fcc0cedd7c726ae7987", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743766, "uuid": "6ed523d6-ca30-40c9-b076-ab81519410a1", "comment": "Malware payload (Mirai)", "value": "0bd8a6d67c1886e3c2747cc47ee8c96f3d41ae62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743766, "uuid": "4f681ed3-bbac-4f13-a321-151dc17cf406", "comment": "Malware payload (Mirai)", "value": "4562d283acc8e07091e9530e07ccd47591fa52e613e8c268fd5efda27ac58e6519e3e78359ff97af1a55a560fd6c1f2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743766, "uuid": "87e03532-49b1-429b-9418-0fb0f0bb3d74", "value": "T1D6C3842E7E12BBBEE668863107F35F70879521D237A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743766, "uuid": "bd159d16-534d-47eb-8b1a-2cbb25ba922b", "value": "1536:g7je1TYGq+f+A02rKXzeve1eTe8p2rKXIeum9Y0GAzQj1l72HBe2ERLWfRZrmW+i:/a1UW0MZQHIB6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691743766, "uuid": "2f5340e4-26bd-4995-a643-9a8cd7506112", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691743766, "uuid": "b36e40b3-55ab-4e1f-a360-3aa2b807c7a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743766, "uuid": "4f4d9b13-bce3-42b1-91e1-aeda1e35ab35", "value": "e4dae1c244298c92d57aff0e9aa9c6a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a27269f-3824-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691743820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743820, "uuid": "b7a4218d-587b-4662-ac82-5ae4dd741d2a", "comment": "Malware payload (Mirai)", "value": "45bdc4ccfc26bad76bef7479542fe83a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743820, "uuid": "88096cf9-f7d1-42aa-91c9-fb9b1a979015", "comment": "Malware payload (Mirai)", "value": "21ecc53c3fe5336dd717b50fa70e281c5612b0c770f68d9f38c93e13e8357e21", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743820, "uuid": "7f7ec696-1706-45dc-83d6-f5b775e77003", "comment": "Malware payload (Mirai)", "value": "eb20f65439fa88e3d01a1d045fade1e4d5dc54f7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743820, "uuid": "e88bc581-a528-4993-80c1-15804b9526b3", "comment": "Malware payload (Mirai)", "value": "7ae3875a86c586b447140ed999eb9b5c641038a079e4821ddca75ed74367213b7c1b4298cfd27c5b321d51bfbf80a56b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743820, "uuid": "7deed97b-f4e9-43c2-9980-6d2475264f62", "value": "T12E935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743820, "uuid": "3013f0f4-6ba6-4469-9b83-5fb1c33cd413", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3byPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKrifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691743820, "uuid": "30635ce3-9510-4d56-9408-2d24ab75cf39", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691743820, "uuid": "f46f495e-85ba-4793-837a-2c8fad9d7f8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743820, "uuid": "c63fc4db-3d17-45dc-baec-b66425107729", "value": "45bdc4ccfc26bad76bef7479542fe83a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006e1c7f-3896-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691792739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792739, "uuid": "5b3e4c5b-a722-4b77-82d7-9d2b4a8df726", "comment": "Malware payload", "value": "ef6692a21aa0f9cb69fa88ba74f3f3c3", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792739, "uuid": "df9801f4-3ea1-4c08-a493-44adab1a94d2", "comment": "Malware payload", "value": "22c6f14443d13f303d30cec8d55572ec99999f8cd01c97a96e0a53cd1d2ae0fa", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792739, "uuid": "56a3affe-d68c-46d7-b1b4-77cc5c01f4dd", "comment": "Malware payload", "value": "426a29984000e8211019b13a98098e4ec699f55a", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792739, "uuid": "ca3147f5-7e53-4104-a9ef-ab3cd3cee1a6", "comment": "Malware payload", "value": "6e45f2684e901658b03a9d609d2dfaecaf820843e271a0437d44c35e41310dddcbd6e1ae0f0961553f94d121774430dd", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691792739, "uuid": "67d24d28-dad0-411b-88db-87c438e449dd", "value": "T13E31AF3226B5030CD2B19A3718B1BA13973AB90DE50B8B8A32515A782C585DCB920F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691792739, "uuid": "22491613-a934-4128-a394-960973e3f203", "value": "24:8NYZsxEeG0RN7oK9aghW82A+WUV+/CWYyPdvx34l7pEQeyTppTpZab/2XT:8y68jeeg1Z3o7iQ9ab2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691792739, "uuid": "e756afb0-8668-475d-a28d-90754082bb7f", "value": 1589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691792739, "uuid": "c7fd0e78-ed3b-4e72-a1a7-8a128c4e37b2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691792739, "uuid": "9971ea1a-2981-4229-964a-0a665474bb49", "value": "bld-upd-stbl.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15988f8-387a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691781037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691781037, "uuid": "1f687b6a-fe26-4970-b41e-77df81c75a58", "comment": "Malware payload (RedLineStealer)", "value": "78aeec9ff9fba05a0af5a4bb09b1ead4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691781037, "uuid": "f8dc765d-2526-473b-b743-3fc5e2455a8f", "comment": "Malware payload (RedLineStealer)", "value": "22fefde34e3f415b2500278f803c1c36a252688370e909a9b095336c84c8b50d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691781037, "uuid": "3fc91f36-9f4c-4d08-a97e-fd8bc34c1c79", "comment": "Malware payload (RedLineStealer)", "value": "23f20ede1d34eec5a1cc63dddb2df834b8d8554f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691781037, "uuid": "6d94e7ab-e2a3-4110-8c55-b3903de1c5ec", "comment": "Malware payload (RedLineStealer)", "value": "a11ae46fbbcd3da98c3a5cbcd8b6f4af640155a40ba38b68e168f938bd09f4e4100a2aa57972ce7c9270cce79893ee9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691781037, "uuid": "ad0b4947-d6a9-44f9-ba2b-79643a725075", "value": "T1B3F4124662D84172D8B63BF458F202C30E35BCB49D78A7BB3399995E1D72284B879327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691781037, "uuid": "9bf81756-f468-4629-be55-702403b19a34", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691781037, "uuid": "478c27f1-cec9-40db-b3a1-07a7dae6c6d5", "value": "12288:jMr5y90PB6YYf7HaTXaePwEuZ0r2Rn7GUfGa727yNu2fWwKrLjl:WywcYYfjaT9nr2tSUf97jNu2fW1rLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691781037, "uuid": "6f43819e-666b-41d7-85ad-fe43ce969d44", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691781037, "uuid": "c564c8c0-aad9-439a-bf96-26f60e576bec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691781037, "uuid": "0594fd17-533c-4076-8797-b6aba5fbb215", "value": "78aeec9ff9fba05a0af5a4bb09b1ead4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94da24d-3839-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691753160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753160, "uuid": "41c199eb-9bf6-4a61-8aab-124f0940faca", "comment": "Malware payload (NetSupport)", "value": "90a00c979fe17ac96e9ff34bbc7e56c2", "object_relation": "md5", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753160, "uuid": "c87a6824-41f9-4094-89c6-7ca0bb1fb47d", "comment": "Malware payload (NetSupport)", "value": "231dd0c90d0d9b8e9477306a84737debb74c3b7c9ec7de7f0d2e23c9ea5cb83b", "object_relation": "sha256", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753160, "uuid": "75bef162-0403-458e-8777-4825b3afb0c0", "comment": "Malware payload (NetSupport)", "value": "5d5eb5b6918dc670f91caccef444b8544ef86598", "object_relation": "sha1", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753160, "uuid": "b5fdc362-1061-4e22-a975-41ca866b3d5e", "comment": "Malware payload (NetSupport)", "value": "9d75b8b8177ba79bea208e9e9eb06fdd5894fcddaaac3afc8f0ba9de29d3eb26ef2cf9f50ba3d6f71a5e973f8e04cd0f", "object_relation": "sha3-384", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753160, "uuid": "ad950b04-1e24-4107-959f-df436d0e8f4d", "value": "T10D315C3722A9071CC2B5463B58B1BA13977AB80DD90B8BCA325059781C1819CBD15F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753160, "uuid": "299ccbd9-2688-4953-95d7-a0508c79068d", "value": "24:8NpZsxEnB0GN7oKpeaghW8JA+WLq+/CWiyaDBLyl7pEQeyTppTpZab/2XT:8fSajJvMBL27iQ9ab2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691753160, "uuid": "870d8a8e-6903-4169-a38b-11dcc0ac4062", "value": 1547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691753160, "uuid": "05eda7f7-28b6-435a-8ea8-702b4fa225bb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753160, "uuid": "92fe8690-ee64-473b-a230-7fa82d06f867", "value": "building-packer.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0169db56-3832-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691749791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749791, "uuid": "683b4681-4aa5-4697-8abd-e5855cc8a55a", "comment": "Malware payload", "value": "5512d7e21b80170fb15f92916816ff27", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749791, "uuid": "7a9373a6-7cd9-47dc-960c-f270f1f2787c", "comment": "Malware payload", "value": "24360169459deffee52ea223a19801ad9cf3e6de12a660bd33c8b8e9456e1a32", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749791, "uuid": "2a110fcb-596b-4baa-8271-0c9c44686966", "comment": "Malware payload", "value": "14d846e35a438bcb240b0bc598be39084feb6c40", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749791, "uuid": "d8c1fd88-4dcd-429e-9c17-80670e01f931", "comment": "Malware payload", "value": "038e2ddc08852e6e72953dcf200cc5706f86ef7b2805a4a632b4d575e5f7dcd232bc34c9a5c23b3e865ac073292bf2de", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749791, "uuid": "6bcded00-7aa0-4407-bdf2-df2e871fd13d", "value": "T146B32822764C8279E6CA217C143C2B6BD73FA471EF6831D3B394BA5A1EA91D32D31117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749791, "uuid": "eed60af2-63fa-46a8-98c3-99cd90a7794a", "value": "72093c181ac0f7a289e462b70f8c131f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749791, "uuid": "af808964-ccd7-41be-aeba-bd4ec070b3c3", "value": "1536:aJrpv2iQgOHQ+viM6dngDBl+fCKaI2WRbZGT0zf0Lo2Yj:SrJ2vgOw+aVdgdcCKaIPRs0zf0LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691749791, "uuid": "f0223dfc-8c8b-4889-85a9-f27844124960", "value": 116048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691749791, "uuid": "09b371cb-bb42-4473-8241-73dca0b42841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749791, "uuid": "e65fea75-bd3c-4eca-ad50-63495eab419e", "value": "SecuriteInfo.com.Trojan.GenericKD.68628795.25109.11703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d59924-3824-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691743789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743789, "uuid": "269c8ec7-a15b-4abb-a852-227aa23f36c5", "comment": "Malware payload (Mirai)", "value": "614f59ee0809613a29ffa238045a7a85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743789, "uuid": "2fbd2e1c-8c1d-4f14-9b2a-79dd69f8a96f", "comment": "Malware payload (Mirai)", "value": "2481e420138bb0bcc52d43a127e76887cc7419ac46e7495f55493d7fccbbec1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743789, "uuid": "30031237-22c2-4ca9-83ba-cbd82bf276c5", "comment": "Malware payload (Mirai)", "value": "8894389eee1a68fd2abcea2485705bbd94758094", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743789, "uuid": "249a1c27-f288-40e6-8c3a-6350689c4810", "comment": "Malware payload (Mirai)", "value": "e114f29725b8674d93bbb7492d0e6b2389008a502ef6d078916637973c8e1edd52d0b44397793a03c1d26430692855e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743789, "uuid": "32f90998-d33d-469b-9dba-a8457cfdae72", "value": "T11A933A47B71C0B53C59B5AF12DAB3BF08B69B9E013D76185A10AEFD00372EB12512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743789, "uuid": "f9aa6565-903f-4757-9c91-06a1dc446a5b", "value": "1536:9QK1n/zXzxuPz5tq57MBtcaKECp/dC1k+8BMLumXxVqDrstKfz9e:99bzI9dtcaT0XMLumXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691743789, "uuid": "0e89750d-92a1-4146-986a-f61108ac64cb", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691743789, "uuid": "be5e3624-9d41-4f70-a278-f111f5e4b6ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743789, "uuid": "3d303095-03a6-4f4d-a22a-b3e50f909b8e", "value": "614f59ee0809613a29ffa238045a7a85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c143fd-383c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1691754310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691754310, "uuid": "6ddab541-d1ee-471d-9228-d2636805e3c0", "comment": "Malware payload (RiseProStealer)", "value": "e55ec45fbe06da9762af5c85fd35b7d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691754310, "uuid": "78b9fe6a-c2f4-4211-af83-9ee2cb386998", "comment": "Malware payload (RiseProStealer)", "value": "25ef0f7912798ce382c529a802d817926761bb52450b2e7f74db7c7788fe6ca7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691754310, "uuid": "0d65f86a-8eb5-4c04-a5c6-c9ad6eebccec", "comment": "Malware payload (RiseProStealer)", "value": "cb173ff21dead880c8c6ef56800af26a3bf00b18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691754310, "uuid": "2a7c41ce-6254-4174-887e-4b9344d19fba", "comment": "Malware payload (RiseProStealer)", "value": "f5ea94016fb799b63208ca1fa78f09ed9c4e6aeba8cf718b3cd6ebfcf73cc871bde8272dbc9c0c8f5311bbd1b334efa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691754310, "uuid": "9bb085fc-64e2-45ee-a126-be2f136b42e4", "value": "T1380502C36E91BC20F5219E739D7DC2E6273DFD614D68769A2268FA2F09B00E1C563706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691754310, "uuid": "bf3d2182-46ff-40ce-95af-454c582984c2", "value": "2c86f6022110f96a017da9bcdba46b29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691754310, "uuid": "9e48add7-311d-493b-90d2-2b70299c5630", "value": "24576:CexHxowbK7+McEOEs2QKSY8c8WCtAczSa:CexKw4YtJ2QDnWqzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691754310, "uuid": "69ed7825-16ad-4859-b80f-17f49511fa33", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691754310, "uuid": "71f873fe-7700-493c-b9d8-a6eba9a965c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691754310, "uuid": "6bbcd28d-f5e4-462f-958b-eb06178e8789", "value": "e55ec45fbe06da9762af5c85fd35b7d1.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0049d5-383a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691753592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753592, "uuid": "c5f3c322-b9cf-49a1-96ac-302b9abb6e93", "comment": "Malware payload", "value": "96abcc18797fd8c25457ac800daee1fb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753592, "uuid": "fe66ed17-d94d-49ac-b9ba-d32f03e3f53b", "comment": "Malware payload", "value": "264559fb811a5c9570001d4c5b4c0c6dbc6e91b021be272f73d48ac1e4f407a1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753592, "uuid": "638615e8-b224-4254-9519-89225c060114", "comment": "Malware payload", "value": "ef6d9f0135454f1ee9c2f36d6b4b00b5f6767d78", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753592, "uuid": "4d115d61-9d4d-41eb-bf8b-83e9620c234e", "comment": "Malware payload", "value": "8e9768226130da18e05938b5a34af9df8a5e289ec6f5d1339c7578a000af14001e01eda416439e5aae1f10ffde14bfba", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753592, "uuid": "d8c04af8-f0e5-40c8-bf0c-bf79fd8c60b8", "value": "T19FE423AFAC070A315FCA1B4576200988FFEEB5217EF6BE27DD11105DE85014A1F2A83E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753592, "uuid": "85e4c3a4-d24c-4b1f-aa62-06f00818679f", "value": "12288:HpJoPWK6GqB8zrc45hZ0wv+seW5Cjb+qkiVFNrtlwxV2nhndcPK4D684N3:Hp6Wff8ZLZ0C+s/0wxChndf4e84l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691753592, "uuid": "3a2b1da7-5300-4bf4-b239-cfddda45fcd7", "value": 713125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691753592, "uuid": "13796316-dd87-4b42-87bb-68ac85979b41", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753592, "uuid": "42de65ef-2d85-4ec0-82d6-08d6da53bd20", "value": "Yeni sipari\u015f _TR-59647-WJO-001.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c1f7e4-3807-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691731706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691731706, "uuid": "02c55cb2-61b2-4e4c-9b75-7b5473059d50", "comment": "Malware payload (AgentTesla)", "value": "09f1281ea1d444eac72cd431c58081ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691731706, "uuid": "c8df5405-2352-4020-93da-e1293bd2c1dc", "comment": "Malware payload (AgentTesla)", "value": "2dd6ce65ea7d7e9e7ec4a5e52bcf41bd327e418c23f3851bea856d9490852e2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691731706, "uuid": "d6f62890-5474-4cf3-92b4-d41895488569", "comment": "Malware payload (AgentTesla)", "value": "f4a3ec6d9bb5ad9f030e687ccfdc9df6184928b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691731706, "uuid": "b1570897-39e5-4fb9-ba42-58bebd904670", "comment": "Malware payload (AgentTesla)", "value": "68c5defb01dbefb075b975236a173f1b23b9acb967e1d75e7ec0dc624b42c8efd2acddee3c9958bb3b22edb26ad955a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691731706, "uuid": "64c891f3-56c7-446d-80f3-6cafb1b11a54", "value": "T1CF05C060AE3DCF42E5AB0BB9104ED70E83725C993527C13A5AA790C6D0977C206DB79F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691731706, "uuid": "0412209e-bfdd-48c6-91f8-5615f00847a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691731706, "uuid": "a6c79e56-6ccf-40d4-8a36-57ddf478cbe2", "value": "12288:N1PDogPBCmA0S4flCNn+XmvWY2QsPC7A3crOgxfcx99lqTjO:MBmA0BflyOIVUxy0OTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691731706, "uuid": "77efc402-618e-4c64-ba84-1b18dbf78497", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691731706, "uuid": "67be57d0-0852-4d55-94dc-a174db10a461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691731706, "uuid": "0dde8942-2fca-4c22-a60a-49409320031c", "value": "SecuriteInfo.com.W32.MSIL_Agent.FPI.gen.Eldorado.14735.3514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82d22af-3839-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691753158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753158, "uuid": "16a4e4b3-8755-4398-86ab-84a2e7f1ec63", "comment": "Malware payload (NetSupport)", "value": "c64f17787bbae1261eedefa104977af6", "object_relation": "md5", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753158, "uuid": "376758cd-dfdb-412e-aea0-96e522463050", "comment": "Malware payload (NetSupport)", "value": "2e1d55acf32b4ccea66018b7a4bf891bf5156aaed944b69dd9b327ee82095110", "object_relation": "sha256", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753158, "uuid": "a971b973-08b9-44a0-a99b-ef92428502c3", "comment": "Malware payload (NetSupport)", "value": "ccfeb2ce3d7a1adb7eb5988caec99446503c9158", "object_relation": "sha1", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753158, "uuid": "30937c7a-5b2b-42f9-b4b1-43c1336ceab1", "comment": "Malware payload (NetSupport)", "value": "f403916184fe1d98625ccc9341e8c4dfb26f45001e9cb2106bb401ad867a4465fa60ca3a4c707f7b64372b590789bf05", "object_relation": "sha3-384", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753158, "uuid": "2b015b8a-e07c-4b7a-b192-2a47502a2f0d", "value": "T113C02B344B3EC079C437041D882D8DBDE82B5045519FCDF003E42A8DFC4746E8E58884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753158, "uuid": "2817b000-660f-4478-85f4-cd641ff643ef", "value": "3:HRAbABGQYmjUTjKPnd1KEgu8KSoLRco1YSo/QJ500GQvyYesbBSn:HRYFVm86d1fX8XFSoIJ5SQvyYesbBSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691753158, "uuid": "c693b310-2e27-49f9-877b-77a523595a63", "value": 152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691753158, "uuid": "a8ecc7c8-a499-4027-8ffb-1627babec5c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753158, "uuid": "6bbc695c-1dde-49f8-9434-0470b757490c", "value": "download-package(win).url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5a85f7-3895-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691792738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792738, "uuid": "e7558c52-a628-4d1c-bcbc-96e56f0d2cbd", "comment": "Malware payload", "value": "97aef8c5f6283c26fa755d39076dc096", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792738, "uuid": "aeea3482-68d1-4f89-80f4-48a632497b38", "comment": "Malware payload", "value": "2e8f719bfd9f84d8ffee3f95232243cadccabf712889258ba7ff8dc5f064c035", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792738, "uuid": "2d3c040d-62e4-4ae2-a238-b0ebed1977f2", "comment": "Malware payload", "value": "0562a7ba3aea9fce7a4abdeaf1d727ca99f6b0a8", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792738, "uuid": "2fb4c1ba-48a0-4f58-b5a6-7cd4158c6c38", "comment": "Malware payload", "value": "6d055e55d8c390dd75737ded645d6270f8891a4d70277132e5e6fddd6868fffaa153bbbdb4b150c5f750f0d1294ed1de", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691792738, "uuid": "80636c8d-552e-429d-bbcc-f39ec673bd24", "value": "T16BC08C24472EC8788823461D880C8C6DE8129040526ACDA002EC2A88B94242E0E48488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691792738, "uuid": "4c19c316-56f3-459e-a9a0-102318f090e7", "value": "3:HRAbABGQYmjUTjKPnd1KEg3vRvUo1YSo/QJ5BCbyYesbBSn:HRYFVm86d1fYISoIJ5BCbyYesbBSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691792738, "uuid": "01f6f467-002d-4928-8aef-0c2839d3db76", "value": 149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691792738, "uuid": "5cc682a4-6b38-4a20-a027-cca1702cec7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691792738, "uuid": "3c1297e7-16e0-4c51-a17c-c6e4baaa136a", "value": "en-win-local(up-download).url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85217672-3813-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691736698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691736698, "uuid": "29eeba90-8c38-4d91-898e-c1a4f6104352", "comment": "Malware payload (Formbook)", "value": "95e1b14be992fe978625c5cb3b8d9bc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691736698, "uuid": "1bd5e19b-dfdc-4df3-b999-6498c3a8dbef", "comment": "Malware payload (Formbook)", "value": "2f77d3d54d53abf393f64e11d858760760953897f4d10025cc4816b9b8b87e6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691736698, "uuid": "a858c787-f57e-4711-b45d-a01597bc5161", "comment": "Malware payload (Formbook)", "value": "811a10cad5dc796395c9db70996c4ad7d5bed59e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691736698, "uuid": "f03f3ae1-94a3-4cdd-8851-0d8efbb51114", "comment": "Malware payload (Formbook)", "value": "097c545a828d3353e01e4969d9a0e071b563c61e2706c98ae93a18a3c24cb262e3dd2f2833eef11651267c6a3a2a1a64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691736698, "uuid": "a1ebd476-b157-4876-95fb-38f23040a3c0", "value": "T13D05DF50AE7DDF82E56B4BB9008ED34E83B24C993523C13A59A750C6D4937C106EB7AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691736698, "uuid": "908d22e3-8afe-4a48-ac62-d4e5200de2c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691736698, "uuid": "f2b7ac63-703a-4aa1-ae2a-cfe3cde7429a", "value": "12288:11PDogBdFP40pLsYfijYPP/DuIeZnPuu80lru51dqchrly1Om5NMRJfOKlqTj13:k8naguIin2Mru5xhqNDMYTj13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691736698, "uuid": "5e993b88-19a1-49fb-8747-68a801af3558", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691736698, "uuid": "bc4db4c4-52a9-43aa-8bd5-a1be90903c8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691736698, "uuid": "fc127126-50ce-450c-92ce-4b81de501708", "value": "obizx.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "994ac4dd-3861-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691770232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691770232, "uuid": "abea92a5-cebe-47fc-9441-59c0fb7f5d78", "comment": "Malware payload (Amadey)", "value": "bd696b6b30b82e3eca65e13aec831952", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691770232, "uuid": "4dfd4df0-3380-4d62-8e2b-3213361721b7", "comment": "Malware payload (Amadey)", "value": "2f994415631983bba52382aaf836e8679fbdfa77a05d3e6647fab9ef725e55b6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691770232, "uuid": "0af12199-845d-46d5-8d92-6ac2e219b172", "comment": "Malware payload (Amadey)", "value": "f6b4cf8f05ff7ccbe17ac38afe10c0a5925077f4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691770232, "uuid": "790f6d91-85fc-4c10-80b4-1e11587f241a", "comment": "Malware payload (Amadey)", "value": "74f9fc05aa98bf8385a3336d20048494092df7ed78ac03045716ecf8732803d21a56eee4d01dbceb0dc7f4dd36e2e9a6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691770232, "uuid": "beab6447-1409-4415-856c-520b1245f8df", "value": "T194F41253DBE94072D8F52BB999F707D30A35BCF19D35C32A1344AA496C73680AA32727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691770232, "uuid": "701fd0b9-934a-4d31-bc87-27ba1b74a174", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691770232, "uuid": "3f93290b-5063-429e-94be-04b6fbd263a7", "value": "12288:5Mrwy90g1hXkpAEFPPDroSnqUm3f/ETxZAu+4NlB9RQp/qHPqha2gp2:JyHfgpbxYf/er9lBTQcHNxp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691770232, "uuid": "3e498097-3f72-4a0a-9f2a-7beae842690e", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691770232, "uuid": "314e7f6e-f4cc-4f96-bb10-6c4f1ff15fea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691770232, "uuid": "c30d4c1e-e92a-4261-b969-366ae6c8dbdd", "value": "bd696b6b30b82e3eca65e13aec831952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c04fc18-3874-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691778344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691778344, "uuid": "597e3519-ddf2-409d-a5ab-ee4d72c40bdf", "comment": "Malware payload (NetSupport)", "value": "1d50013bc39d79c5cf076b8f48cbf3f7", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691778344, "uuid": "a700c1a9-5de8-4273-896f-6b30f34680aa", "comment": "Malware payload (NetSupport)", "value": "3080111d611b6d3636afed61b31335fda48d04ad854a351a953dc444e6bccf27", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691778344, "uuid": "687839f0-b89b-4142-aa10-95280ded8f62", "comment": "Malware payload (NetSupport)", "value": "a695685fb76ae4afd0e33e608b49ec4ad04ccf9e", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691778344, "uuid": "c9f964db-a85a-4c94-a291-a3ee67782bdc", "comment": "Malware payload (NetSupport)", "value": "3a0926e77b2e7986a8a7f475d8d9a9d3d92e8d699f57088dffa7718272c77afbf0f60d65566ffcc4adfb9a351002e142", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691778344, "uuid": "486e0c65-bab2-4201-b84b-c47257b5e92c", "value": "T1B4A533134B729DC4E423323B6CD57930BA7E9336BA627E6CC15ACA8720D9DD6C96CC44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691778344, "uuid": "496b6346-156d-41b6-b948-76a92c743933", "value": "49152:qcqtE+5PWZMB1qEzda5D/GatWTjvE/OOKnzUjznX+:qVtEgPdiERqpWvMOOpPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691778344, "uuid": "af5fe2cc-5ce9-46f7-9b76-e40a258a1be7", "value": 2191105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691778344, "uuid": "e1aeee32-9033-41e2-a39c-6a9a157f042b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691778344, "uuid": "08393d8b-a37a-4b5b-8567-20071582dd2d", "value": "Environment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1945298-3849-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691759992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691759992, "uuid": "70300817-5bfa-488f-9459-785ef60327ea", "comment": "Malware payload (GuLoader)", "value": "57b201383e13105dd46c176ce11bcf6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691759992, "uuid": "4065aa9b-5a4c-4119-8673-b0efe4c620af", "comment": "Malware payload (GuLoader)", "value": "3084601ebb4bf83f233667588d6390bdc04cd8c0e6fdaf51d3a81fbabdb4e0ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691759992, "uuid": "6b5fd37d-3017-4fae-919d-7d3b9d5bc6d3", "comment": "Malware payload (GuLoader)", "value": "19b9af71d762a78e2daab55157a7fbe2aec65eee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691759992, "uuid": "7791666a-34b5-4e37-aba4-62e315a8c48e", "comment": "Malware payload (GuLoader)", "value": "2a27f699a9bbceb652894027484a0dd5c1ef622fb9677e3e24180f694bfc937b3a4b75d414b825906c90c0bdb0054435", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691759992, "uuid": "c804855a-0aa8-4640-99a2-c1f5e4d88efa", "value": "T1FF353925E77B245AEE29A1F85E2F847239D6DCC0F1B1C588A7E72C0385C23514E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691759992, "uuid": "db9e6f82-d474-4160-bf4d-1d83a8d0ae6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691759992, "uuid": "89f3e714-6de4-484f-8201-d42312c6097f", "value": "24576:e9zRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOTHCejuH7cdEokx8kgeHk:eNRs6CE3jLbO9Rs6CE3jLbOTHCbH7cv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691759992, "uuid": "33e094db-8a8a-4a21-a3b8-95462f9c4744", "value": 1125376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691759992, "uuid": "d76fe276-1a50-4c75-a146-4f774a0953ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691759992, "uuid": "67a43309-1e20-41e6-9ec4-9d49ad7e4f76", "value": "Sales Contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8de053-3857-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1691766055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691766055, "uuid": "c0e18d5f-e0b7-4c23-9b02-258249ef1283", "comment": "Malware payload (Cobalt Strike)", "value": "7df806ff482d88dc652a634338ef616b", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691766055, "uuid": "7fc40451-cbf3-4f60-91d9-d60ee5186ba7", "comment": "Malware payload (Cobalt Strike)", "value": "30e835866395298b102bb0bc62ea0d2f8aa26bd06bb38a6dc4112beb4df2219f", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691766055, "uuid": "fb8d03f6-300f-4237-a875-c23b87e90cc7", "comment": "Malware payload (Cobalt Strike)", "value": "d623c9bb721f0a30770acd6f67053f6554185ba9", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691766055, "uuid": "0bc920ab-b9a2-4d84-9bf3-f435a7891021", "comment": "Malware payload (Cobalt Strike)", "value": "7c92e4c85fb11da86652c897abfb86dec7e3ca7330237b53194fb6e0804e33d1009a983597b6398b19d2c15d067895ad", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691766055, "uuid": "0eed6b14-c13c-4bf0-be60-d57a6292d6c3", "value": "T1C894F3C6B71BECF9CBF3C076A11163353E89EAC140919E374761C7B96D35908A85ACB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691766055, "uuid": "cec31c87-8ad8-444f-b1c0-06d9b7086f6e", "value": "0104663fe1ade3974a7b185f8d21896d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691766055, "uuid": "3b595670-00f6-4c63-89ef-5828ec9f555b", "value": "6144:z40y4KNS/BG2J0d/16U/YQ9Ikg75nV3h/HX3C0sWpGTv/+UAXKKz/:z+0/X0dt6Ugtp75//nC0JcTv/+UAp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691766055, "uuid": "162890df-d7ac-41f0-8129-96c56b1c2d33", "value": 430592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691766055, "uuid": "18de0039-dc1b-4139-ae53-bbe48603a185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691766055, "uuid": "24f8481e-c5c8-4477-a40c-2eab0e3ea22f", "value": "30e835866395298b102bb0bc62ea0d2f8aa26bd06bb38a6dc4112beb4df2219f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08618cb-3863-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691771130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771130, "uuid": "8c3bc15f-58dd-4def-93c5-d9517fb5fd78", "comment": "Malware payload (Amadey)", "value": "95dc0cde0b98304076158819ec592985", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771130, "uuid": "80f18943-75ac-425f-b220-7df3e6dc99dd", "comment": "Malware payload (Amadey)", "value": "31940993c7600c9c4b9c12dbc13cfeabb50f5526f3c91eefd5f02789920c6be6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771130, "uuid": "d95afbd0-c39e-454a-8853-c6f54ebb5ce9", "comment": "Malware payload (Amadey)", "value": "6f20fa5d8bd8f15e9d1db4006314d0c24eaf6d9a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771130, "uuid": "d1c94584-8e07-43da-9ac2-9777fe9e0092", "comment": "Malware payload (Amadey)", "value": "a30474b3f5f5521dd0f039f244854148b3e53934e38f4ff8b94ce7e84638637c6ad5ca10078264872a046b6aed3f0ccd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771130, "uuid": "a03a924e-e96b-41d9-898e-fe8527ceea1f", "value": "T1096439417952C072D960A1721AB5BFF2C59D68249BB049DB7BC00F76DB212E77A30F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771130, "uuid": "54488d40-f62e-4d4f-b5b8-b254ca1cb2c1", "value": "44e769941d2c6ad88bf42ac4adb36135", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771130, "uuid": "d39e6f0d-f100-4eef-be2e-4282419d8341", "value": "6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691771130, "uuid": "77cdbeb6-b73f-4e52-a7bd-8b7628802099", "value": 321111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691771130, "uuid": "c864b9c3-406a-4c21-ba72-161c52673658", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771130, "uuid": "f4429368-0290-4ea1-8eba-356afd510f63", "value": "95dc0cde0b98304076158819ec592985.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a755992-3856-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691765429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691765429, "uuid": "f9ff4885-36d8-46b5-89f4-c269a9d09259", "comment": "Malware payload (Amadey)", "value": "fa597eef1df5ce947d58241e8032ebd1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691765429, "uuid": "e3253504-d4ff-4eb3-869e-dcff37522ac9", "comment": "Malware payload (Amadey)", "value": "32e6b1d0171b031ab54867f60050e97dcb58faf624c789a2f1eab034b6794f5e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691765429, "uuid": "b2de9d24-1ce4-47ac-be2d-971de3757508", "comment": "Malware payload (Amadey)", "value": "ba9d54f68368642767dcd339b13e5ef2c8eaa2b5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691765429, "uuid": "f242c8ba-792b-4817-855d-d8c636a8122c", "comment": "Malware payload (Amadey)", "value": "3c85d81a41261a7635226f80c89456de1d5140b54ecf78411d7238eeeda0f6159d9581e93516042122fb0a83720350b4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691765429, "uuid": "feac0bf0-b705-4994-883d-f4caba41ba22", "value": "T1AED41253AAD84073E9BA67B01DFA02C30735BCE618B8976B3341D95E0CB2691E875737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691765429, "uuid": "06bdd21f-662f-4ef7-88f7-d9e491b15481", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691765429, "uuid": "47306356-33df-4e15-b029-0be326e9338a", "value": "12288:XMrky90vzSWE0W3C8VlOBxOupXC+jfk6ZAwbDc:Py+E1y8V+AuVC+L7ZAwbDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691765429, "uuid": "f361ed2a-bf7b-4c96-aca8-375cfba08859", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691765429, "uuid": "a4a78013-792a-4288-8462-ad2847fdf017", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691765429, "uuid": "78e40825-ea28-4bc3-b431-8d0a2c3169e1", "value": "fa597eef1df5ce947d58241e8032ebd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4834f7c6-3803-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691729724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729724, "uuid": "9eb4db4f-25bc-46ed-9271-da24c02582bc", "comment": "Malware payload (Mirai)", "value": "1cc3e589e1ab263163e74c8ccc341521", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729724, "uuid": "dbc387a8-5ba6-441c-8566-71400b77e2b7", "comment": "Malware payload (Mirai)", "value": "33d325e57dbff162c70e2d234371a185b38d654efd928b74fb2096e143485527", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729724, "uuid": "f1a22227-23da-4a06-a1ed-61bf946732fe", "comment": "Malware payload (Mirai)", "value": "f18896beaed184285d37b238086f04afb36dbb64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729724, "uuid": "7edbe13c-10e5-49cf-b322-0ec820b97143", "comment": "Malware payload (Mirai)", "value": "9bcd2b858ad77b569cec3d0da562f009e8cefa0cc207f8464f0d052f9bf31d70dc73bedb048bb34c30284700aeac740e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729724, "uuid": "d1e2d1c1-9990-4ca5-a77d-b026b6dd8dd8", "value": "T1BB534A02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979996B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729724, "uuid": "daa856cb-6436-4cfe-9cee-852b4e98f5ac", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1n6Ba9UCdny5EMy2/J9iSzEv2xRgN0L6FV+tg6wO:+5HAdOmG0UFdnAd7iSgOxRgN+e+aTWOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691729724, "uuid": "75ceece5-cccc-428f-9def-eae21224f6bd", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691729724, "uuid": "745bb5af-3e72-454c-bcb8-adfa1eae1919", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729724, "uuid": "5139a2ab-a5b8-420d-98a6-7e1d8a0dfc6b", "value": "1cc3e589e1ab263163e74c8ccc341521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109b9481-380b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691733066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733066, "uuid": "813b5997-b1ae-42c4-995d-ce99115e905e", "comment": "Malware payload", "value": "20e0d9f57c0899c873ad91931dc5c671", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733066, "uuid": "657d8f2c-3ee6-43b6-a3ea-c1bef2560fe0", "comment": "Malware payload", "value": "36a4e8a65fe37a2fe4ecff45beb57626551492f5db2c6b755ca07a299b9cae80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733066, "uuid": "6269ce33-d1c9-48bd-8705-6f9e64e6230e", "comment": "Malware payload", "value": "4937411b9b8caa79d5e38d02121ef4226d86078a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733066, "uuid": "a09ae09d-8466-495f-b07d-f5add905fc6b", "comment": "Malware payload", "value": "5e896f541521ed3a543c3e2660381ed3b66fc3998388249ca55838e49c3f3b1e6641a21ea43e89db00ed7748edc111b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733066, "uuid": "2cb163cb-fada-4cc6-b6da-022863f7ad42", "value": "T1A3150722E77B6549EF25A2E84E2F847179D6DC80F1B1C98CB7E7680385C23114E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733066, "uuid": "6e50c85b-7b75-4017-a32d-bee4aab0142b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733066, "uuid": "b8595b5a-a040-470b-a697-f6cbe92cb060", "value": "24576:UvYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOEOguYc2lL12S7Gg1M:UwRs6CE3jLbO9Rs6CE3jLbOUu4L12sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691733066, "uuid": "4b42bba9-386e-4186-a21d-3fd748fcd323", "value": 886784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691733066, "uuid": "99a0b3c7-8a18-4450-846a-202ed357501e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733066, "uuid": "dda45e1b-4b18-4c95-946d-823b0bae5478", "value": "Request for quote_S020-230710.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19af4be6-37da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1691712036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691712036, "uuid": "3203674e-08b9-4788-a69e-f907d7024b33", "comment": "Malware payload (GCleaner)", "value": "0444961d34ffb4738bc72c4637f25581", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691712036, "uuid": "c2525006-483a-4254-8b49-869566e0b879", "comment": "Malware payload (GCleaner)", "value": "37070f217d973a45349a1c7ec6e31c3cadddcd5dd0a9ea5a80f46e0290ed3af9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691712036, "uuid": "8fdd06f1-73b0-4ab7-b410-f9dc96817e41", "comment": "Malware payload (GCleaner)", "value": "41adc721939711645003317ceb5215f50de2e739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691712036, "uuid": "50bfeabd-7a0e-4d78-92d2-2287d6f1fb07", "comment": "Malware payload (GCleaner)", "value": "44f6b61bc747155bbd4d30e7968595b3ed440bca72b81322d41a982174c4da35aae3d1ac759dfe6faca979fc42ad8210", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691712036, "uuid": "e346d23a-76f9-41f1-bc15-aaba57ab293f", "value": "T18654AF1067E0C035F1B722B64DB693B5A53DBEF25B2491CB62C43BEA9A356D0AC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691712036, "uuid": "90eb86a5-a0fc-4822-87df-3f7ed40118e8", "value": "5836b0745b42c6bdea4bd6e4cf5c6b7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691712036, "uuid": "7c88d111-5f12-40d5-88d3-8ba08715c273", "value": "3072:lKw6XaRS/keTIQhoCX17c+0aYn7y2w5ZR/mGz8Zu6M1T8fnlXytXcv9oKHC4UsaC:lKzl/jTtDX17PdmtZjtw444DjrrKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691712036, "uuid": "0e79fc9d-f1ab-4df5-955e-50e48cdd3115", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691712036, "uuid": "711e5fce-5cac-4bc6-b44a-3418a003e0cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691712036, "uuid": "ed009efc-dfc1-4140-a02a-ddd85cf63ed8", "value": "0444961d34ffb4738bc72c4637f25581.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e5600d-382f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691748827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691748827, "uuid": "1d84822a-4cde-4bf7-adaa-d44d1bc33855", "comment": "Malware payload (RedLineStealer)", "value": "74a5e19eb14a278179f18e41519b606d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691748827, "uuid": "e004a9f6-a9b1-48e7-9dce-9cdb1a8188cd", "comment": "Malware payload (RedLineStealer)", "value": "37de802ee7fb89ecbaef5175ea96747b7d429e92621cc236ee461cd6f084799b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691748827, "uuid": "5a2dc053-de1b-4f9c-8beb-d721f9f53d69", "comment": "Malware payload (RedLineStealer)", "value": "9760dbac41039db28f8fc64970a0974bfafe9a8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691748827, "uuid": "042ddb25-1014-4aaf-a46d-b4ec323f1f36", "comment": "Malware payload (RedLineStealer)", "value": "8fdce6d3bd28eb11784764b37f9a5e2dfe30933df9996c49b36ba2b9f409bb23c555c9acdc2de002a1e318ad9213d7d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691748827, "uuid": "3406a0a4-67e4-4d76-9900-3205fe7a6a35", "value": "T13264D05263E0EC71D2264A30AF1EC6E47A3EF5B15D698B6B33547B2F1D70192DAA3304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691748827, "uuid": "5404fe83-5954-4c48-95e2-04f928ced311", "value": "041d48491af33996afda7a32ee725dc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691748827, "uuid": "324514e4-e516-435c-9d41-f2867bb4be0c", "value": "6144:1eQL0IWxNMQkol0HgLFmqV+4VW/o4vTsrMoP06iXs:/zWx9bm6FmSgTLV/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691748827, "uuid": "64380adb-0b73-4a52-a818-e5b4f5113081", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691748827, "uuid": "d21229e4-1c2d-45a3-8f06-4d5109e7bee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691748827, "uuid": "a31e2420-ca23-431d-a64a-236087820437", "value": "74a5e19eb14a278179f18e41519b606d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a26372d-37fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1691727606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691727606, "uuid": "3e88799f-8909-4266-9a52-bf50ed2ad5e7", "comment": "Malware payload (Gh0stRAT)", "value": "2dd889f6012498e55f85fcfc63722be2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691727606, "uuid": "d65ebe6e-6cb5-4722-aab5-0f168fb0e190", "comment": "Malware payload (Gh0stRAT)", "value": "38048316d8a7ce688d6c8f93a3d3879ac2342a318af0db12829103beab32032f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691727606, "uuid": "94867da6-4115-4117-8d3d-a9ca61716bc7", "comment": "Malware payload (Gh0stRAT)", "value": "cd51bff92d7c115bdaabe0a8dfe55a08ece57203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691727606, "uuid": "cb881dbe-288a-4b08-8eab-bb02df84e86f", "comment": "Malware payload (Gh0stRAT)", "value": "1867ccb7df17c1b25c05b555308f263f0ee294e7d2144f10e43bcb2b52de96ab9f47d46cfe4f8aeb2dc5e37b2479011e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691727606, "uuid": "301998a9-7875-40a3-a85c-1918c079a31d", "value": "T1C314F14D6E934127D9848AB0C2D00ED80BFCEC473D9275AFEF6098561A6409DA5FC9FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691727606, "uuid": "35951fbe-79d9-4112-a33a-33118f2c3238", "value": "ef39d474ee88b9215814d74ee695b02b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691727606, "uuid": "ba28ecd3-1b15-41a5-9ce7-73b0240c8283", "value": "6144:n6M96wgvRHCzOYtqlGyzcsX3KA0LQIQR:6i3gNCpOdn/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691727606, "uuid": "1997960f-b7e2-4412-8783-4024b339f9b5", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691727606, "uuid": "2800615c-b21f-4784-a236-62f5cbe2279d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691727606, "uuid": "79ef9a5e-9151-49c1-95c1-e3a9c61e8878", "value": "2dd889f6012498e55f85fcfc63722be2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d474d377-388a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691787941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691787941, "uuid": "2e6c4014-be24-4830-9fa8-57c1615806e3", "comment": "Malware payload (Amadey)", "value": "2e9a08b0e5ae5fd5ef8fcbd63239a5fa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691787941, "uuid": "46781473-31ae-463e-b593-c3e16e1d25d0", "comment": "Malware payload (Amadey)", "value": "3937d754c3192c545f9f50d8534c86aecb49638a9f63b716c45e92a4a09cf3d0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691787941, "uuid": "94864ce5-d326-4151-a2aa-2debe3dc4fac", "comment": "Malware payload (Amadey)", "value": "2f7d547fb61da95c108e79efdb9b1044a8dc5783", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691787941, "uuid": "2e85e6a7-0a4a-4e38-b6ad-ec6f54ab3330", "comment": "Malware payload (Amadey)", "value": "d352f5a9bd0bc17ba99e9eeac6749967cf1e0ca72c9511486882c1f439986ea7af83991889c68bafe09d5b8bff8abd41", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691787941, "uuid": "e9a73e64-585a-4596-8758-5535bba43fa7", "value": "T1C16439417952C072D960A1721AB5BFF2C59D68249BB049DB7BC00F76DB212E77A30F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691787941, "uuid": "ef53a11d-3b86-42a2-a0ad-6f13b3b90f4d", "value": "44e769941d2c6ad88bf42ac4adb36135", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691787941, "uuid": "10bcb408-c4cd-4a64-8f4f-4311bbe10bf9", "value": "6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691787941, "uuid": "615549d6-5e7e-4b4c-ac39-74f65d03bd45", "value": 321229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691787941, "uuid": "c559175a-5eb4-49bc-8c8a-28c40cd04ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691787941, "uuid": "bb05615d-b79d-4bac-848f-7efaa0b923fb", "value": "2e9a08b0e5ae5fd5ef8fcbd63239a5fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfdc041b-3822-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691743293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743293, "uuid": "5647cc20-ddca-495c-a6a8-578d04ea81e9", "comment": "Malware payload", "value": "9b47b94bee9f3fe48aaf855d35cd16ad", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "curl bat", "colour": "#321FD2", "exportable": true, "hide_tag": false }, { "name": "EnergyEfficiencyConference", "colour": "#A49DCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743293, "uuid": "fc18fbc2-1ecd-4ecd-a894-e2a3143e7751", "comment": "Malware payload", "value": "3bb989d1ac1b1d35c87fa7020bb9c92bbb71dde57515039bf332d14fad1407c3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "curl bat", "colour": "#321FD2", "exportable": true, "hide_tag": false }, { "name": "EnergyEfficiencyConference", "colour": "#A49DCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743293, "uuid": "7b5d8c78-6143-407a-a575-4dfa374f3e9d", "comment": "Malware payload", "value": "f11c9ce130c4a62011d1d495dd3d74063517e002", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "curl bat", "colour": "#321FD2", "exportable": true, "hide_tag": false }, { "name": "EnergyEfficiencyConference", "colour": "#A49DCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743293, "uuid": "42ff9db7-277f-4f10-906d-46c97b384125", "comment": "Malware payload", "value": "550a9919b7765e59bfb5f73a3ee730ed5d8d6761213fc430beb9f1f7d8eb4ffe87ed637b400bb997c9ecd4cfa433b882", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "curl bat", "colour": "#321FD2", "exportable": true, "hide_tag": false }, { "name": "EnergyEfficiencyConference", "colour": "#A49DCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743293, "uuid": "15bf25e6-f802-4f6e-97cd-66962f179fd5", "value": "T1CDE09A5A8BE89279840609AF42491D5F50BF35AE3B8C8C30C3F01881EC48E3C99E2DF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743293, "uuid": "bb112fe0-475d-46d9-a848-0db85a9c02ec", "value": "6:s8GuOO0qgnXPrDCphMefk9bSsLo05CphxQp5LlYpxVppbLlYpxAoYzn:s8J0bXjD7vusLo0MNoYzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691743293, "uuid": "9ed884ea-926a-4f10-8664-a3159640a4a7", "value": 367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691743293, "uuid": "67c615d9-3d0c-4065-a8a4-d73e13620529", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743293, "uuid": "ce4788a1-e2af-4f96-a16a-d9134fb2da6b", "value": "curl.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9a8f45-389a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691794857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691794857, "uuid": "a9768275-7d16-46da-909f-b15ec734c251", "comment": "Malware payload (RedLineStealer)", "value": "1df29c26a58429bb966f9857091bf23d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691794857, "uuid": "30c58e25-cec1-4c89-ba69-0515c939e456", "comment": "Malware payload (RedLineStealer)", "value": "3e991776580443a25da5586957eb9bd5b2746e3d6f958148c801087ffcac183e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691794857, "uuid": "25052a39-b1a0-4db4-887b-3617d34a9a1d", "comment": "Malware payload (RedLineStealer)", "value": "636480bb749bd8ebd39d268db4bb91b2ecfdfa3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691794857, "uuid": "1a7c49e2-f6cb-45d4-9379-b84eb0fb7d16", "comment": "Malware payload (RedLineStealer)", "value": "633f4b4cde0e363b2fd81d675962eb5720bb85e9ff13021caf6f3e1d850edf6e93b6b1d22c4ebe4fc9c760da5bce2ca8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691794857, "uuid": "31d41bcb-75d1-42fd-8271-ebc55262cc40", "value": "T12613F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691794857, "uuid": "52dfcf4f-cef5-4902-9cba-d41f9a32143e", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691794857, "uuid": "266dfad2-d607-4075-8580-4a5ca968733e", "value": 43215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691794857, "uuid": "99234269-3108-492d-86fb-71004c848ea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691794857, "uuid": "1c1450c6-6081-46a2-b11a-cc28d4e79ff1", "value": "1df29c26a58429bb966f9857091bf23d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f421899-3841-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Chaos)", "timestamp": 1691756391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691756391, "uuid": "5b45b85d-4e39-4aac-bfe7-e35d589073d4", "comment": "Malware payload (Chaos)", "value": "08c7ff3a65f703d12fc644b63dff19d5", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Yashma", "colour": "#EFD02D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691756391, "uuid": "860775de-f7fc-4d7c-a3a2-6b5039ed75ee", "comment": "Malware payload (Chaos)", "value": "3ea6df18492d21811421659c4cf9b88e64c316f2bef8a19766b0c79012476cac", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Yashma", "colour": "#EFD02D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691756391, "uuid": "ae095014-3dbc-4aa9-a80b-4b356e7e5481", "comment": "Malware payload (Chaos)", "value": "f38e8932f4c88c1fd801696267924c6767155028", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Yashma", "colour": "#EFD02D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691756391, "uuid": "c3dd95ce-eec0-471e-b0ef-13d2c8cbbf33", "comment": "Malware payload (Chaos)", "value": "457f93f532b9aeb23b6599c17ff452abe6ee48cfbf41431406b3446a9ece9f575ccbd8de8fb70b612353df007746177c", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Yashma", "colour": "#EFD02D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691756391, "uuid": "3d91c634-9724-470d-b49b-77ee43e5f701", "value": "T1B354AD2425F68018F173EE7207FCB8A7D5BEB27E3696716B3081471B8612D458D836BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691756391, "uuid": "cc2a7514-2d66-4cd7-9fd3-549f70cc924d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691756391, "uuid": "5d3556f6-33ca-4102-abab-6d9986b6c4f0", "value": "3072:16biq9hBxqDhNiMLbfyU9+SHfZLoL9oic6VlQbuKGOQzEjQVnDnRM4n9gQ:1kiq9H8DLVLbf9r/ZLr6YbuC0hRZ9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691756391, "uuid": "d619285a-fe54-498d-a257-0bbec68bae94", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691756391, "uuid": "c934a6cc-1380-4777-89f9-85f9bee37183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691756391, "uuid": "ccd78fd8-b24e-42ed-995a-d3a4ba743f49", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee5e53b-37da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691712314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691712314, "uuid": "df5c22be-e147-42b2-aa08-c71a8c0caa7c", "comment": "Malware payload (RedLineStealer)", "value": "05110422872ebc723d10a402fdc27a47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691712314, "uuid": "b55e2e94-3936-42f5-8039-b59b009f9aaf", "comment": "Malware payload (RedLineStealer)", "value": "43866279c665ce788216110e56726c1b82817ab79bbc9c13be309043455a74a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691712314, "uuid": "69788b14-d053-45c2-85aa-9d2ac8b7f38a", "comment": "Malware payload (RedLineStealer)", "value": "c06ffb335c9e4fc26d5a15e3347599e061ace2d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691712314, "uuid": "58cf52b6-a14f-44b3-a237-664599895e7c", "comment": "Malware payload (RedLineStealer)", "value": "a0f2de4cd4dd3ddc84920366d8995c4d2f9338d3c10bba5200cd4d4b6aac9f45dff42330412cf15689cacbd748eb8586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691712314, "uuid": "5b025fed-d967-4b0c-8d89-1a1006a27afe", "value": "T12B74AEC26E907C64F522CE329D3ED2E6763EFD518E19775A2228FA2F05B11E1C623711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691712314, "uuid": "8914744b-19eb-4f87-87d6-bb50233daa9b", "value": "652c7ff7afcc08a2e9c5186e380250b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691712314, "uuid": "4953c50c-c950-4b9e-a6b7-86f01716a21e", "value": "6144:Cgk+3Y7WfT12E7n1XHs7j/X07eRFCvBVtcIIVMI:3kydfTrBHWk7eohrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691712314, "uuid": "9d2d18e3-70c7-4b1a-afba-4848c58cb2f8", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691712314, "uuid": "0884ca0a-10d2-4bf8-bbab-754440c05bd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691712314, "uuid": "a1794721-683e-477d-a0ad-4e6a9e1f4f35", "value": "43866279c665ce788216110e56726c1b82817ab79bbc9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83837fc7-384d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691761606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761606, "uuid": "68f0cd9b-0d3b-43a5-b5e9-9e64c062bab7", "comment": "Malware payload (AgentTesla)", "value": "56e9828b042257b8435ea07538ec4a04", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761606, "uuid": "e8e605f9-dfef-44ba-947d-26c155312ddf", "comment": "Malware payload (AgentTesla)", "value": "44a0a3156ce790bc0fabb2dc74bf1ed1945fc0a0bc1052733dd00672026ed144", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761606, "uuid": "f9ff55b9-54bd-457a-8b81-10ceb78df0cc", "comment": "Malware payload (AgentTesla)", "value": "bc6d1c2d478857ab69f9527d89dbc7850744131c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761606, "uuid": "40279e03-a5b7-495a-a238-07ed7c50e6f7", "comment": "Malware payload (AgentTesla)", "value": "35e316990875b7f7ab1320dd84f75b6999c334f39f5876ac188959a3ffb32a10fb45f04bde8b8398f66d99922289ff77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761606, "uuid": "d3ba7133-27c6-413c-99ab-dbbdcacf0c1c", "value": "T15C252825E77B249AEF29A1F85E2F847139DADDC0F1B1C488A7E7280385C23514D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761606, "uuid": "786fb068-ff98-4f4f-a205-fa49e8bea661", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761606, "uuid": "254994af-c861-42ed-814f-e4658768c3a0", "value": "24576:IkjRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOf+Bzs4Jzz3PtVGhuXPCT:I0Rs6CE3jLbO9Rs6CE3jLbOOfzzftVXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691761606, "uuid": "135ba5d9-bcb0-4c77-bab7-7da569c6d4a4", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691761606, "uuid": "42961f7c-da3b-4d7a-bd10-572d40fd0b8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761606, "uuid": "bb01605f-cdda-4342-9dbb-93ff3ae11443", "value": "SJpy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07520073-384e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691761827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761827, "uuid": "2db8eee5-4ed7-45bd-b24d-f1865953d293", "comment": "Malware payload (RedLineStealer)", "value": "5f7f1977efa1b6f3d570db9c52dfe4e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761827, "uuid": "44d4d4eb-90e2-48eb-97e9-f7b640f12ee7", "comment": "Malware payload (RedLineStealer)", "value": "452f8a80f631d6cefac1a61e6a631540f257825432c2135b74fafcf3d8bd299c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761827, "uuid": "cd84f91c-fa34-465a-8932-9cff86a0a9a1", "comment": "Malware payload (RedLineStealer)", "value": "a7b20b2bbdd567c4ee9770584c673e97261998a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761827, "uuid": "a1cfe1fb-783b-47fc-8e21-996e2e2dd921", "comment": "Malware payload (RedLineStealer)", "value": "c5db3101e0ac1dc052b65f4d5623bcbaca4df44b63dfdabf909f443be7697629e81bc7b24eb8e63b82bcf5df1a8a5c5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761827, "uuid": "0f386d8b-2a3b-48e1-afbb-5a12de5365cf", "value": "T16CD41213EAD9C073DC7527B018F602830A36BC915968977A2795AD1B0C733E8E97673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761827, "uuid": "a2222db7-a60f-41dd-8cc1-96fed79e16db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761827, "uuid": "eedd2128-4b35-4b65-89e7-280b8c4e5c19", "value": "12288:tMrQy90hlY/ViQD0RK3MYKRpEX8p7eh6oqK74FoX6g0I:JyCY/VlQRKLKTEM7oqK74U6g0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691761827, "uuid": "69a16533-561b-41c0-bf33-4f097560e458", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691761827, "uuid": "f7c460fc-b355-434c-9128-19e4deba78ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761827, "uuid": "23fbca4d-a2cc-4d84-9fc7-a36681cf5139", "value": "5f7f1977efa1b6f3d570db9c52dfe4e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1ecb87-3803-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691729678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729678, "uuid": "50d73c84-d313-4bf2-a6ba-a4b24b75f997", "comment": "Malware payload (Mirai)", "value": "a1df034aa1b029b453d9bc12dea380df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729678, "uuid": "e79a97fe-f7fa-4a29-b396-98548c7df82c", "comment": "Malware payload (Mirai)", "value": "466300c3c31ee81e3e24dfa4e441b0be64d615c6b0768d042e90c3d626c62c60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729678, "uuid": "396deff9-edd7-443c-b08f-8c5211ef656e", "comment": "Malware payload (Mirai)", "value": "43623ec4f48fb79bf27716d5c1502db8b0640b95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729678, "uuid": "3b855486-2e1a-4964-b05a-aaa932644c26", "comment": "Malware payload (Mirai)", "value": "821516264f0a219423ac74a47c5df4cce4cce3d112a86ce87e9eda4fb7a3d694fb724235e433ea39a1abbc3944e84e18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729678, "uuid": "574df2f1-18cc-40f3-abb7-7e844cabd8a9", "value": "T107634BDAF801DDBDF81BD77A4453090ABA30F3D542831B366397B9A7BC721981D22E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729678, "uuid": "fee53d46-30b7-4878-bd9f-036c8c0d2efa", "value": "1536:XYwtaY1wjnDYvXD8V5f41Mx0S3VdJH7S1fYq5QJp:XYwaYmTEvXq41m0SV/1q5Qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691729678, "uuid": "15bfbf59-0e82-4ca5-9a29-62c89508a11d", "value": 69640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691729678, "uuid": "8bd633aa-07f0-47df-8502-894a3e4e26f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729678, "uuid": "157c2f39-984a-4ea0-98e0-cd03561ca4b3", "value": "a1df034aa1b029b453d9bc12dea380df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e68e3fb-3824-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691743827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743827, "uuid": "13e49a43-2935-4b50-a603-245e000a2484", "comment": "Malware payload", "value": "b94e9d21d508ff316cc954e0bb07592b", "object_relation": "md5", "Tag": [ { "name": "EnergyEfficiencyConference", "colour": "#A49DCA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743827, "uuid": "5bb49ded-9366-464b-bbdb-6444d459d69c", "comment": "Malware payload", "value": "4b17136f8c29b602c2edf107923e0bedf991b1f1edc4ced5c253da7181fb0b13", "object_relation": "sha256", "Tag": [ { "name": "EnergyEfficiencyConference", "colour": "#A49DCA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743827, "uuid": "d5bf5396-6625-4f77-a0e6-76e006821e79", "comment": "Malware payload", "value": "91bc15d193030c7f1a1c6abb7100a41e4bc4fac5", "object_relation": "sha1", "Tag": [ { "name": "EnergyEfficiencyConference", "colour": "#A49DCA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743827, "uuid": "3645fcf3-60a5-447f-8aec-97275c54b2e5", "comment": "Malware payload", "value": "3ed3ed169f5bcacd6d553702b116477e149e555d6d1fbe8979203cdf0b574561aba651393ed762b89cec8b17ce2ea732", "object_relation": "sha3-384", "Tag": [ { "name": "EnergyEfficiencyConference", "colour": "#A49DCA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743827, "uuid": "43450e1c-68af-403e-bdbf-7449f83ffeea", "value": "T18D31C2245BD41336CBB34A365066A302D97AFC12F605FF5F438895DE0C566016E64FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743827, "uuid": "79c1545c-ca8f-41b4-94fa-c8c47d43019d", "value": "24:8Wwc7WxNpoQGe9A/mq+/0otvYNWG4GzabYDl:8WGNEVotAc8a2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691743827, "uuid": "a4d92ee6-af9c-4d50-85d4-8788022a91d3", "value": 1714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691743827, "uuid": "75762a1f-6646-481c-9976-25b341b6aa60", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743827, "uuid": "ff46306e-016e-412d-a511-8319b907fcde", "value": "start lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2f6ac0-384a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691760520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760520, "uuid": "8eb1c22b-e789-4def-8083-eb24fbff57cc", "comment": "Malware payload (GuLoader)", "value": "b3819313abbaa2c048f2da0577aa40a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760520, "uuid": "5f5df423-8137-4cb6-a14a-271001e9b6f9", "comment": "Malware payload (GuLoader)", "value": "4bc7c76462ca49d995702befda5647f40b729659d1d97129723ab1eb4ed45787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760520, "uuid": "71bc709d-7d6d-4aea-8118-280658b08521", "comment": "Malware payload (GuLoader)", "value": "074a0d1433012c4d99ca85926ba57df9581167f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760520, "uuid": "e2977891-3d5f-4dd4-b012-8b71c70b6a94", "comment": "Malware payload (GuLoader)", "value": "697253de4a247ed6a139490eb522d0e3475518c4f618fd11c6a23acb6fc670f4c4915de418ae41bae3d47cc4c731ed7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760520, "uuid": "bdef957d-685f-44f0-9f5c-b343350f8d6f", "value": "T1A7152307BB9C8FEEE39A03B2B47A5B31C254DF831512A99376F4FE6D253265C28021D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760520, "uuid": "8176f1b2-0b5b-4be0-b686-980511838cbe", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760520, "uuid": "455784e2-4110-4786-8630-5da3bcc70d89", "value": "24576:ucjuuls87yo9MpaZYtEvgZeAweRe/rSCSeowpdZ:njuuCiy0bZUeAweReMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691760520, "uuid": "94f48b9a-0914-42e3-a875-a50dc73a41e0", "value": 926960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691760520, "uuid": "00a05990-be5e-4688-8999-9b152f27f4ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760520, "uuid": "c9ded0e4-146a-4fc7-9ec6-7944c7a16edc", "value": "QUOTATION#893034AUG23_BRIDGESTONE_KBG_SAMPLE_PRODUCTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c06c13-3843-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691757263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757263, "uuid": "5ef79155-76bf-4fd4-9fb1-4a41e1dc7842", "comment": "Malware payload (AgentTesla)", "value": "e11bd1d7a386286d5daef0cf661ecf5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757263, "uuid": "05be2afa-f77b-476b-9fcb-72562ee12f9e", "comment": "Malware payload (AgentTesla)", "value": "4c57febab3c5810a755769a190c85eb5eb5b99a31e4b463f0db13ece0ea104a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757263, "uuid": "6fdf411f-5dca-4eef-b222-acbf9201a3f5", "comment": "Malware payload (AgentTesla)", "value": "3e1d83e037cbfa998ee5cb1eadcfe19c77f91fb6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757263, "uuid": "0bb3b045-4887-4c16-87eb-711bbdc2d25e", "comment": "Malware payload (AgentTesla)", "value": "bd4dcfcad1b62af01d282a910e056bad7399dbde8e1c5615c8b3f9cfd41e2cb6d7c92d39f1d0976e406aff5a3fe6b936", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757263, "uuid": "079818f1-c9ad-4f11-8b85-109bf8211af3", "value": "T15DF4CF60ED79CA82E54F4B79108FC70D82728C563622C63A5ABB51C6D4933C216DE7EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757263, "uuid": "b57dba0b-5c47-4629-8b77-34a0b41185a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757263, "uuid": "d9f1d509-0909-45d6-98d6-274a8c9839ed", "value": "12288:eT2HLXfGXHfHViSA62D8iFbZ3pnTQKper3diTZn0gFPlqTj:ZLXf4cgfiFZ3pvL10gKTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691757263, "uuid": "9b0ac3e3-c864-4258-a27e-9aaba339b5aa", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691757263, "uuid": "fc9496c0-73c7-41c4-80c9-5b96dbae09ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757263, "uuid": "6baee467-d34b-4666-97a3-00d555072f59", "value": "SecuriteInfo.com.Win32.PWSX-gen.28931.13697", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303d71a8-383f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691755453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755453, "uuid": "2b4dbd79-2413-4992-84f9-4130a61a0779", "comment": "Malware payload (AgentTesla)", "value": "e738bded86115ba04dbb7b7cc61ac6c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755453, "uuid": "733467ed-13ad-4975-a636-daf26394c4ee", "comment": "Malware payload (AgentTesla)", "value": "4eb5f3c908301d3c411f83acf5de2738240cfc015cc6717c33446eedbb4242dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755453, "uuid": "bedb4b2b-b342-48b6-97c1-1bfc89538bc0", "comment": "Malware payload (AgentTesla)", "value": "9c726dbe569142d9963fb28428f694dd2fe65359", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755453, "uuid": "5b4e8214-3814-4c30-9a56-1b09f679262d", "comment": "Malware payload (AgentTesla)", "value": "73cc7441518405332359b20deef14ee4e7a6f7787312daa10d83b52fb2848d2583d553a1f66974a238910f3e5ae2e293", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755453, "uuid": "9d656452-aa76-4603-8dce-bbebfa8f542b", "value": "T17C15D060AE38DF82E56B0BB9408ED30D87765C993527C13A5DAB50CAD4837C106DB7AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755453, "uuid": "e117cb6c-290a-41a2-9cf8-fd9734d4d8b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755453, "uuid": "b29623b6-bf25-49b9-8013-e8b959d45ddd", "value": "12288:g1PDogDyWaLtOg/pUSYkWeu4yJQ57Q7YYgxqabZwtNJWTj43i8K2lqTjI:B3WaLtOVSYdeZ70zgxpbAN3+NTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691755453, "uuid": "bafd4b7a-c760-4d7d-89c0-ad5627d09c82", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691755453, "uuid": "98f72a28-53c8-48a8-be6b-c042bb91841d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755453, "uuid": "0db94321-6a4c-480e-bbda-3410d9d99d78", "value": "Awb# 8457108962.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcccf7d5-384e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691762132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762132, "uuid": "ab6b8ba1-5457-4f61-8582-f8fda6ab3432", "comment": "Malware payload (Amadey)", "value": "223ddd547e48ffb7ae6574df1ae0a4bd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762132, "uuid": "9b8f6c14-1dbf-4637-b2b5-f3167ebff32a", "comment": "Malware payload (Amadey)", "value": "4f43c48c1df992655ef87a5175430373b1473b48ebd7f71daae5f9591d2845c4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762132, "uuid": "d1a3eb3c-0af2-4fae-b71b-1f1376572bac", "comment": "Malware payload (Amadey)", "value": "8937ba5d7b00a416646efe7b3468f8eb19ff37ce", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762132, "uuid": "8c6412b6-31c5-408b-954f-cfe151f01da1", "comment": "Malware payload (Amadey)", "value": "1f3fc2207fa6ccc36220cc4de8933cbd55a2044113355bdc0e5b24b2d1abbf5cdefab78ff201eb6e6410f3d0a4727666", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762132, "uuid": "9d56a4cd-ef66-46a6-9282-67f5592258d0", "value": "T1E7F4226392D88532EEB51BB448F511830E76FCB1E93553671386691A8CB26CDE93233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762132, "uuid": "13d9f4ef-67a5-44c0-85c2-a0af42f4e5f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762132, "uuid": "eee9fdee-6278-4398-87ca-9fe64fbbc168", "value": "12288:kMrGy90P7Me/uFtQzHheL3KZqQ8C2BvD6J2ZS36Pw4V765AB98Yb:iyHe/uFt8PSb6J2ZSKPwKNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691762132, "uuid": "d7d10dee-7a69-4008-8866-046530e2ba67", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691762132, "uuid": "162aa2e4-32a6-41af-910f-4e32a675eb62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762132, "uuid": "017a9802-1a4b-4bfc-b2c0-148291852026", "value": "223ddd547e48ffb7ae6574df1ae0a4bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1071b8b-3823-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691743751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743751, "uuid": "dbb8be87-dcf0-4f21-8582-d9eadb3d199d", "comment": "Malware payload (Mirai)", "value": "9d0de761833e806fe3fb1d31f2ae3b2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743751, "uuid": "a336e8d3-e266-4550-9b0e-8a6f6176e9ff", "comment": "Malware payload (Mirai)", "value": "4f6d665fa107ba9d7313ff6bf1527dddf18bcf178ae34c0e573b3afcb52d685f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743751, "uuid": "6ca6cfff-5fde-4d70-816a-5902f2d4f6f0", "comment": "Malware payload (Mirai)", "value": "3fb72ad870e95226ab5aaf7ea2f36f9aecf564b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743751, "uuid": "6263c174-24b3-48c1-a3f8-9dc02bf1bfb0", "comment": "Malware payload (Mirai)", "value": "a61ae2c71d59410d5099a32ab3747ff27317e049e1a9f7aef9c6b1bb017aadd4a93c154fad7deea98228906515acab42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743751, "uuid": "2d04897f-48e4-47a2-977e-5e4483c43124", "value": "T1E4B31845F8408727C3D327BAE78E478D3B36579467DB33116A38BEB42BC17892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743751, "uuid": "b30dc38c-85a0-4330-b610-0f2e7add4b3b", "value": "3072:MSk+U6m1qW/w86lPbiRq6AmkZrQAhPDCXFke:U6mgW/16lPXmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691743751, "uuid": "027aced3-2a1a-4385-a6dc-bf830787df3f", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691743751, "uuid": "891adb19-b122-49ec-b838-8518a01844fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743751, "uuid": "c76c01ad-ceec-43de-856b-99425cd00dce", "value": "9d0de761833e806fe3fb1d31f2ae3b2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39e36f3-37fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691726146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691726146, "uuid": "68914863-7fca-4374-bb65-db563d0efb63", "comment": "Malware payload (AgentTesla)", "value": "50e0bef8c8ea8ffab979360ed54e7890", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691726146, "uuid": "42923206-15fb-48ab-b8cf-d901b758faf9", "comment": "Malware payload (AgentTesla)", "value": "4fb0b8522760a6193d82fa7eb4cd3c750979b83c817676965279f39d4d44ee05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691726146, "uuid": "a7ba7500-3556-4ca9-a2d4-db89033f1380", "comment": "Malware payload (AgentTesla)", "value": "55a37c5c5b9af360ca2750cd8cf9fc0d007cc51f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691726146, "uuid": "89452431-6011-47b2-ad97-1c3c30525ad5", "comment": "Malware payload (AgentTesla)", "value": "3bd96aec88b47e0cdaff169cc1be4511980edcd53d8222177709fea0f5e4588d1b0fdb085255dfcc8777ce3c3cb6fac3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691726146, "uuid": "2e4fac96-3fbf-4c32-9d76-a89a1819baa1", "value": "T195050826E77B655AEF19A1E88E2F847238D6DCC0F1B5C588A7E72C0385C23114D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691726146, "uuid": "f5c39f11-382e-4cd8-af90-2144948f27c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691726146, "uuid": "e0004738-9e9a-4255-9122-6dba20f87483", "value": "24576:ejSRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOfUF5MGqkOlSFIn:GSRs6CE3jLbO9Rs6CE3jLbOfiTOlSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691726146, "uuid": "e3ad7363-49b8-46a3-9fa2-9038482018a9", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691726146, "uuid": "00f34691-9ccc-476f-b86b-580f0721ae66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691726146, "uuid": "ab8de588-87c6-444a-901d-97d70c46658e", "value": "50e0bef8c8ea8ffab979360ed54e7890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad010df-384e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691761833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761833, "uuid": "558cb36e-e41e-4630-9a9a-7ec060f75b76", "comment": "Malware payload (Amadey)", "value": "e4dd60e5719a14a3708554de70f1d18a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761833, "uuid": "d830b845-ee65-4e66-a3d1-10b2046b16e9", "comment": "Malware payload (Amadey)", "value": "50d4937c5209f877dddf1a19b28e98421f58c6c2332850b9dede53edb9fab2fa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761833, "uuid": "907837a0-f519-4163-9086-5da5cf9fa06f", "comment": "Malware payload (Amadey)", "value": "2eddab6246e47e6699735edb6e276bbf9da929c1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761833, "uuid": "7d3ffda8-bb36-495e-a6ef-dc54999beaa6", "comment": "Malware payload (Amadey)", "value": "55782be7b26c016cfd7fd59d37216a4bffee3d9dd04fe2a7a9e87db4ab2cc2bac85e0587b5e5e1ba26efa7250748f2f9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761833, "uuid": "47c9ad6c-4342-4154-86e9-0f380d267f7e", "value": "T1E8D41243F6F88462E9B52BB058F617930B36BC714C78C27A2B91694E1C726D0B57273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761833, "uuid": "6f476d54-d219-4a82-855e-2dbc3f617eaa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761833, "uuid": "0dd34726-ef5e-48da-a01e-f99d9d4caf05", "value": "12288:PMrYy90hDYtC54z/HwN36+4MYdRGOyEEjmZCwX5S4/zWv:PyFrEK+4M8RDyE+mswXMMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691761833, "uuid": "f2593f70-378d-4a3a-b4c9-0cc5279c47a5", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691761833, "uuid": "c2fddfc8-8a82-4aeb-8942-67a1fb4450e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761833, "uuid": "3ec71809-7638-4d2c-ad39-a8c9c5ad0650", "value": "50d4937c5209f877dddf1a19b28e98421f58c6c233285.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1e7770-3818-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1691738860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691738860, "uuid": "d54d5c3e-1699-4a64-9a9c-c63a8319d7a9", "comment": "Malware payload (LummaStealer)", "value": "e9c1d83119c86cc0d3ca6310a8ca58bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691738860, "uuid": "d865d554-5685-4c0c-87a8-9675a580123c", "comment": "Malware payload (LummaStealer)", "value": "51d90d0f36824178f6d6331e3fd67540fefb3414f2a22e631a91adb0e1528e7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691738860, "uuid": "b4679708-4516-4959-9fa1-6738de90debd", "comment": "Malware payload (LummaStealer)", "value": "dadde809dd0793bfdf6e3bde75850c513a9bbc05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691738860, "uuid": "38a8cacd-acb3-442e-93c2-d07c98ff73bb", "comment": "Malware payload (LummaStealer)", "value": "d555ae6934ea9ba9fcd2ebfc7eeca163e441be9926ee9525278d5583b792221b49a38a0eb24af5eb709d8d19432edea3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691738860, "uuid": "275a664d-6253-46c2-b9f1-91c1e1426c6e", "value": "T18B96DF12B6018177E4C10278E2FEEB7A1A284F37073985D3A3E43D555931DD26E3B7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691738860, "uuid": "fccce975-ef9b-4b7d-be32-6b99358d377f", "value": "4e79b99a424e7a07d13d786a61dc51eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691738860, "uuid": "973cb9a3-3bc7-4845-8edd-5840cdefe646", "value": "196608:af0ZfmRqcAOPZBqgpAt2NJEP7fxRCOdmt:acZfm5ZYMA2ETfjCEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691738860, "uuid": "4a6e528d-0805-4c12-aec5-9adcc30ec814", "value": 9323008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691738860, "uuid": "6ce72456-cf8b-4bdb-8ee5-ceda0ce9e1e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691738860, "uuid": "994550c8-ca11-4f04-814d-e69e7852d725", "value": "51d90d0f36824178f6d6331e3fd67540fefb3414f2a22e631a91adb0e1528e7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb86ccca-37e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1691717113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691717113, "uuid": "6522e4fb-6f19-4c73-95d6-f994524465b1", "comment": "Malware payload (Fabookie)", "value": "e38981158d083f3d58022cd7a338494b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691717113, "uuid": "cdf1c8b2-5c2e-4878-b998-b76fe3562734", "comment": "Malware payload (Fabookie)", "value": "51e955c9297fd841aa12fc39dc7b4dc3b7cc290a9641c2a5b343d30e52cda4b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691717113, "uuid": "5a4976dc-1235-4203-9aff-f664ea0ad4cc", "comment": "Malware payload (Fabookie)", "value": "fa0105ffb2632eb3f6bc72ffafaf40f74485371c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691717113, "uuid": "0d5e0ded-42eb-4908-a518-cfb59fd6415b", "comment": "Malware payload (Fabookie)", "value": "196963fa1d91e84af90d207137485a4279226a7db59e134a665804e4cfc589fc67772c46032a58d09b867a593dcd637f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691717113, "uuid": "1f133b13-0096-4b7d-8c9f-1b5fb18708db", "value": "T107445CD26F90B860F416CE329D3EC5E6263DFD618E59775A2218FE2F04B11E1C263B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691717113, "uuid": "84e897c2-3c03-4fed-b2da-c7bc69ce2e68", "value": "2c86f6022110f96a017da9bcdba46b29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691717113, "uuid": "8b5c4284-9058-4561-af13-6b4100970f15", "value": "3072:JJ7XOteLkXRzIdy7sbx0tIMz61Lm/X1aK3qPAgXAWjBHB:niWk9Qy7stJUp3qYgXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691717113, "uuid": "d54fe6b5-7e72-4127-88c3-46cce54fb40c", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691717113, "uuid": "54ef7bc7-cf46-4364-956d-f4c89b2f0885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691717113, "uuid": "9677e174-b468-405b-8a9b-e0fae657f802", "value": "e38981158d083f3d58022cd7a338494b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d49e3f4-3865-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691771850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771850, "uuid": "1069c780-46c5-475f-9733-2687a9c53541", "comment": "Malware payload", "value": "265d32072ced55df515b490522f7fbf2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771850, "uuid": "e4c147e0-9091-45b8-ac8d-345d2703e21d", "comment": "Malware payload", "value": "52497df2d908f438a98819ae4d5d6956dd7ae88c6f393caafd658ed30cf68c0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771850, "uuid": "51228861-a8bb-43bb-8690-324f1360ad72", "comment": "Malware payload", "value": "0468cabfd818f535135b06f1399d1fd322d32a8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771850, "uuid": "12a16509-3cbd-4cb6-acc8-6015680ba123", "comment": "Malware payload", "value": "1b8422e2776bef26e214169b7f7bf662c8f6e0a93ae4d0a37e1f868566b52adb7ed6aa11bb89e3880f44080e41c47aae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771850, "uuid": "53f799dd-3a9a-4f5d-9817-d70a5eb56e76", "value": "T18FB36DC4F687D0F7FC1211B61427E3325732D939902AEA93C37DEA36EC56661DA0A61C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771850, "uuid": "f60ecd5f-42ab-4e5d-a14d-186c63d084c2", "value": "1536:cWraQSMYPFYJRi9GeLcVh2GLsLWGExi25fXPdZUNUNzdd2SW/557:cWra/1PFYJehQkLVE4YXPXAUBPEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691771850, "uuid": "a9cf54a9-6810-4f96-97c5-a818786dfc12", "value": 112940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691771850, "uuid": "d45677c4-577e-4ead-a4f3-4818ad7f9835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771850, "uuid": "4821eb91-8e43-424f-8a1c-a90ae520131d", "value": "265d32072ced55df515b490522f7fbf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a21922-3855-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691765131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691765131, "uuid": "8e09150f-4b31-4627-bea6-1a3350caed80", "comment": "Malware payload (Amadey)", "value": "f7cfd92d45a9af7b1b6be6858851556b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691765131, "uuid": "b5c558c7-555a-40c6-8925-97d7a6da0010", "comment": "Malware payload (Amadey)", "value": "52b103c5437de3a3c0f7a00635ec3a698248dabc313c0c92e353a266dbe800e9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691765131, "uuid": "890a7a34-975f-48f5-9c6e-8e946f48a525", "comment": "Malware payload (Amadey)", "value": "1b7b81535110c09b3618663731d52c0f9d603f68", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691765131, "uuid": "c36c6e58-0338-45d9-986d-b33c462ccb8e", "comment": "Malware payload (Amadey)", "value": "489ef88af6d764c87d6785b0c6e7550d47b0d3ba06f34d1b852c5c3e56ed988bf6126beeb83b2ec9e62d5a83330a4021", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691765131, "uuid": "52090b2e-4fbd-4d7f-8406-fdd8f6ef039b", "value": "T133F41253BBE840B2C9FA67B084F606D32F36BCA44878D36B6395584A1C739D5A831737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691765131, "uuid": "b7c5bcae-11b8-4d68-b634-6482ec10ba08", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691765131, "uuid": "0e25ba4c-a3a3-4db2-8586-a49bdbec883a", "value": "12288:BMr4y90ChXlD3tIT+Ie/xys4e7ElR+vAe+rSV1TSurvbRtInfl9vPKBUenCC6:9yLXx3+T+I4As77Ely94UTSYvbRGnv6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691765131, "uuid": "ad0aab2f-3942-464e-8398-5e4200237897", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691765131, "uuid": "a2810ae6-b81b-4426-8415-f98507f2c193", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691765131, "uuid": "4a6296a3-ad58-45a9-848a-d188ef0e1536", "value": "f7cfd92d45a9af7b1b6be6858851556b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d5723c-382e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1691748319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691748319, "uuid": "9e8fde1e-7485-4465-aa98-23f3fda029f1", "comment": "Malware payload (RecordBreaker)", "value": "a716a9d3a4f96ab59a8009404f3e7874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691748319, "uuid": "237ac9d6-a71f-4840-bcfe-eef87f4eef15", "comment": "Malware payload (RecordBreaker)", "value": "556bca91bc7257d70c8fb87a96fb97d2487880f0db3dcafab67684b2e9aaa394", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691748319, "uuid": "9a760303-b42a-426f-8603-67399a8aeab6", "comment": "Malware payload (RecordBreaker)", "value": "cd8bb89f49dd31847404de6972f99fde9f282a85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691748319, "uuid": "200c05bd-e27d-4066-a601-202115d27732", "comment": "Malware payload (RecordBreaker)", "value": "631b8b0b61ab612c29ce240d795f398344fa3f644c5267f756b6f4575473a7773d4897af61a8d99a1321630cc2e16140", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691748319, "uuid": "17db459a-88ba-4242-96ee-458d4c51ec73", "value": "T11333A1D2EB8DE433DA930478337C5C26AF9B5C1324D4F4876B4E876792E45814A1E32E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691748319, "uuid": "158bf858-163a-4a24-a1b1-8142cb2ab646", "value": "8293f3c89c8bdc2a5d082fbe7d24c76c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691748319, "uuid": "3dc44734-2ce4-46a8-97b8-56b7177621ac", "value": "768:TVcCo1dt4cybqx7P9vm9Rg6+E7apmW8msk:T2t4cybq56O84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691748319, "uuid": "138e13f4-ff7e-4d72-92d6-d34fb2570b27", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691748319, "uuid": "83a34dfd-bd0c-4e78-a34b-1f8eec1e1d25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691748319, "uuid": "0b1b80a2-8158-4dda-8b68-36e079691250", "value": "a716a9d3a4f96ab59a8009404f3e7874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a81d62-381c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691740643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691740643, "uuid": "384edea2-56e6-41da-a802-38f9b2f74168", "comment": "Malware payload (Formbook)", "value": "9f780ee9c5e70f4bfba67410f74c7dfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691740643, "uuid": "ec500123-f942-4397-aab3-bb2f49e62c20", "comment": "Malware payload (Formbook)", "value": "5762d46e91e94d731bb4f1047a3d080b27be1b34d05236e8c8f24b24238545fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691740643, "uuid": "a6b75531-127c-43ac-b9fc-1ac57686e76c", "comment": "Malware payload (Formbook)", "value": "401e6b768a25b6e65528b3d648e19b57040ca5d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691740643, "uuid": "6a4d92ad-ba94-464e-bc6c-ea4b410154b4", "comment": "Malware payload (Formbook)", "value": "ea130c3794bc9e6c2dc1bfb5696b78eca0e1f4b9a4047866bc4aa5ee53a56b43ef4cb65a41921d86db3a1fe3e1393f76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691740643, "uuid": "dba53feb-83ec-4fac-b63d-2328ab117254", "value": "T101E4D060EE79DE82E54F4B78108FD70D8271485A3622C63A5AAB50C6D4877C206DF7EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691740643, "uuid": "e15e96e9-06bf-4b5b-8a77-72f3ad214b15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691740643, "uuid": "9ebfea47-9095-465a-8636-ff589fa7e436", "value": "6144:JNCzt/PdYTe6w/Fui54JPA93KAy+mCE+ymGPERcxWZBYJCGmBaKQOf26nNnL7bEj:GzYzw/FSae+0PERHUppkes8p5vLlqTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691740643, "uuid": "25cc24f2-5872-4967-a245-a4b4a0659d48", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691740643, "uuid": "701601d9-9a5e-4ed7-9eb8-22ce4cb294df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691740643, "uuid": "ba591f53-3f2a-48a4-9e9a-1b8807c8050f", "value": "10.08.2023-11.08.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2a9ab3-3839-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691753166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753166, "uuid": "7815ba28-d2e4-4713-89a8-1715a7ad51e2", "comment": "Malware payload (NetSupport)", "value": "7620db169553b3502d762fb6feeeb5a4", "object_relation": "md5", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753166, "uuid": "5ae0417d-c165-417e-8ba5-4e1f87962c3b", "comment": "Malware payload (NetSupport)", "value": "582d304b2b0409ce856b6ee845deee6ba3ecc38de6c567da37cc0e1298df1cb5", "object_relation": "sha256", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753166, "uuid": "715e5a2c-ea10-4c1e-80e2-d83abb6dc062", "comment": "Malware payload (NetSupport)", "value": "c92c11fc19a3b0cfd18dbba5f51d4444737fd9bb", "object_relation": "sha1", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753166, "uuid": "51a72231-1ecd-48ed-b4c3-dae51116d47d", "comment": "Malware payload (NetSupport)", "value": "c56aaf59889aca0badf0c8f571d6eb201571c5b5ab9c2b08d9d5fe13551920dfd0d5e75562edc059d55d368ef88073e3", "object_relation": "sha3-384", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753166, "uuid": "f250d61f-5d5b-4e09-8cfc-c78ef8aec8d7", "value": "T13FF633CEAAF27651DCEA263782706D413F3389D5950C4534B27207B988BA1BD31BB19F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753166, "uuid": "4ce58169-db12-4add-b71e-c868d80b70dc", "value": "393216:OO/pCXYiQQNg7P2eA36ie7m9bZLFqGac7dey:OlYi1Ng7P7A36pS9Npy4dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691753166, "uuid": "9f1fca14-e4b0-4a81-98e2-f0b65b69abf4", "value": 15409768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691753166, "uuid": "3d77cad9-5dbc-43db-b98b-b3c693142abc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753166, "uuid": "a08f6816-72a1-43bb-9927-94de427fbc39", "value": "SquirellApp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2820ee-37dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691713165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691713165, "uuid": "592df807-c959-4cf2-9258-949ed6d807ed", "comment": "Malware payload (NetSupport)", "value": "c4fc19bb80f07ca2c662ca889ff871b4", "object_relation": "md5", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691713165, "uuid": "46e90fa3-e3f4-4b57-a696-c756ca5764dc", "comment": "Malware payload (NetSupport)", "value": "58ac98386aee5db598d2a49eb67f4b255d38d11e4f2ffd715102da5d83706d89", "object_relation": "sha256", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691713165, "uuid": "1b41b394-9873-4f46-a7ac-86484d6c41c8", "comment": "Malware payload (NetSupport)", "value": "f880c50b83e7773739ffbe854abf92fd55ae5721", "object_relation": "sha1", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691713165, "uuid": "6913009f-37c0-47ea-bb8c-d26157ebd174", "comment": "Malware payload (NetSupport)", "value": "9e494a39a8a33e47efa60bd43c1d475eaaef1bbf80c80dc26e74d8879f1bc1d8f5c472f8371a8520559de3e1984833b8", "object_relation": "sha3-384", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691713165, "uuid": "2e310ecb-9eb5-42d7-a674-1abbec2aa337", "value": "T102B533039B219F94E413317FACD5B920FA6D8336FDA2AE2D826BCA9310D9DD5D56CC04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691713165, "uuid": "3af1170f-df58-44c9-bf62-2960a755dbde", "value": "49152:OcqtE+5PWZMB1qEzda5D/GatWTjvE/OOKncjznXkPv+A:OVtEgPdiERqpWvMOODP0n+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691713165, "uuid": "4947d45f-3d3b-42f2-a013-819aed6024d8", "value": 2458954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691713165, "uuid": "e1d04046-ad70-4a65-ad35-76e17508d69f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691713165, "uuid": "563b7cd5-03be-4fa2-8a75-ba71ac8afa92", "value": "secretion.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a369f3-3849-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691760079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760079, "uuid": "a6f83f87-7d3c-4bf3-8440-6626c444bdef", "comment": "Malware payload (RemcosRAT)", "value": "7ce48ca84dfdc400711520252fe8d076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760079, "uuid": "8379b378-992a-4fb0-a4cc-cb93190e5ceb", "comment": "Malware payload (RemcosRAT)", "value": "593cf342a669fcb1bff594bd8ce85fc112bc19d42f7fcb0932c9ac5cdf70d0d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760079, "uuid": "5daad07e-cb44-4eb3-bfc0-cf8240a48750", "comment": "Malware payload (RemcosRAT)", "value": "853c0f9dd4ef621170f7a8bc96a8e67aaaf0b30a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760079, "uuid": "625a43ab-4d30-478d-8be1-bf6a42661910", "comment": "Malware payload (RemcosRAT)", "value": "806d81ad6af9897207d99887345edf13a3d1abc8266ee451505c45b89092c108007d540f990bc0f7da709bb99f9e32aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760079, "uuid": "11861d6e-3430-4ec9-a0c8-16b0b251b8b3", "value": "T143D4230012D889DFEEA765B6B67B92098FABD41329D4C74F0BA1051D7D71902D32E3EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760079, "uuid": "c61d72c5-1af1-4e43-bb2c-9758cbea72a1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760079, "uuid": "4d0af6a6-b10a-4a26-9dc5-e824dcde756c", "value": "12288:/YzT2TQSEjWleV1407o3r1UhdBjAi3eetxtHoaCqsyP24Sg9rdyyX/vjw:/Yz7Slm1i3GdBkE5tfnCpyq+dyyX/vjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691760079, "uuid": "8d9a1eb2-7385-4cd3-bb98-9ddf9972d391", "value": 610823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691760079, "uuid": "729135be-d81a-47f3-b6e9-7ed04171d7a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760079, "uuid": "f40c74e4-0e10-4f3a-90e9-de2e82bc583a", "value": "SEPA_2023-08-11 000538766211092.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b67ae6f-380b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691733138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733138, "uuid": "540e54ba-714b-4f07-9d4c-359ebb62f8f0", "comment": "Malware payload", "value": "05a09ae2eac1734ca19ce2827aae0fd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733138, "uuid": "310a371c-8d70-43da-82c4-192c62a84a53", "comment": "Malware payload", "value": "597545bb4c9d31c409a8d7990e7d9e90e55c06a7c7e16dfa7001bdef62797e43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733138, "uuid": "bfbd4f50-8949-4865-b44d-2b5ac7c4936c", "comment": "Malware payload", "value": "88ad451315344759c7b69193aec44459c4425772", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733138, "uuid": "a9a2ae90-c640-47cd-a2a7-6756cf521af5", "comment": "Malware payload", "value": "90bd6a3f62a136680b4fb46755720590fa1f7f655ee33e20a167a58af83aeb168dc857d786fa9cde17aa60f9fc466e81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733138, "uuid": "e2bf1002-67f0-4759-9cc9-a37d0ff55564", "value": "T1CFC4231503ABB6A8F1E2553F985E5B503210B243C36AD6EF6985782D0EB2F0C77D1EE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733138, "uuid": "ede843c4-72c4-4070-872c-649f9657cbef", "value": "12288:a45JCRX6Xzp3V6xJowhhZO9kV3FyGhwPgIrQitY3d0pxTCMwJ:agJCCzp3V6xJowh69kV1yGhevrQiyd4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691733138, "uuid": "b498bb1c-9f13-42e8-9dc2-d89e263f447a", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691733138, "uuid": "e8b7ab59-9906-4bb1-b977-ae0e8d2ca4bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733138, "uuid": "6da778e5-08e8-4492-86e2-85e484f7afb8", "value": "ED 4666665600 ED 4565788888700.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6fae14-3825-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1691744599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744599, "uuid": "31576041-1c8e-4d72-805d-3229294da524", "comment": "Malware payload (AsyncRAT)", "value": "c6e5045b7f5201f86fa4e655781cc97b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744599, "uuid": "de2b4620-2021-4058-9d37-a83cd87a56cc", "comment": "Malware payload (AsyncRAT)", "value": "5ae30394f70c8269f576374a2adb32de3b400e87b00786d538246dd7b9a7f548", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744599, "uuid": "e57694ca-ce2d-4a63-9b9c-1f1d38d0144f", "comment": "Malware payload (AsyncRAT)", "value": "4e3e9125d8881e632a2384d6c57fc27f8bcbddcc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744599, "uuid": "bed0fa4a-9241-4716-9ba5-8e83c770667f", "comment": "Malware payload (AsyncRAT)", "value": "b7808660ef7f7e8f0414595e5513d63278410ec955145e64ed3517b18a346f73a3f481df4f1427fdc38e7295f4d65cb6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744599, "uuid": "bef3efb1-9f5c-4f92-a9e4-9df4ce909fc5", "value": "T116A6335063C6D076D47242355416B538B8B5B430BB789C6E9FC00EAFFB75E90AA32B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744599, "uuid": "6a4b2a43-2f96-4b25-a30e-50a22baec90e", "value": "027ea80e8125c6dda271246922d4c3b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744599, "uuid": "7f3d35ee-61d3-4427-9a84-6230f788268e", "value": "196608:JBP70XvXdb5e0hnHTW3GwhXscv84MzaVpXeEWgJfbC1xllS7o/riN:JBudb5eaHT4GYrvbMG6K+jQ4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691744599, "uuid": "6818967b-b5dd-49bb-a624-0ea5abd0daf1", "value": 10025262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691744599, "uuid": "274dee40-36bf-422a-9a36-5f43abf71d7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744599, "uuid": "dd82ab08-51d8-45e5-a98d-d238e67e3b7b", "value": "Venom5-HVNC-Rat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02140cad-3832-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1691749792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749792, "uuid": "7c9576ea-8098-4d3f-82c2-ccd88d18ac88", "comment": "Malware payload (ArkeiStealer)", "value": "e67f6f38d2df9860e479110c20e65480", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749792, "uuid": "9fae07b0-2c12-4639-9ce9-a10b35fb681f", "comment": "Malware payload (ArkeiStealer)", "value": "5b4b8343ff56fd9ca6d55567e49a3bf1f31d542dbe620bdeb27f7e7ce792c656", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749792, "uuid": "55c724e8-6ff7-4366-a565-098af14fcdb0", "comment": "Malware payload (ArkeiStealer)", "value": "0b51b1f2c8e25516bddc9e7985a49f3f21049176", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749792, "uuid": "a265975d-d6b6-49d6-bdc6-9b056dce94cb", "comment": "Malware payload (ArkeiStealer)", "value": "406a7f1247de72a43e1eaa08396c2d722ab827b9c91b283f37549bff0739515a58ee1b3fea63599f022b8dc3b1b92a28", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749792, "uuid": "30258b9a-4fc8-44ac-980b-e95c4168ac1e", "value": "T103359D27B2E0CA34F6A801719B3FC9A13B55E8E02715E2DFAF9610647E911F017F1A9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749792, "uuid": "87ce46a0-3890-4a63-9557-e24c26c30f16", "value": "2851f76e885446c55a9b6a41d8745a10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749792, "uuid": "7983e403-2acb-48b2-8b35-af12ebce0b9b", "value": "24576:txcqRQGvPD4jYQbYYQOOByy/dlAEuTFh/8j0U6Y:HjPD8dhO//neFF8j0U6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691749792, "uuid": "6c1f8c05-4b47-42b6-b7bc-4d396a9207cc", "value": 1150108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691749792, "uuid": "f8c07a15-82d3-42e4-89d7-b35368ae91f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749792, "uuid": "02b6894e-8bb7-4b4f-bda1-bf51d2583d83", "value": "SecuriteInfo.com.Trojan.PWS.Steam.36399.19509.15804", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb9bda4-384a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691760412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760412, "uuid": "ab39ff66-8fe5-4bc8-81b2-134ad519ff46", "comment": "Malware payload (AgentTesla)", "value": "68f870b03e666104081bb119115b6c93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760412, "uuid": "f606b3cc-de12-4696-9b49-54674bed4043", "comment": "Malware payload (AgentTesla)", "value": "5bef9c5e982317507abec039014606f799a758bc24d922eb5a89e42a611e7c43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760412, "uuid": "139aacce-a5f4-42fd-934e-bfef038b34a2", "comment": "Malware payload (AgentTesla)", "value": "8ec65720c93563e7df3c3d22c875979a3cc45ff2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760412, "uuid": "ff6d7d38-ef2a-4b6b-9fc6-21998b259e67", "comment": "Malware payload (AgentTesla)", "value": "f235dd61334e0dc51415056b756500bebfa837a469c71cbba862b5f3a2cc1c1f1d9661e47507086e634580475b941aa7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760412, "uuid": "b60cd56a-3547-4adf-8458-b6f806024301", "value": "T141F3087A624D8B12C26F5CBED06E314D97729D6BA702E38ED88C77F409F27815912273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760412, "uuid": "ab0cbc5b-95cc-4765-9174-7ca2c39fcf7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760412, "uuid": "b66a91fc-0153-405a-a3c9-ef5bb3d16567", "value": "1536:x+OF8hB5ZB+h53TiTt3AdzM6FDdB3MTJY06MtfJ2cUMRCc032onnfCI3SnqjwEhq:x+T5YEAVBfpwJY+fKPc0XnfiCcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691760412, "uuid": "89d9ae94-ad77-4fef-b205-cbcedc91d2ad", "value": 166400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691760412, "uuid": "f93f8232-479a-4acb-9e7d-603e24b81a8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760412, "uuid": "301c5a2e-8776-45f9-8a1c-c49dde66ca66", "value": "IMG_WA202377567400000000000000238958372424.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb98d0a-3867-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691772632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691772632, "uuid": "a4c3f170-ccfb-4216-862b-72b0a580837b", "comment": "Malware payload (RedLineStealer)", "value": "7df4894b65510d6efa281d86fafc7aec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691772632, "uuid": "8bad245b-e274-4c99-bf36-6cf9838f042c", "comment": "Malware payload (RedLineStealer)", "value": "5c27f9b6159562edd37f78eb1183bfbe32d144b7e3d727ac16a86cfbee0364e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691772632, "uuid": "1b182a9a-5cb3-4e54-8d2b-7d3dcdcb5115", "comment": "Malware payload (RedLineStealer)", "value": "2ccf3d17d5ca764b1950ccc61562f936392ad54b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691772632, "uuid": "cb9d5f01-86da-4b87-917f-88abd03ca667", "comment": "Malware payload (RedLineStealer)", "value": "e33288c937640ed50d1f7cf274c401acdcb3a1e7972c6c3547384aa29c625b30575e1d3ea6c726ab2d0b27fdd742c3c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691772632, "uuid": "a17fb3ea-fc67-45cb-954b-98026f5b1fd6", "value": "T1D4D41212BAE58036D9F527B098FB03971B327CB15CB8936B2745584B1D72AD8E93073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691772632, "uuid": "4cdb1cd1-7a2c-4c95-925b-3b8b09e2e702", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691772632, "uuid": "7ac4f418-b7c1-4110-b36f-2f1464db7857", "value": "12288:dMrUy90Q7i8pWByZTc2+hWqUMTJqngZJOFICH9lkN/kB9Y6x/L2:NyHg6c2hqJqngZaICH/5/L2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691772632, "uuid": "1fb0ac97-01d0-4cf8-866a-71daf8d302d2", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691772632, "uuid": "c008f365-a881-4f80-b457-3e8f78830770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691772632, "uuid": "09753aa1-69d3-407e-9010-4b358c467ca2", "value": "7df4894b65510d6efa281d86fafc7aec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06157317-384e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691761825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761825, "uuid": "522bd92b-a392-4b20-9373-df2d3c66c348", "comment": "Malware payload (RedLineStealer)", "value": "5312c7da0ee2466b1d71ed3b203f00a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761825, "uuid": "413040f8-a6b4-43ee-b737-4fb03f3847d6", "comment": "Malware payload (RedLineStealer)", "value": "5cbf8eef93e4fb2f74fd28e9cfbf31e9b719b27e53d305d02bbb15c92cc774e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761825, "uuid": "9231732a-0857-4cee-b6dd-864fa40520b3", "comment": "Malware payload (RedLineStealer)", "value": "9bd3fdb42f1cdec5dde09157ca2fe6920775d98f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761825, "uuid": "8eaa392b-6c0f-49a0-8959-051bbe93b9b7", "comment": "Malware payload (RedLineStealer)", "value": "185ec01621b4dad5ba6a21f8e0552b139d77bcf9791e51f464a48c06fa501bbc109c286b8a4177d4ff99090be589a84b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761825, "uuid": "eb9415ab-647d-4dbb-81eb-5c3507098b47", "value": "T1DCD40243A6E95073DEB41B7048FA16830F35BCA15834873B7B9AAD1E5C72690E83573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761825, "uuid": "f91a908a-43d3-40e2-ae6e-26df78e229e1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761825, "uuid": "e49a0481-2404-4ad9-a13b-74f4a1d6771e", "value": "12288:4Mr0y901mq1pMVwH8KV/e7xVYKRfEXvp70XZB2JhEAGreiMi:cygwwcOG7xiK1ERIKJ/ix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691761825, "uuid": "6b865895-30ec-4161-b8fb-cab4bdd77628", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691761825, "uuid": "5c2773d8-16a3-4d5d-a14a-2d4feb387b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761825, "uuid": "66354e62-468e-483f-b03b-539cfad53738", "value": "5cbf8eef93e4fb2f74fd28e9cfbf31e9b719b27e53d30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3b265c-389b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691795279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691795279, "uuid": "473de165-ba2a-4480-9ff1-4bcdc909ac63", "comment": "Malware payload", "value": "98b259fdde37a53af4551c126eb5ca2a", "object_relation": "md5", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691795279, "uuid": "11eaf100-e124-44ee-a6b0-e007659b3088", "comment": "Malware payload", "value": "5eaa6aea97ddacbf3bead2114748b652c2f624be0b936df6ae7f6cb315056bf2", "object_relation": "sha256", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691795279, "uuid": "6cc56868-bdf1-4b51-9ebc-e1fa165fbd13", "comment": "Malware payload", "value": "94f048ebbfa1e61cab3e50297ba69d41de70d6fd", "object_relation": "sha1", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691795279, "uuid": "07079d5e-0c31-44b1-a04b-d3a472133f61", "comment": "Malware payload", "value": "176d9445a236cbb5dc75720c17f1c78735cb58363c0a3d0c620cbc8cbfa06596abb7d1156e1312bdacd07af92e9482ec", "object_relation": "sha3-384", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691795279, "uuid": "4056e980-c043-47cc-82bb-440ec08957ae", "value": "T1670633C1D5B1C6DFB91CB32894FB8E6415E2A0150780599C6D6E6D0FE3A887A33B378D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691795279, "uuid": "b113ab85-a620-4829-823c-fb6ac3bba21f", "value": "49152:U1tDQQGdgw548HUWCYR/IgE5O9V7ORSxElm97LN4ywMd8:qxGGw54AUWZRgSViRSxElmlLiXMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691795279, "uuid": "80dcb289-c4b5-484f-83c9-2b70895abe63", "value": 3825401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691795279, "uuid": "e30f2bdb-a9b5-4e7f-8afc-b6d17b97e51a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691795279, "uuid": "38d22556-072d-470e-8160-f6d2ba6ef10b", "value": "Bermuda-Traffic-Code-Handbook.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45a35e2-384b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691760802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760802, "uuid": "a4919e84-a62e-4b0d-a74e-b37f188aa0af", "comment": "Malware payload", "value": "ce673739385293ad25cc87550d7dcf12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760802, "uuid": "0260564f-3db4-44f7-8c88-d649211b7c72", "comment": "Malware payload", "value": "607f7696ce4d5cec40e9014e259f562d3b31edc24b188fbe01ab9eaf31b59c73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760802, "uuid": "029a0f4e-4dcb-4b76-9591-f74d7f7ffaf5", "comment": "Malware payload", "value": "b61a7c0ad1e3dbb0eec8cd8788b976cafed97a3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760802, "uuid": "b5d1d28c-aa23-46f5-9151-a138fe19d85b", "comment": "Malware payload", "value": "8a894b058a64307c458262866c8d5f6144442dcf3a3fc2f543fdc1d49ed2b404cc4f1f4d02f7d54fd5e2bd3f44585f45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760802, "uuid": "308de6ae-a0cd-4c50-b846-022a779c3803", "value": "T1FE04D617BA5B8AF1C358273ECEDBC1040771E581BA93DA5AF98E13EA48433B69D04747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760802, "uuid": "7ceebe6e-230a-4116-984e-33879d663a55", "value": "3072:WkRGDzs9TgzZn1J1GiZS9zSAAfhCfqbi28FtRXcWxyf9leBhb:Wo0s9Q13GNPeCfqbi2ytRXcWx+lez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691760802, "uuid": "48060b1f-f02e-491d-8391-563ed85f011c", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691760802, "uuid": "2a0497c2-2cdd-41bd-8e16-4f8286b62edd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760802, "uuid": "97c2c9ac-b65f-4bc5-bde9-473ad63ae4b0", "value": "SecuriteInfo.com.Win64.DropperX-gen.17450.17188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd57a32-37f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1691723235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723235, "uuid": "44a72953-0ba5-4cae-8b44-1e51af0eb4a9", "comment": "Malware payload (Stop)", "value": "70e9fd1a3ea59522819baebcdcc14676", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723235, "uuid": "4db6f677-2a5d-4431-80c4-eaa0b6c7df27", "comment": "Malware payload (Stop)", "value": "611f679cc10f8ed05846a59c184c334363d770583f4e0e806bac21e51dbfb853", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723235, "uuid": "ece03da0-0371-42b9-83c4-32eaabb4433b", "comment": "Malware payload (Stop)", "value": "78723617b7d40a48315adf95e5fc39550e0cc5d7", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723235, "uuid": "6463fa53-d4f7-423d-900a-2aa7b20860e9", "comment": "Malware payload (Stop)", "value": "02ac8880fadcd01ae81a50a9b472cc49d6de2db20b724a528da1bf8639b62f82de3d6ab57b7b4c37a38d9395685d1ef6", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723235, "uuid": "5f038c62-be0c-4071-88e2-8c457a6af780", "value": "T1AB45AE02BB819171E5D341BA0DFE977E883AA9A0933A95C3D7E91C568E306D0673F3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723235, "uuid": "c3e262c8-1302-4943-be3c-8004f09991fc", "value": "24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/RRPOO8eJSUq7:F0dwAYZt6C31WeTJRPOheAUq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691723235, "uuid": "bbb7e2c6-4165-4586-a713-4c53d2540a60", "value": 1273856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691723235, "uuid": "842c89d1-022e-4d64-b18b-fcfb1dd52514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723235, "uuid": "ba36daf5-eba5-4c66-bbe8-f2370e260e9d", "value": "2023-08-10_70e9fd1a3ea59522819baebcdcc14676_stop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fc70f8-3858-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1691766445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691766445, "uuid": "0c31d786-8408-40c3-ad98-84dd1118f7fc", "comment": "Malware payload (AsyncRAT)", "value": "230cc963bf4ec456800d4c97bb9ed75f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691766445, "uuid": "fb98c432-4f73-442e-b526-dbdbf3de5486", "comment": "Malware payload (AsyncRAT)", "value": "61be8cdec38d60d5a8a64fd0f891656f0410825d7c1181d7f40eb6aaf56d3521", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691766445, "uuid": "b9dd0dc1-e1b9-4b56-ba2e-4187d893cb66", "comment": "Malware payload (AsyncRAT)", "value": "7cf46eaea8f922ad24f6ec70b4f8dd2024657329", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691766445, "uuid": "49dbc3b7-10eb-4b06-991b-1228c800e81d", "comment": "Malware payload (AsyncRAT)", "value": "ddaace5b2fe37c65026f0d1cafd27c04c934a0cf3cbd524fa44907be370794cc55caac7a2b5189368d051b452d0e8490", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691766445, "uuid": "8c3e64ba-09df-48e2-a3e0-2557ee800862", "value": "T110236C4037988136F2BD9BB5A8F292458679D25B1D03CA496CC815EA2B13FC696036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691766445, "uuid": "681d2c42-c020-4636-9ba5-3899a877a2a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691766445, "uuid": "469ceaf6-8a79-436c-b21d-19b3a27e2ac0", "value": "768:Eq+s3pUtDILNCCa+DiPsMmaCVi/G8YbNgeiMRDz1+KCfvEgK/JDZVc6KN:Eq+AGtQOWZzzbaXAoPnkJDZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691766445, "uuid": "856e1a74-e56e-49d6-91d4-16fcf85b8081", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691766445, "uuid": "c1673174-27ca-4415-bfbf-a4eb377f6722", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691766445, "uuid": "62f0fc22-9840-4e6b-b2d8-b910def10101", "value": "bOPj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413703ad-387e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691782540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691782540, "uuid": "7e4b5e84-634d-4ef6-a2ee-fbe8b7087b52", "comment": "Malware payload (Amadey)", "value": "0085548581607e3e51bcdead15ecccd7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691782540, "uuid": "ec635047-1927-4a5d-b735-e09952176ceb", "comment": "Malware payload (Amadey)", "value": "632ce516ac99df30f7c09d70c070c45b7d82fbee77aa59a118fb9f0dec0f1221", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691782540, "uuid": "86b648d0-6f24-4020-8f86-cb2fba797708", "comment": "Malware payload (Amadey)", "value": "91d13c18a8ea4a02ca96e4f640bde89712b32a01", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691782540, "uuid": "15c3c44f-eb98-492e-aaab-bb84b5bdd0e4", "comment": "Malware payload (Amadey)", "value": "fb2c4bc0c4358dac8a934efbb2d64ae28934eb640876d047ebe0558af49fd0b565da535f0ad49fc2558cf01bf6963b79", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691782540, "uuid": "fca902c2-7905-48c5-b2f9-c30e6f6edb77", "value": "T123D41202A6E99023DDF52B7058F207930B34BC656C786B5F3256785E4CB2AD4B87633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691782540, "uuid": "0fff6576-efa7-4d7c-9d8f-44326d7ffe5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691782540, "uuid": "8eafe50f-cb9a-4b3c-94e5-7c853901f36e", "value": "12288:iMrLy905Bli9zlwhFrTFUggBXVm8KS/e74bGKRfEX/p7GgTcIdLf40rwm1T:Fya2y9TFUdJG746K1EhDTciU0rHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691782540, "uuid": "6c9cf6ea-7ac3-4159-9828-1e0ff72a373b", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691782540, "uuid": "291c7f7c-148c-4083-aca6-5550ef86b190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691782540, "uuid": "23071fe9-d46c-453c-a27b-16a8f71444f7", "value": "632ce516ac99df30f7c09d70c070c45b7d82fbee77aa5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8b7ec5-381b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691740010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691740010, "uuid": "8b1dafce-4eab-436b-8b9f-03071db93912", "comment": "Malware payload (AgentTesla)", "value": "a0c7a3f0dd173118261bb21f77428fa1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691740010, "uuid": "ed491a8d-b00e-43ef-a66a-5f20a1143d65", "comment": "Malware payload (AgentTesla)", "value": "64fffa3d75b859fad070c71975904f724e3c5f84bf049b6faa1991fa7db6a457", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691740010, "uuid": "651e975b-968f-4755-a668-e492123b6212", "comment": "Malware payload (AgentTesla)", "value": "e9e6b1cb2a194a9965b0ee18220a6cb8a37ceec1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691740010, "uuid": "8ba097a0-794d-4fd2-aa3b-a18d83bc93a9", "comment": "Malware payload (AgentTesla)", "value": "278826263017016f9ed058eccbf20644ebaa58b89ce16ada5cb198a0737543e707c649321338c03942af4bc86e8b9e54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691740010, "uuid": "c001ee59-d83c-433e-bd4f-4531a9c48b7d", "value": "T1F9150725E77B254AEF29A1F85E2F807279D6DCC0F1B1C588A7E7280385C23514E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691740010, "uuid": "8580fd08-f152-4129-bc1c-f6b36dfcd59e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691740010, "uuid": "7a3a0093-a059-4b52-a1aa-d7ef32b16808", "value": "24576:hwbRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOwUFIPDIDvRFNwQ0:hgRs6CE3jLbO9Rs6CE3jLbOwDSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691740010, "uuid": "8adbc1b7-323f-48a4-896f-5ea64cc9cb87", "value": 928256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691740010, "uuid": "830c9382-7f08-4f43-821b-2cd7da56f678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691740010, "uuid": "d2a1841f-0ee3-4b8b-925d-931fa8880237", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265dcbd4-388a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691787649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691787649, "uuid": "e061f2a7-b1af-4823-9da7-bbd82c4cc65f", "comment": "Malware payload (Amadey)", "value": "c5cec68e6714280774ccfad13d1dce5d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691787649, "uuid": "c16ab108-cfc7-4faa-bc85-c9be9860876a", "comment": "Malware payload (Amadey)", "value": "66597d116b2deed716780259078ad9224ac7d7df411b416bf11827e907a0c144", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691787649, "uuid": "dff828e8-8c33-4b26-95e6-9f31a8d9b377", "comment": "Malware payload (Amadey)", "value": "2def6bf83226e833cfd7ad9c872a4ddc2c4879a9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691787649, "uuid": "33bef971-ff78-4471-989e-0af41a5df778", "comment": "Malware payload (Amadey)", "value": "1f6b690f2a37b0318ede259fddf7b7e8f6d59cb968486e5c4514e9f772c6ae732282f94d0f556f5c1bbd63fa4c24639d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691787649, "uuid": "1625fa88-929b-4ad5-bc53-c37c112e0a93", "value": "T1C1052259BAE88432E4B467B009F703E71F36BC515E3493AB375668462CB22C4BC7572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691787649, "uuid": "3b02e4c0-a3ef-4939-913d-6af253ed8757", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691787649, "uuid": "09161bbd-521c-442c-8c3c-d74dae3b094c", "value": "12288:JMrMy905bXnTxIDi2/OfrztENZwJ+4mHM4g4r9shwtFYGHvEaAfTVUFQvwU:ByCLIj/Oo8+XM41ru2aGPL0Usx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691787649, "uuid": "2231a92c-8150-4ce2-8a33-503a2f797b9f", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691787649, "uuid": "b96f84bc-2ce1-40ce-b94c-c11e784f4aa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691787649, "uuid": "af934b08-f04e-46b5-bcb9-efaf6557c6c9", "value": "c5cec68e6714280774ccfad13d1dce5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312be132-37f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1691723243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723243, "uuid": "55512a32-0aa4-4c89-b67c-7178a3c2469e", "comment": "Malware payload (Stop)", "value": "c802be969cae2ccea3dd695bfb189853", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723243, "uuid": "b10e6680-7558-4065-b03e-72fba226472b", "comment": "Malware payload (Stop)", "value": "6710fdc74a03a3a89dda4a3e29c6cfd1be93bf8a76a53214409f4ef972d3b5bf", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723243, "uuid": "7e0e2811-afb0-4d03-bf00-d6553cedc008", "comment": "Malware payload (Stop)", "value": "e9a3001dc1848a92f576068179b8e4d7602c6be5", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723243, "uuid": "e4bfc8ca-3c8a-4c83-af3e-67e2d5aca3f2", "comment": "Malware payload (Stop)", "value": "580075bdba136e60749b1e5f74ec401b426ef31b509e665b365a7c982e470ef3d1a9b5f3084f28f06a4ac15a271df767", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723243, "uuid": "f63b7795-2cf5-4c87-853b-0739589dbef1", "value": "T1D445AE02BB819171E5D341BA0DFE977E883AA9A0933A95C3D7E91C568E306D0673F3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723243, "uuid": "516c0fbe-153b-49d2-bf0b-a8efcbea7c7b", "value": "24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/RRPOO8YW9HUq7:F0dwAYZt6C31WeTJRPOhYuUq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691723243, "uuid": "3864d98d-8f98-4932-8ca6-d5a2bf8d14d5", "value": 1273856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691723243, "uuid": "bfeadf3f-6dd1-495d-a970-8f1d1d4e2018", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723243, "uuid": "5004e51c-b5df-49cc-b6df-d1293eab3b5d", "value": "2023-08-10_c802be969cae2ccea3dd695bfb189853_stop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b05a150-3868-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691773242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691773242, "uuid": "ec222e47-b904-47ec-bfc7-4a53b069c7ae", "comment": "Malware payload (Amadey)", "value": "d002ab3c11695f49c63cfe9a3bfa6843", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691773242, "uuid": "97428539-20c0-4ecd-a286-b6633ee6074a", "comment": "Malware payload (Amadey)", "value": "674d891a3f2b0084679ee4d43d0060bddde203c952bc2ab73e3b22dc9e98be74", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691773242, "uuid": "eb1bee36-09b0-4b55-8c68-1a765a6ba430", "comment": "Malware payload (Amadey)", "value": "6fbaba5d0e4daf10bf8fa8be8c1243f46ad475b7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691773242, "uuid": "50bf420c-4a9d-46f3-a558-0790333afbea", "comment": "Malware payload (Amadey)", "value": "f0d5e3e1ab58e1f19723deec840bbcaa1af934552a766e41adfd1567506ba7b05b11907fd2f58b25b567611a69982c71", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691773242, "uuid": "fbc0c8f0-0e23-4915-9b1d-e264a21d7bf2", "value": "T1236439417952C072D960A1721AB5BFF2C59D68249BB049DB7BC00F76DB212E77A30F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691773242, "uuid": "3f7b6aa2-6a26-4e7c-a43e-da7cddc13fd4", "value": "44e769941d2c6ad88bf42ac4adb36135", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691773242, "uuid": "7e41e73c-f5ba-4eb4-94a9-d6537ec87cfb", "value": "6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691773242, "uuid": "1729eec1-6ff4-457f-9caa-93ac97834284", "value": 321108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691773242, "uuid": "2bdc1da9-88b7-4c0e-9715-9cd1658209a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691773242, "uuid": "f17fbfd5-e732-4860-92b9-39a24ea5ea79", "value": "d002ab3c11695f49c63cfe9a3bfa6843.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1f02e6-384a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691760171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760171, "uuid": "ccbb67ae-4798-4329-b2c1-76cc41e102fb", "comment": "Malware payload (Amadey)", "value": "5bc0153d2973241b72a38c51a2f72116", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760171, "uuid": "6482b12a-3a50-4df7-8f19-266b74f30517", "comment": "Malware payload (Amadey)", "value": "68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760171, "uuid": "476befd4-e9f3-41b3-893f-09cd13f43b6b", "comment": "Malware payload (Amadey)", "value": "cd9c689663557452631d9f8ff609208b01884a32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760171, "uuid": "0d27cbbc-4214-4b8f-a2c3-a4c2caf7d3c8", "comment": "Malware payload (Amadey)", "value": "e589e90d0d92f6c3c6cacc74146f432ebf3da2596d600c1669937710b15e4b604522dd681ddc4f1b36220e752121622b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760171, "uuid": "4bb38e67-2e78-42f9-b2de-9ad640e017cf", "value": "T1B2935B1030D2C071D97E55351878EAB68B7DB914CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760171, "uuid": "3c66450e-bff0-4cc1-a058-4e7c09c871b8", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760171, "uuid": "0bd010be-a338-4522-9e33-7121391da291", "value": "1536:5o4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU0iaB89p:5oUCWbBNpplToUs1uNhj25LJUTaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691760171, "uuid": "92903096-0b3b-451c-b401-75667727a3f0", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691760171, "uuid": "43274b20-f62e-425e-ae2b-c73202826946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760171, "uuid": "73fcbbee-4d3f-45d4-9185-7b832d3fb2cc", "value": "5bc0153d2973241b72a38c51a2f72116", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fcec60-384b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691760803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760803, "uuid": "6cb10d20-6bb3-4c3f-aeae-bbc756bbaea1", "comment": "Malware payload", "value": "f587d2c106a3a96b75d4e435c0aa5b1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760803, "uuid": "75e6338c-0fb7-400b-b1e6-44d60303d3c2", "comment": "Malware payload", "value": "6967908608491cddb0fe97a2c550f204d61e32142556d78aa9ad4c24fd6ae376", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760803, "uuid": "685207d2-70fc-4df0-91d4-e573f289b864", "comment": "Malware payload", "value": "b1e070d441c63748f9a791f39c9a5a60cf05e17e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760803, "uuid": "97fda7e7-80aa-47cc-885b-ba73df09da64", "comment": "Malware payload", "value": "1dccdb147f6a926acf7b589a8b066175f4ceb8d51f31ed68db642d38295c2e8bde21a22a3ecc4175949a015044d09ad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760803, "uuid": "e7ed6dd2-15d0-423e-81ba-5c9ecc53b748", "value": "T12C04D723B60FA5F2C3893BF6C5DB510C0770E68172A3D61A798F53E958433BAAD25607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760803, "uuid": "ed6558ae-1e80-4d8c-a13e-3d46da09f969", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760803, "uuid": "c46fbb88-0e68-482e-915e-9c8ddddae653", "value": "3072:24W4CEiTa8AvqrsOLpkzNxyMk3jQjNqbJKhZC:I42Ta8AvqrjLQyx3U5qbJKhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691760803, "uuid": "fb0a7aad-ae11-4b0b-8163-c5eccc2babb5", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691760803, "uuid": "e8a32ddd-2e35-4209-9f3e-0c00e22e229d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760803, "uuid": "19d78609-ba2a-4f74-8e5a-a3af93169505", "value": "SecuriteInfo.com.Win32.DropperX-gen.10510.20091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c853866d-3853-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StormKitty)", "timestamp": 1691764298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691764298, "uuid": "59213260-0abb-4101-a31c-cff5baf075b3", "comment": "Malware payload (StormKitty)", "value": "fe7a215f58c846f671142227e0a71061", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691764298, "uuid": "caa2fdf3-e6ab-409f-a426-f022ab065d4c", "comment": "Malware payload (StormKitty)", "value": "69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691764298, "uuid": "db43801f-5a75-4fc5-a2ac-e05e6c11edf1", "comment": "Malware payload (StormKitty)", "value": "f40c456ce9f674ee93d3ef691c1b3aec0c53156b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691764298, "uuid": "a5c98c8f-d689-4a3e-ba3f-c3da11b8e8b9", "comment": "Malware payload (StormKitty)", "value": "79c3ada937a5001221179b66ca3bb0361058d0542d2983ebdb9aedad3caa6ea60345fef10c85cf6cdbc91aa75423ec3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691764298, "uuid": "6fd28382-6830-471e-a48d-041a47511a4b", "value": "T10B473304A9ACD028B977F7375EF8143366853060F5A8C99B9FBCEDC29B4E0092D7645E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691764298, "uuid": "3cd648fa-68a8-490c-97c1-7d1aadeea134", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691764298, "uuid": "a16b6e52-9e71-4a82-88e1-5e0846509808", "value": "393216:VT4ER8LcdmjoDuUKQhgL9bH3x0PmFhpbgab/bKh17KfxRu7i4Kw5jnS01oufNTda:VT4ER0pjoNvhcX6u1blb/bEmZRGi4Lb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691764298, "uuid": "73946b66-79fb-4251-8869-3ea163b19971", "value": 25121280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691764298, "uuid": "7a100361-8741-4746-ab1e-c295d7ebc577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691764298, "uuid": "a6a849a2-4756-4fcf-aaf7-a79325321877", "value": "fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb7371d-3854-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691764413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691764413, "uuid": "ea17d415-0808-4195-a7cc-c60b116333a1", "comment": "Malware payload", "value": "efdd576c2222fc15deda23856b0fd2d4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691764413, "uuid": "fae94a0c-b452-4188-82fd-e5d71cf18681", "comment": "Malware payload", "value": "6b4e610d13f3b3bb9fea6236cecd56e85ff3b9d0c9ff1d3aca5f8137dda19830", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691764413, "uuid": "561035ba-79d7-425a-b807-1874e81f61e0", "comment": "Malware payload", "value": "ff32fac3eef79b7919ad4d82922fb61bbb423421", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691764413, "uuid": "2d8db67e-8b40-4044-849c-89a7f3de764a", "comment": "Malware payload", "value": "d7dcc0f6af7bc5ed5a8d261850f3ec80de5cc695e62cc73a23161fb9d2e1b887d5d8adc4cb85a829325ebe8625b2d6fe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691764413, "uuid": "d82e4b1e-8b95-4ad3-a860-07d3acbb32d3", "value": "T144648D01F184C432E16A38705620DA724DADB8311B6F999FE7C94CBA9F34BC29724B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691764413, "uuid": "d77126b9-6b9a-460a-a387-89f33e8c5df3", "value": "032b5e3a4b10d75752624e5eb0d27310", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691764413, "uuid": "a913e7d7-d5d4-48aa-a439-ae5265121ac6", "value": "6144:fxnmIZZZPbJbu0p4KhFhFnAtZcj0MLMOSJfVfol:fxmI35Jbue4KhHI+wzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691764413, "uuid": "5bc23536-dfdb-4315-a8b5-fb0a384b7543", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691764413, "uuid": "96bb9078-2b6c-4d44-be36-fa340bff4dce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691764413, "uuid": "6e593be5-6ce1-46e3-bb90-2fde373fae3c", "value": "SecuriteInfo.com.Win32.PWSX-gen.18278.1124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2427f6f7-3842-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691756722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691756722, "uuid": "6ca8d4c9-26f4-428d-8599-a43159bf6b19", "comment": "Malware payload (RedLineStealer)", "value": "81074cd5f110722eaec76d66d7824899", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691756722, "uuid": "060d8c27-3c30-4345-841d-c70cd5173f3b", "comment": "Malware payload (RedLineStealer)", "value": "6bae2b9a7aebdde484309dcbd6ae0d5d71a2403184d58b7ebf7112d7eed83ef7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691756722, "uuid": "336d6439-b1ad-4f65-ba37-05d14793a825", "comment": "Malware payload (RedLineStealer)", "value": "ac870a08a6089b874a7d6285540911d294d220a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691756722, "uuid": "e0500921-f289-47c1-bbd8-43faf6c88d1c", "comment": "Malware payload (RedLineStealer)", "value": "223613f5d92c6fc38cbf787c8c17b47336a4005f279dc48985fcc6514f3966aad00a16bdf807e2252ce52f10798ecc39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691756722, "uuid": "24b99101-bad6-463b-8c0f-bed90373c01b", "value": "T1C5D41212A5D9D1A2D9FA67B418F603D30A757CA11D7CC36B1782889E4D33A84E532B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691756722, "uuid": "286adfac-4ceb-49ac-b0e4-a294db91f5e5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691756722, "uuid": "735987e1-4afb-45d9-af3c-f50976e8e462", "value": "12288:6Mr4y90USpyMnGD103LsDhqdRWKwskv0jDAiS9J+Z:WyZIxnR3L8hqdRWKF//Ai0J+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691756722, "uuid": "e71c2f1b-11be-46d5-b838-2c698b8b1d59", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691756722, "uuid": "5ab7aa64-1fee-4771-bc3f-b6abd7641e57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691756722, "uuid": "4ec6d1a2-cf7b-4198-9451-114749f3dbf8", "value": "81074cd5f110722eaec76d66d7824899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83b16bb-37ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691728221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691728221, "uuid": "81cf6136-24bb-46b3-8789-aeaca6edfa47", "comment": "Malware payload (RedLineStealer)", "value": "7e5398e73c35bdd52f82a7eda9ca78c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691728221, "uuid": "9cfe45f9-ebb5-4a09-98b8-95617b4a3610", "comment": "Malware payload (RedLineStealer)", "value": "6bb1680b41bd6bb5f27b86e7e68f5d232685c7681b7c39c5fb7ca7b884f62db3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691728221, "uuid": "fd8114b3-1741-4de7-9422-29cbda1621b3", "comment": "Malware payload (RedLineStealer)", "value": "997d771c7925120a1638ec7355e4f19ae61eb12f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691728221, "uuid": "04deea5f-9075-443d-9cc1-dfbeeec5cd43", "comment": "Malware payload (RedLineStealer)", "value": "0dfd6e78c7c3902e112c01822a2ce3036ee2bf1bbea4db502ad0cce5544f88f9d471e9a27863756f9e334b00532a66d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691728221, "uuid": "dcdbd09e-ac85-4a3b-834d-95ca3a486a44", "value": "T190150211F6C484B1E86618350EE1B371BB7CBA341B368EEF9B844A2D4F705C19935B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691728221, "uuid": "9c12e463-e8eb-441b-9f06-67ecf28866a8", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691728221, "uuid": "42363a7f-27ef-44a9-b4c4-52adc6b7f129", "value": "12288:f3DkEGDINi1EwkG8rfrpJxS4NboVfL+Ie9uAQ1QelT5jY1i7T69ILsHWihcW:/DkUNi1EvGcDb2fqxK11cPbWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691728221, "uuid": "68f474c5-24cc-4910-887a-e87711e27dcd", "value": 914230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691728221, "uuid": "21af4955-a551-4729-851b-9d0bfdb7cfe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691728221, "uuid": "2fef6f5c-29e6-49f1-a2fd-24a633e83577", "value": "Quotation Catalog list.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc7f84a-3822-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691743339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743339, "uuid": "9fa3349c-2cb0-48c6-b4c8-b1d9ea76c1a0", "comment": "Malware payload", "value": "da7822df51eba2ea7064742927ddd694", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EnergyEfficiencyConference", "colour": "#A49DCA", "exportable": true, "hide_tag": false }, { "name": "func bat", "colour": "#B46DCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743339, "uuid": "0687e100-e37e-432f-8e6d-82b66926f3c1", "comment": "Malware payload", "value": "6bbcb488af60a25f433eab95d0282aca535117e6326d19a04a3031af20142d26", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EnergyEfficiencyConference", "colour": "#A49DCA", "exportable": true, "hide_tag": false }, { "name": "func bat", "colour": "#B46DCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743339, "uuid": "c2dabe81-44c5-43cb-af95-4f6f74b00b8f", "comment": "Malware payload", "value": "4eb79f9d6b3a83648c9111212cbc8eef7962ed0e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EnergyEfficiencyConference", "colour": "#A49DCA", "exportable": true, "hide_tag": false }, { "name": "func bat", "colour": "#B46DCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743339, "uuid": "d8777eea-cb0b-4afc-bd7c-e65424fc6bfa", "comment": "Malware payload", "value": "0287903b294a84beaa840a33b543ccae6a516ad4c9c982b08a92989230e222fbe754c91b125dd29b2c0db0ecd15cfe5e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EnergyEfficiencyConference", "colour": "#A49DCA", "exportable": true, "hide_tag": false }, { "name": "func bat", "colour": "#B46DCD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743339, "uuid": "d0d11492-1ee4-4a71-ac3e-a4c0759d4675", "value": "T1C731F27E3688C9B3451200B7863F4DC7F43AE05B6348CCBA93B14595E807EAD59E89D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743339, "uuid": "4ca17171-6907-45b6-b8d2-ade8489b73db", "value": "24:cYYrDZZN2w/9DYJWdbba+7Ofkk1aqOOy6EUDMfOi:c5DN5/9sJ2bb3cYv0Ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691743339, "uuid": "bd8ad0d3-6f6d-4fbc-9bc5-77d2866d43ac", "value": 1619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691743339, "uuid": "e403fba3-0c86-40d1-8961-68c4a209bff5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743339, "uuid": "04f65e94-82d5-4d6d-b6ea-11c10fdcceab", "value": "func.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d9c23e-3896-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691792745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792745, "uuid": "5ff5795c-da85-42a0-a6d6-ecdeb846e235", "comment": "Malware payload", "value": "410a4374b869a164939116c3ff63afac", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792745, "uuid": "19571875-5759-4b9a-bfd5-8de715f11f57", "comment": "Malware payload", "value": "6c3c174dcae1d449395f25f2e130d538809b5bccfd2b528697a7e3537c333b6e", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792745, "uuid": "7bfd1000-f2bd-4b8d-be57-e11d682f200f", "comment": "Malware payload", "value": "cee674597f26c9bcf33c5a91d3c171e814367b61", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792745, "uuid": "44d05965-d3a8-4994-825f-9a434cfef678", "comment": "Malware payload", "value": "990e05ae25d21c2eb99f15e3c665c6933ad9e73d4e7ea1a335c298b2fff690ba1efdbc6471a5742bfebb8bd38d6c2e66", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691792745, "uuid": "f5e59229-fac6-4fc1-894a-100afcd7a570", "value": "T1B80633015621A8DF91689C774EA77D1A46C41F22E8C41F146CAE1F7602B8FE7FD80EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691792745, "uuid": "d62ec4fc-4335-4dc5-8309-77fe7dd44544", "value": "98304:Lh9bubHRZyKtg8mN/qkIfJDZUZhh182K269ADJth8:Lh0jDwNlwPG582kiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691792745, "uuid": "8e3dc0d8-2766-42fb-94ba-7a88463aab57", "value": 3884459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691792745, "uuid": "8338ab12-e405-4a2a-b308-4479ddcdd224", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691792745, "uuid": "66dbe321-7c93-41c5-a4ed-1ea545f21ce6", "value": "FilanCorp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b678666-3822-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691742990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742990, "uuid": "1af6f5f8-9a82-4c90-92c4-97eedbbc7581", "comment": "Malware payload", "value": "8d6d66aaf2266546eeb02e73f1d557ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742990, "uuid": "b9acd346-7817-49b9-ac79-bff07b31d04a", "comment": "Malware payload", "value": "6c5816812ad2b8dcf1bdf8e7a393c283202f85b1c998c899639579c3458abc26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742990, "uuid": "30bda87c-785e-47fe-af37-c175bfe71a13", "comment": "Malware payload", "value": "7aa1bb79c87d8f950f6ead6c8e6d8f68fabc6172", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742990, "uuid": "491fbd0a-d74c-4609-b3e5-38c79fbaeafe", "comment": "Malware payload", "value": "14041a9b1deae035094000009b5557e8bbabfa21f4ff17ac4835cfe39c162a6abeb173ecb74b7d2de3d2c8fb09e566eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691742990, "uuid": "cf2f0274-4dd0-44f6-a2bf-528533028fa4", "value": "T1B3F24A2937DC471AFAFE8E7A55B2841446B9B90B1422FF4D0DC474DE0CB3B809941BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691742990, "uuid": "45b14682-e81f-4897-a05e-2d8ba54fd820", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691742990, "uuid": "cd129e2f-566d-410a-a7fe-8b5bb701749a", "value": "768:+EgGvYEGMlglLa+UcII6Ouy7NAizhYPdX:2Ogl2j9Oh7NnuVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691742990, "uuid": "6cc7cdfe-e944-459b-8493-bda523975595", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691742990, "uuid": "1403cde1-11e5-4b30-b172-c6fb4811501c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691742990, "uuid": "e04f803f-a9d7-428b-b041-241618585f58", "value": "sdk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2556659d-3866-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691772185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691772185, "uuid": "802a5297-b1ef-4ae9-8d97-4737a2491bf1", "comment": "Malware payload (Formbook)", "value": "64f784b19a1db29404ba29f49f02ff2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691772185, "uuid": "b0bf536a-4108-4cbc-afd1-3413083e57e1", "comment": "Malware payload (Formbook)", "value": "6cad63187657e8cf245910096f37936a9d749ad8c7747e078c636fdd3b63cef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691772185, "uuid": "ada68549-f5e7-4af4-962d-5ec516296a01", "comment": "Malware payload (Formbook)", "value": "27fd0a7d61ad7a13c61130710899ffc98acedf41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691772185, "uuid": "98bfd617-a387-4e47-acc0-93415b48ff4b", "comment": "Malware payload (Formbook)", "value": "34c2e0327b278c24f8d70bb4e5e14e6b6afadf950bfacd62557ce5236fcc0e16575268e24af33dde55e789b194486caa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691772185, "uuid": "70d6391e-1e60-4fbe-9010-5a53587681de", "value": "T11004D783B98B89F1C3891736CA9B05040771D685B693EB0AF5BF13E5494B7BA9C43E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691772185, "uuid": "e28adf62-9f45-466b-a2db-fdb3055896a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691772185, "uuid": "120d6c69-e39f-482c-93c6-55777636dc68", "value": "1536:tK4dPHtpYmlTVqE1YIgfADsOoLEbGxTUgHwVLhk2tzrLReFPt33u5uP3/XJRK9qI:tK+lT7QY2EbQTCyoFeFPpbHXr0Gri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691772185, "uuid": "68335d1d-3cf1-4822-90f0-aa1a07f12cf8", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691772185, "uuid": "fbe703bc-73ae-47ff-9a61-cd7ea013ae3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691772185, "uuid": "5cafc969-470e-4f3e-b7cd-2d59731fc155", "value": "IMG_WA0011434664646466463435500054434434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0daf632c-387a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691780736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691780736, "uuid": "c4787f24-b605-4085-b0ab-001b4d192835", "comment": "Malware payload (Amadey)", "value": "35c919b9c6e549d7c295a93c787a704f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691780736, "uuid": "41a120b8-acd5-49e7-92e0-adc3a1102c37", "comment": "Malware payload (Amadey)", "value": "6cc5aeeb3a586cc0ff7d3a4fc136f13ab5b44ece219ef63c77946922fb5c342b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691780736, "uuid": "2b2313a6-12c3-4093-ac99-e0eba2087c85", "comment": "Malware payload (Amadey)", "value": "22a260fe8b01c392d138460605b59959f42e5ba7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691780736, "uuid": "d01c8714-76d5-4e76-adac-f933aa4e1a10", "comment": "Malware payload (Amadey)", "value": "53e4e686265260c63a7aa8bcf5d0e7467635d52d4181ecc16a7b061e2e615da976be56f82086eaa6e5ee552d7cb226a5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691780736, "uuid": "ebb6e6b8-400f-4d35-86d6-b6ba696ac128", "value": "T12F6439417952C072D960A1721AB5BFF2C59D68249BB049DB7BC00F76DB212E77A30F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691780736, "uuid": "1b92c8fa-e78c-4eb8-8349-dec14357093c", "value": "44e769941d2c6ad88bf42ac4adb36135", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691780736, "uuid": "65536037-cf2a-4988-91c4-7424af8e83c7", "value": "6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691780736, "uuid": "cdbf2191-772a-4819-96ce-c35714df9b88", "value": 321197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691780736, "uuid": "2a4952a6-b384-46fb-9958-2bc024e74fdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691780736, "uuid": "d6ba54c4-95ce-4e94-bdae-d2cfd386b68a", "value": "35c919b9c6e549d7c295a93c787a704f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b489ba-3863-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691771132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771132, "uuid": "8e64826b-8395-46dc-b6ea-de0775759608", "comment": "Malware payload (Amadey)", "value": "be0d5be1fb3eaa045b848ad29ad70c6f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771132, "uuid": "dfd9366b-b1ed-40fe-baef-fa5a1a5c75bc", "comment": "Malware payload (Amadey)", "value": "6d470bf878c9a70702c363411bfd53b17a4e71105e29bc05efe5a402175fabd0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771132, "uuid": "e4f810f8-e557-46a8-a614-6f5ce237c016", "comment": "Malware payload (Amadey)", "value": "6cb7e3b2e56baaac9d3d23c3c3a4e9743ad5179f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771132, "uuid": "8a7435b8-ddef-4989-8a41-78a6faae60aa", "comment": "Malware payload (Amadey)", "value": "668fc28e0fb5e6c66eb0e0c14621d764df885359a44b676f84ffae622d3306ef1d566cbbf191dc3171c0ee24cf00c08c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771132, "uuid": "494ce51a-c007-432c-a9f7-b92a023e76b0", "value": "T11B6439417952C072D960A1721AB5BFF2C59D68249BB049DB7BC00F76DB212E77A30F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771132, "uuid": "428601c2-bfb2-4088-a92f-44fbd1b0397a", "value": "44e769941d2c6ad88bf42ac4adb36135", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771132, "uuid": "40081df1-90f6-46c3-b5bb-31c500cca341", "value": "6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691771132, "uuid": "b76ad3e3-943e-4de7-84e4-b1a0ccbcd8bc", "value": 321130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691771132, "uuid": "1188bd4d-934a-4259-91b6-078f42a914de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771132, "uuid": "7dda8c4c-23b7-495b-8359-512e75d906b3", "value": "be0d5be1fb3eaa045b848ad29ad70c6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c019478-37f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1691723234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723234, "uuid": "0161d0c1-b17f-4108-aa0d-3931ecf8a866", "comment": "Malware payload (Stop)", "value": "27cd3686f079e68f5ba6959d01cbedf2", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723234, "uuid": "1c4cd872-46a3-4689-924d-21db97fa0db1", "comment": "Malware payload (Stop)", "value": "6dd00f91feb5b3a755f3dee952d800d13544d451cedf6aca1eaee938d7afb030", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723234, "uuid": "c821c4d2-2a56-4856-a562-45271da0098c", "comment": "Malware payload (Stop)", "value": "f7d9f23c7b6819f914a4fd8729bc0e0ed9969d74", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723234, "uuid": "a3c35ef3-5ea3-4b61-b29a-0aba51b8af75", "comment": "Malware payload (Stop)", "value": "5c106fb0dfef583e3987d89939ebab75ca74cd655074de9b6796485ccd0b54273e0b27816f2ad5298553ffd2714929ab", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723234, "uuid": "2a1a66d0-7e24-49ca-ae2b-335a7a9b0cc0", "value": "T10F45AE02BB819171E5D341BA0DFE977E883AA9A0933A95C3D7E91C568E306D0673F3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723234, "uuid": "d2f34093-1892-44f8-b658-3f7d42bbf7e1", "value": "24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/RRPOO8eIJUq7:F0dwAYZt6C31WeTJRPOheuUq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691723234, "uuid": "782cc5ed-fd3b-4596-89c7-344dd1539ab5", "value": 1273856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691723234, "uuid": "1d2f4231-1bfe-4bbd-aa0f-ce2243925605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723234, "uuid": "d2ab5a0b-8396-4438-acba-aa1a9181331f", "value": "2023-08-10_27cd3686f079e68f5ba6959d01cbedf2_stop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0f1b0d-3843-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691757268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757268, "uuid": "7f37d939-9908-429b-a3e6-0a4046cf1d1b", "comment": "Malware payload (RedLineStealer)", "value": "a1d16f71991d4d8934e6181a6153fd26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757268, "uuid": "5e857de1-1579-4457-b99c-b4e2f926b069", "comment": "Malware payload (RedLineStealer)", "value": "6e801ff670a8234773a10bcc4430afdd87dab113381136a2d03702d0efdf1b19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757268, "uuid": "cb2f2b58-a723-40fe-9ea1-0102270bd1d9", "comment": "Malware payload (RedLineStealer)", "value": "f264ac146e5f9db58c2377d5cfb847d9143cb24f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757268, "uuid": "afc0f03a-4f40-45ff-98b9-1b5d3b3f59d2", "comment": "Malware payload (RedLineStealer)", "value": "4fa01f5b41f44384fe9b78ee6cf0e44c78f48ce5500ba98a60b13c20ce5339d6306f9ee58de1a8ddb45819eaa2332320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757268, "uuid": "0b1051ae-1984-4fd5-bd5b-e8cc3ff60a4f", "value": "T1DB247C17F0A040F2C179FD782F4558C41E6DA8B9BBEEF50B64BB20AA9F40BB41186D59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757268, "uuid": "928f8131-b9a0-4d26-82e2-e4e6a75181a1", "value": "bc87f5b8f551ddf79b304fb51090042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757268, "uuid": "cf33ccad-975d-43c8-876c-e94231d74e79", "value": "3072:nd12QSMj4Et8BW1cr9ydlp3rrXo8lIKi16URXm8CN+SCTIO03OhJyO:32zMPWH6HXX+MULZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691757268, "uuid": "8b8714b8-6c11-4fe0-af09-accb8a08fda3", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691757268, "uuid": "025c9cd2-9342-4c1e-b55d-074649c61991", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757268, "uuid": "a229fae7-f478-4da0-ae42-34e05402603d", "value": "SecuriteInfo.com.Win32.TrojanX-gen.19067.5733", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afbef00-388e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691789509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691789509, "uuid": "d98ae315-0778-4af3-8767-9c8fcf3d9465", "comment": "Malware payload", "value": "e059ae536da8736c9c7681d32472533d", "object_relation": "md5", "Tag": [ { "name": "27-124-3-171", "colour": "#F6EFC9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691789509, "uuid": "715574ed-9835-4f60-aad0-965e287002ac", "comment": "Malware payload", "value": "717c30217a95bc7c2a51bfc4f392f25261bfaea5c6932075d6db4b934886d914", "object_relation": "sha256", "Tag": [ { "name": "27-124-3-171", "colour": "#F6EFC9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691789509, "uuid": "daa98523-9f9e-4153-b78f-a5f76abe194c", "comment": "Malware payload", "value": "80b1d20fb2638406e0ca1b8a4468de044075cda3", "object_relation": "sha1", "Tag": [ { "name": "27-124-3-171", "colour": "#F6EFC9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691789509, "uuid": "a84dd0fd-1b8a-432a-ac57-8d1e0abca670", "comment": "Malware payload", "value": "507fd083f8e648fb9f661de175f1bc6e88fa542b25c4b2fca84706ebf85045268c174ff34853f12e24d164a8697fd17e", "object_relation": "sha3-384", "Tag": [ { "name": "27-124-3-171", "colour": "#F6EFC9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691789509, "uuid": "8c1cc16c-c8c8-4797-ad1a-5ad202f4be7a", "value": "T18076E193F755D6A7D8F5667B1B2183FAA31F4C24126B86C31E89323D2C772C28662DC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691789509, "uuid": "53875236-c505-4b93-a0ba-c32475e9c321", "value": "12288:JySxQRaRqaQyOzbq80kWR7jHYryb6TPIbvWyHnyB+MKvANsoO83SgTibd8J+O:s7RaAZzbq8YRvhCPUHyBfpNsoQgTiB8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691789509, "uuid": "19f3b9ff-8178-420f-b6f1-98fbe09532a7", "value": 7436969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691789509, "uuid": "67a13934-88fd-484a-b462-dc1c0bce2d82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691789509, "uuid": "d5802542-004e-4bf3-8a93-c36df56129dd", "value": "MINING.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0ec26b-380b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691733116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733116, "uuid": "291544ac-0750-4459-9580-07e5870a8104", "comment": "Malware payload (AgentTesla)", "value": "1d1d6ea75af85536676aff8e9df63498", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733116, "uuid": "251b0dd4-56c3-48aa-aa8f-76c261654931", "comment": "Malware payload (AgentTesla)", "value": "7416f22c0320b7169a24c5c0ee5b1cc400f5b98861f0de3308b6e515a2ebf870", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733116, "uuid": "73ad752e-56a0-4fb7-bbb4-246e01c07657", "comment": "Malware payload (AgentTesla)", "value": "3cb069660d6df64fabfe6696c4d25fcfab7d750d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733116, "uuid": "ec5af3a9-b205-4512-a464-70e93202305d", "comment": "Malware payload (AgentTesla)", "value": "a7d0adfad3a085015f52232d17608e601e2275d946243127ea00db7883d5201b3ae666f172ea8747920dc44a963948e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733116, "uuid": "a4c9f779-693a-4f64-a1c1-3e1fe6fcf1a0", "value": "T1E465CF20ED7DB982F19E0678004ED71E837388962176C73A666F51C2D7D32C116DFBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733116, "uuid": "1371d3bd-dc59-45ce-9463-4280a0577c19", "value": "24576:Y1lrsH1TISgJEWuB/NwpFP2zs5vI6PKSTjq+:YbqQaB/6FL5vIhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691733116, "uuid": "1982bb55-d4ec-47c4-9bbe-8e3698cb4967", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691733116, "uuid": "5bc6b3dc-dde8-4399-a4ea-e208d8c836c9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733116, "uuid": "f0b302d0-3706-4344-86c3-bc5ab3cae952", "value": "orden de compra.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28756a26-387c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691781640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691781640, "uuid": "de187ab4-21a1-459d-b75c-8d4050776719", "comment": "Malware payload (Amadey)", "value": "c2396c587135ab99ded5a3952e6c7c9c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691781640, "uuid": "4d888196-3883-488a-8a57-4ccffb00b343", "comment": "Malware payload (Amadey)", "value": "746030118a69919697452c623b3a4b858ef2cd0e221718e57ac232c1874dbb7f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691781640, "uuid": "56b31b25-31ab-4875-9fd5-4c39807d115e", "comment": "Malware payload (Amadey)", "value": "53e5894f51b9f4f22409874d9bf4a952dbba2374", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691781640, "uuid": "6a84976c-5844-4361-aa63-7b25d0b326e1", "comment": "Malware payload (Amadey)", "value": "9499d648cc57e63d6b57e8970a85bbf9e9b00d44c07ece93dc4da6b37c90882bd75c4cddef9b6c9fb4da8606b83d11b8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691781640, "uuid": "ec77d9a1-011a-402b-955d-b656894612f9", "value": "T16DF41292DACC8432E9F55B7859F213830B3B7C566C3C876F2781A90A1DB3584A43677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691781640, "uuid": "89a8f73f-1ce0-4ca2-9072-687f9653779d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691781640, "uuid": "e51da151-f003-40a9-a1c0-b75246f9fa05", "value": "12288:GMrUy90s21cUANQRLs65fyaflH4sqKfgJx80i13Y+eG9v/+ukijcnksz:2y61cUIQRPH7qEgJx80i1Y+t1Wu/iz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691781640, "uuid": "dd6756df-5c63-4a1e-be1e-81beb8e5759f", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691781640, "uuid": "790828d0-c6a1-4cd7-9541-626f68dac435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691781640, "uuid": "b96caf46-4e29-4acd-b466-f070f03afd33", "value": "c2396c587135ab99ded5a3952e6c7c9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d43201-3893-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691791643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791643, "uuid": "66d7c1e8-d21c-4c2f-a45d-472a381bb7ac", "comment": "Malware payload", "value": "ea9428dd2820418d508ac4b3d8d8382b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791643, "uuid": "ef547847-86dc-4394-bad2-8e716462be2b", "comment": "Malware payload", "value": "777894a1cb29d3cc1b4030000a5fb1d6f63c1af15a3daaddff1faeb142827c7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791643, "uuid": "dd2800b4-f590-4bec-92d0-ae66f7fc445e", "comment": "Malware payload", "value": "13b2b9eaef2ba1bbf45e0f0fa9f3f48ffbc0f8c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791643, "uuid": "ef314aee-c7fb-40bd-ac70-19516d9ecb1b", "comment": "Malware payload", "value": "1c2042323648ca90852f248ad79b3ea3c50900a4a7e883a0b003fbe4ea84686568337121b7aeeb08c4d8a27b84d06402", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791643, "uuid": "ec342920-5bb0-491c-906a-eea2ffbf196f", "value": "T179749E1337E4E63BD1FE173AE43206194BB0D967B612E38B6A5A55F92D133868D403B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791643, "uuid": "42647a9a-32e9-4ae7-aa68-b761c128905e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791643, "uuid": "4ff69929-498f-4f3f-a4a9-da0dbabdfce1", "value": "6144:37qQ4i1FFiEK3sni4iq3DbuXf11yZGrgK/m6:rplieLmNWsgK/m6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691791643, "uuid": "c7dc436f-903d-4530-a85e-ffbe1ae646b1", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691791643, "uuid": "43733aa9-15c7-40f7-9278-74ccebd71934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791643, "uuid": "20de44a7-4c79-4962-80f0-bac49eceb5b4", "value": "bOPE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a526d30-382c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ManusCrypt)", "timestamp": 1691747310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691747310, "uuid": "4102ba58-70cd-4950-b262-03e78be5330f", "comment": "Malware payload (ManusCrypt)", "value": "b5818e3a26bb20e95dd0af1835c5646f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "PseudoManuscrypt", "colour": "#A19C0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691747310, "uuid": "55b9d93c-3619-4454-a257-5a869fc22186", "comment": "Malware payload (ManusCrypt)", "value": "77bac9c2a0b042b29d7b7e8553d09d0dcc3fd0977ff2a10402a6d799303a5138", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "PseudoManuscrypt", "colour": "#A19C0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691747310, "uuid": "5534bcbc-6bb4-4339-8c1d-363ce5a0f2b2", "comment": "Malware payload (ManusCrypt)", "value": "b07394160a3accaeb214df5eb28a2541efe118a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "PseudoManuscrypt", "colour": "#A19C0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691747310, "uuid": "d9ec5885-56eb-4aec-bb59-4eed81ae0437", "comment": "Malware payload (ManusCrypt)", "value": "d1960db0172f66f4a70e2e635ebbb5a21704f4faee4257bf5d4165ae153b3582aaf485cdc7f2737b4a99ca449fbb7735", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "PseudoManuscrypt", "colour": "#A19C0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691747310, "uuid": "447d4bf7-6972-479e-8224-eafe9bc86b8c", "value": "T1CE748D01FA419036F4EA017069BEAF7A5D7CB4301F6A54D7E3C8AA7A5D305C23B38B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691747310, "uuid": "15297e77-6ef6-4315-96d0-c4bd8b943435", "value": "07d1e37f4fbb3c964f02f83e4f64d207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691747310, "uuid": "80d22879-4d7d-4448-ba40-607f189b04d2", "value": "6144:j+vJxhqdSKPlxjx614A6Y+wH6/+6TBOhLLqXMt5yP:j+vJvqdfz+6Y+N26T85L60i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691747310, "uuid": "da899d17-bb0c-47fd-b58b-e2b5297da392", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691747310, "uuid": "0f68e683-280f-41da-8f2b-8c41a3aa2afe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691747310, "uuid": "109d9d3b-ead8-437e-b178-3de9fb00d39b", "value": "820e6cabe7ab6288d67fbb6c424c701c443cbd9161b0c47c9cfdbaf6fc3cd91d_unpacked", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4ecd61-380a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691733004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733004, "uuid": "34201c68-4fbe-4a0f-a23d-13c12c4965d6", "comment": "Malware payload (AgentTesla)", "value": "e54c8e80e30f7ceb4b541ef241333246", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733004, "uuid": "0873996f-d24a-453f-8fbf-38fe01e48361", "comment": "Malware payload (AgentTesla)", "value": "7835b9b2aef480d731cef3c037e0cb45958d6cda6e9546953712ed7e64d86208", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733004, "uuid": "47906881-1a32-4de1-9cd1-b3603f37d844", "comment": "Malware payload (AgentTesla)", "value": "8768672d05f92bb64e8fe2e1d390251ed5b366be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733004, "uuid": "c587928f-c0ae-4dad-9071-9004d606930e", "comment": "Malware payload (AgentTesla)", "value": "8c120cd668a7c0f4d3e7c308bd9f61be8a7c212f5616b254be54194eb8f85828148e58f68dc7388728771eae1998efbc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733004, "uuid": "c1592f99-b9b5-495e-a419-1338b3d13c0a", "value": "T1BC05F722E77B645AEF19A5E89E2F857238D6DCC0F1B1C588A7E72C0385C23114D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733004, "uuid": "ec3f1063-a01a-43bd-a5ae-ecb14fc09531", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733004, "uuid": "94169054-e62d-44fb-a970-289b79362f12", "value": "24576:WwutRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOzUFkZpEsiLRquMso:etRs6CE3jLbO9Rs6CE3jLbOz/pE9quM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691733004, "uuid": "b80c79b5-061a-4ff1-b093-83e302889c25", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691733004, "uuid": "ce352ff7-fcba-404b-8c35-be5ab00db440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733004, "uuid": "d29ec376-ad25-43f7-bd6a-39ad82fd19eb", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8fb05c-3876-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691779236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691779236, "uuid": "586ef4b9-74d0-481e-bcd9-018ab09d3b5a", "comment": "Malware payload (RedLineStealer)", "value": "6d71a1f8030453080bef8dfef7f7da17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691779236, "uuid": "7e3a6ad6-240a-4496-9b86-17c5b6ea4d26", "comment": "Malware payload (RedLineStealer)", "value": "783eb782e95c55f80d6e355a05f97364708ff31b908d764d953a1c69cb9a3c45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691779236, "uuid": "6f81c5ce-0282-4677-ae00-15dd1e98d774", "comment": "Malware payload (RedLineStealer)", "value": "fc7fea89635a27cf2cebff1f774af098977f405f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691779236, "uuid": "6ad5fbc6-91c8-42d8-8ef8-bf8bfa5e24b8", "comment": "Malware payload (RedLineStealer)", "value": "ec6fa6de9935390c64adf481301ddc9a342d2b18f50aefc788be7f3b3ac2918764579ff4860d217bd42564cc0b9aeb3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691779236, "uuid": "a3066395-dd61-4823-9037-10b4481e1de1", "value": "T1AAD41213EAD98063ECB9277058F617831F317DB158B487677B52645F08B3BA8A13173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691779236, "uuid": "69805355-d660-46c7-bff3-8f0dad73ada1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691779236, "uuid": "ea96bd77-6fac-41e4-9cf5-adaad4412050", "value": "12288:YMrCy90dipZtZOa3w9DDLROG5QYKR7EXjp75hlzIgHDkEp:qy4i3DaXbK5EdVIgZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691779236, "uuid": "a9b4418b-f003-4344-af9f-770703109133", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691779236, "uuid": "9cce0b19-e185-4c4e-8221-47a89e2fc682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691779236, "uuid": "2ecfedae-6123-423e-a330-ce84e762c52c", "value": "783eb782e95c55f80d6e355a05f97364708ff31b908d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43033321-3882-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691784261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691784261, "uuid": "dcfb6d4c-64b1-4913-b807-0bd289fb8d71", "comment": "Malware payload (njrat)", "value": "577ecc8ea50f5633d57902d4d4f1b925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691784261, "uuid": "518fdd08-b7c1-4f3c-9ea4-1f34dd04a87a", "comment": "Malware payload (njrat)", "value": "784e7f352ce8a8ca2e2909967bb42e67652e964c981640222ba11aaa148f092d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691784261, "uuid": "31fe5dc2-a51b-4692-9b8c-b280bbd6b3c6", "comment": "Malware payload (njrat)", "value": "88eb87e9985342c9117d3945bf771d2cb9ab8575", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691784261, "uuid": "1472fccd-75ba-471c-b521-9fa5e949d979", "comment": "Malware payload (njrat)", "value": "327f76f443e34191ff932cda4cfc8b2834a22c772733cb5b41100e3b21a89c2247da476146c912336657d877a995c217", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691784261, "uuid": "f9bf5148-8db6-47ec-9171-6d76b4a6b597", "value": "T167E2084677E54215C6BC16FC8CB313210772E3878572EB6F9CDC88CA5B676D00251EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691784261, "uuid": "a5d69d95-72fa-402b-9422-64af0ed75ce0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691784261, "uuid": "c36800ab-a868-4e83-821d-310c6077f877", "value": "384:k0bUe5XB4e0XmOnpQq1pvmufCsIsBWTFtTUFQqz9sObb9:hT9Bu1pQqvvmu6FGb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691784261, "uuid": "e2287bf7-16d0-4585-ae69-e3ea43a3b97a", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691784261, "uuid": "a5ff6596-4362-4ea9-b968-cfcb32f6980c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691784261, "uuid": "359a7b03-d704-4f48-9857-13f6d54ae702", "value": "xZJKmUXowvtp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b5d81d-3857-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691765856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691765856, "uuid": "34498fd2-709b-4231-91dd-6677ebadb1df", "comment": "Malware payload (RedLineStealer)", "value": "d7f301c6cba9d944f7cd046297ecda42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691765856, "uuid": "46ec0c85-9d4a-4491-a2d4-7cd3f7d8a0f7", "comment": "Malware payload (RedLineStealer)", "value": "793c5832f007199c128dcb5a56bdb600d9edb69731fcf4769b102dcf4b434c13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691765856, "uuid": "072892bf-d713-40bc-b595-10d72f71d6e2", "comment": "Malware payload (RedLineStealer)", "value": "db6332ca315dd948f432cda88d5bc023706ba1af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691765856, "uuid": "f8d4505f-f76a-4a44-bc46-8baeac7161e3", "comment": "Malware payload (RedLineStealer)", "value": "f2de6e913f2ba665a1784c558ee685905d54c34260cb10a1e69c8695f645928bb104df3ba609dfc46e33e8788f20a2d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691765856, "uuid": "57313097-5ed6-4760-bdc7-daae18555764", "value": "T13E64D11266A0FC72F436CD314F3EC6E7B63EB9615E65A67723145A2F0C301A2ED66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691765856, "uuid": "0739bde6-ce97-4dc8-88a9-84aa6ba4ffb1", "value": "041d48491af33996afda7a32ee725dc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691765856, "uuid": "b32969ee-2104-4687-9e31-0f2f36d3ce8e", "value": "6144:IziLa4MxNEC/Xi8+1Jxua5ZDCtZd6JfWZRb:19MxOSc13PDQHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691765856, "uuid": "6ba63365-0b29-4a9f-a693-23de50854997", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691765856, "uuid": "1040a2ea-fd22-49e7-a22a-a05987fa4370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691765856, "uuid": "efb2e8d0-90a0-419f-9ad7-6621dd092e5e", "value": "d7f301c6cba9d944f7cd046297ecda42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16ba746-37dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691713150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691713150, "uuid": "1bf71238-36de-40e8-8ea6-59c36d57e503", "comment": "Malware payload (NetSupport)", "value": "c2f4b073fe25310dff3139ebbe025e8b", "object_relation": "md5", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691713150, "uuid": "8ece15ae-cfbc-4bab-8b36-67b8472aa460", "comment": "Malware payload (NetSupport)", "value": "7ab08a553010a5657b3393dd0752306854916685dc278b70eb819cd9c4e140fc", "object_relation": "sha256", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691713150, "uuid": "3e17deab-1c6c-49d1-93e7-312bce363488", "comment": "Malware payload (NetSupport)", "value": "db9ded427471961b185d98a9f5a611cf9e8db159", "object_relation": "sha1", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691713150, "uuid": "ee144fcf-7ffc-4bf1-a515-f3ef1d664abe", "comment": "Malware payload (NetSupport)", "value": "49c7f7b36da82b025d5db2d11a252e2f7a615b843c00fe225c7b55388a3c729ad3026872f66ce25cb482448b988f5d21", "object_relation": "sha3-384", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691713150, "uuid": "f283ff8a-4f91-406e-b099-f3b975a7fb29", "value": "T17A9533D26102DE7584F6207897BD6E49D33686E54707C80F2C831E38E1DE7D6E99E0BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691713150, "uuid": "74dabc83-7b73-482e-8c22-a926a5ed737b", "value": "49152:zDeAuZGapfw9MIid3fykSwNlZO4CGjUQDixO/kte1:zD0Z3poswcTUQx/ae1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691713150, "uuid": "3ada945a-6069-4b35-a642-e9c8209942a7", "value": 1993838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691713150, "uuid": "2760267e-a71c-4f00-a424-6f15acaef259", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691713150, "uuid": "d61e483f-3a4f-4c42-b183-8c08088bdb3b", "value": "en-local(download(upd-chr-mz-ed).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a48a6e-380b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691733162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733162, "uuid": "52f5cce6-5fdf-4a8d-b673-153290643f33", "comment": "Malware payload (AgentTesla)", "value": "22c534db6bbef81371255c8c7b497dcb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733162, "uuid": "a91fda21-d192-433b-8b99-cdcaa27198c9", "comment": "Malware payload (AgentTesla)", "value": "7af30a8f4780aa9bcc3ec75b529c8cc6b2a110c90d2b521761e744179534d410", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733162, "uuid": "ec04eb13-c858-47c8-a886-8c247d386a77", "comment": "Malware payload (AgentTesla)", "value": "215fc9a3bd82c25ed62f01ebbe916a2082a51cf5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733162, "uuid": "d2685347-e3e6-4dfa-9e1f-596694232d5a", "comment": "Malware payload (AgentTesla)", "value": "41a31aaa31fb6d38e3481fcfa7f6727db245b09df80c28ee54823367c2c6b3e79a83a6085dff74eac17fd16d09b01264", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733162, "uuid": "50d828cc-483f-42cc-9696-8865a92be6e0", "value": "T13C15D020EE3CDF46E56B4BB8008ED30D837258993527C63A5DAB51CAD4937C1069F7AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733162, "uuid": "e0643ff1-b569-492a-9c4b-645cfb7e2221", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733162, "uuid": "1a0a97ee-3b40-460a-81d8-9cf37331ae45", "value": "24576:XahWMrwXoGUjwkbGBDR61ykUBgl6XFvxRTj:eVUeskgglmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691733162, "uuid": "9a1e14e5-1a75-444e-8899-5ec20beccca6", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691733162, "uuid": "dc78dbf3-635d-48aa-9930-167ab3a96a3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733162, "uuid": "de2fc15b-212d-4d8d-b31e-8b4b7f2f6c4c", "value": "FedEx_AWB#503511274643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717d67fd-384f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691762435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762435, "uuid": "05de1185-8e80-43c2-aea6-b2313eb80f50", "comment": "Malware payload (Amadey)", "value": "e2d940d240d8d54fa9f84b3137486a0f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762435, "uuid": "00050df9-e93e-4856-a993-30b10d439eca", "comment": "Malware payload (Amadey)", "value": "7b8897660f34caac9a556a0a3071e7e268cd1229fde3977ffd5d47ed4f91a627", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762435, "uuid": "ccb68c57-9957-45c8-b567-8b44b85ac9a4", "comment": "Malware payload (Amadey)", "value": "15232e272af7f6963ac8d751b49b661ca530c85c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762435, "uuid": "6793a610-fa7b-4af9-802c-1658f2809922", "comment": "Malware payload (Amadey)", "value": "012bd88b0de2a13a29b34d871a7bc516c538130a1459c6421eff6cb81086af5e40522b0da18c1092fcc264b82400f1c0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762435, "uuid": "d31b961e-da8c-4df5-90c0-36f5fee48df7", "value": "T1D5D41246E6E99062EDB12B7058FB03C30E35BC606478576B27969C1E0C33AA4E97177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762435, "uuid": "7c0a8497-766a-4e87-b87f-4b5d1a456df4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762435, "uuid": "9aa6e8cb-3037-4a80-aa70-785e1e04be19", "value": "12288:mMrKy90XXY4kQZx6WZKj/e77NYKRYEXTp7BH39D/RuWeO:AyhDQZwAMG776KGEtRND/4ZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691762435, "uuid": "6513561d-b96d-40cd-97b9-c53cf63aa0e2", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691762435, "uuid": "3655c45d-fa50-4ecd-b3ac-ddc782e416d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762435, "uuid": "8b883c24-2cf9-4aea-9af0-e8697abfa6c8", "value": "7b8897660f34caac9a556a0a3071e7e268cd1229fde39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00cebc45-3832-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Neshta)", "timestamp": 1691749790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749790, "uuid": "4ee81b6a-525f-460c-ab4d-7ab5cd5e9d64", "comment": "Malware payload (Neshta)", "value": "ce27430516a6f6d69371c99490f2e555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749790, "uuid": "4eed7246-6090-444e-a567-5e7362de1d54", "comment": "Malware payload (Neshta)", "value": "7cf16fa9b84052ebac0f1752fd4cb2a9ffc8ffafc757f785376f2bde6fb554a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749790, "uuid": "9eecd97a-5c26-4389-971f-90bfe06bc7f3", "comment": "Malware payload (Neshta)", "value": "085b6cfecb803a8afeef3ea65aedd5845fb06591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749790, "uuid": "39ad5075-4fc4-4a55-afce-2907b36a32eb", "comment": "Malware payload (Neshta)", "value": "44bc7d5d37c5e3e41e765705ba11795dfb94a97adf437e811ade879089f6b9c55e6d662376bfd34667e1eda60d554c59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749790, "uuid": "a917c85f-1808-4021-8a9d-9619109b8981", "value": "T11615C061AD399A42E44E47B8004FC73D46724D4A3626C23A56EA7DC7F4673C10ACA7EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749790, "uuid": "c8e293d6-54ce-4aa7-b965-776bce460316", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749790, "uuid": "8956fcea-2662-4ca4-a51b-82a65e3ca9e4", "value": "24576:A6gCs3Mqx+4V4Yp0bHTABN2Qno2WbPZTj:A6Bs3MqA3sBno2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691749790, "uuid": "4a6f96aa-65f2-4c0e-90a7-471e68a421ca", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691749790, "uuid": "b69137db-5d30-4c21-8b0a-01e036fa3ad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749790, "uuid": "fea07746-057f-4982-8076-47a968e2ae77", "value": "SecuriteInfo.com.Win32.PWSX-gen.3565.24293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c165db18-3825-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1691744530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744530, "uuid": "bc28d989-13cd-4f1f-88e0-e2b6f86d7661", "comment": "Malware payload (AsyncRAT)", "value": "9a69ab7b946879819e3412be2d379efc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744530, "uuid": "f5f914b8-7521-47f8-a457-cacb26e3968d", "comment": "Malware payload (AsyncRAT)", "value": "7da2fead1f047d7944281ec28881f8b765c6cd484712d4f5b3c79798b957231c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744530, "uuid": "fde61b7e-1f6d-48c5-b403-ba3a9328bc59", "comment": "Malware payload (AsyncRAT)", "value": "0912a94c851f78431d5e79af2e27f59ddfbd9905", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744530, "uuid": "b45691f9-a8ed-4f8d-a556-54e6de406d8b", "comment": "Malware payload (AsyncRAT)", "value": "da78c234e0ad69976e3c88e375bfd1655d1010384868d898eabd72e3bf420614623529ce7415879b78f56f6e49cfa2dc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744530, "uuid": "4126927c-b066-4499-a45a-67e81101b420", "value": "T191A633A139CB359A6AB644B13B60B7B9C859F1C01425F0CF3C335ACF6674EB1E6D5822", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744530, "uuid": "5a61c73f-366d-444b-9839-643a489c720a", "value": "196608:1WrCb7WBh4pXayrE2trYrk97T0TH35A8kSDDzM3T8TrWEBJp:LfWBh4sYJrOHp944/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691744530, "uuid": "fa091293-be1e-4500-b1ea-fd946fe14bac", "value": 10179107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691744530, "uuid": "0870c8a8-8a69-45b7-8c06-b98d15f8256b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744530, "uuid": "a37e83c0-69c9-4988-b28f-d0f0568ce11c", "value": "Venom5-HVNC-Rat.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e461d826-384d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691761769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761769, "uuid": "e83b8f28-5016-44cb-8cbd-5b7671677656", "comment": "Malware payload (AgentTesla)", "value": "70fee5f1a1923ad1530a09e9fc1a9d27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761769, "uuid": "6c9becd6-69c8-4b31-948c-93c93b3d713b", "comment": "Malware payload (AgentTesla)", "value": "7e61372c93131539d2b166b8e8ebdfa7191591d2cd782f834a4b4e48bca81f92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761769, "uuid": "c2ef9288-c561-46b4-a7dd-507af956b16c", "comment": "Malware payload (AgentTesla)", "value": "b88178eb3518ef70bf50a0ae723c6aa1beab827c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761769, "uuid": "b47a4b2a-556b-4c0f-af26-575d6fa7b32d", "comment": "Malware payload (AgentTesla)", "value": "0eaf5e5c9d6634cab7d18a07cdead47758e72b49ff467d543d28ecd953eba2a1be2ad85ef60d3f2c51a82cafd8703727", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761769, "uuid": "3ae45341-e173-45ca-8d99-2f7c7b42ef98", "value": "T124453B22517B60B7EF5A77BDA927C83A34986B40A1F2E288631B35D3C5C31124D3B7E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761769, "uuid": "0b5581ca-144a-4c37-b2bc-8a2610b4a909", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761769, "uuid": "c0df792f-3a40-44b8-8903-b2de68bc5cc0", "value": "24576:KY9vceD2Tzh7xBpppNpppppoOQpppNpppppoOHTqKr4jlBj4hTIluayAeUAp+R:TO7O+KsjlB8MlAAeRp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691761769, "uuid": "ccbd2fa6-f217-407d-a680-805476663acf", "value": 1203200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691761769, "uuid": "8db57639-ce9b-4f16-ade5-ab531f16e090", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761769, "uuid": "27648193-a2a7-43db-bd6c-05957f91d0f5", "value": "Invoice-AWB-Document.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bbdf3e-384f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691762437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762437, "uuid": "14274dc7-7510-402d-ba7b-0625f8ee6a1c", "comment": "Malware payload (Amadey)", "value": "7eac3e2e862fb5c28db568c504c35f28", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762437, "uuid": "78fe0b05-9af8-477b-85bc-fa6845c8bef5", "comment": "Malware payload (Amadey)", "value": "7f51e25ad5da86dd2e974ae5cda4826d13eeb36037c294232fd9ec57ef14463e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762437, "uuid": "05218fe4-6bb0-44ab-953c-049db743adea", "comment": "Malware payload (Amadey)", "value": "2af452c8f6d343b2cf36a0a6516a122026f02d28", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762437, "uuid": "cb82c5af-82fa-4878-8bb2-0466a5418888", "comment": "Malware payload (Amadey)", "value": "4f003e840181e3377802a34fb5dd4a6d237f15bcb3c7523c212eb6c30b87fe595c8faa3488258594583c7955605c201b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762437, "uuid": "a0a63461-0f7b-449a-b49d-aa0432981075", "value": "T1C6D412039BEDC032ECB527B059F602E70A31FCE14C3857BF2759A52A1972995A53273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762437, "uuid": "c636029a-2a65-4a91-b372-d635687f4fc2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762437, "uuid": "d35128d5-c59e-4942-8bb5-cf36c0d7b4e1", "value": "12288:nMr+y90dUdEbUzL4au2LFrlKdT+13DFZSlM/7wBJz:xyWUabUzL4u7KdT+13DFwC/72z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691762437, "uuid": "a5e3f031-0d32-47ee-823a-1e18a4e098ae", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691762437, "uuid": "b58a3fb1-12dd-4cab-a169-fff193f67898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762437, "uuid": "3773d6d2-0b79-4331-a32b-94e248d1c341", "value": "7f51e25ad5da86dd2e974ae5cda4826d13eeb36037c29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcafa3b-3803-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691729736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729736, "uuid": "8d9bf408-58ec-46c2-a899-32abb9eecbfe", "comment": "Malware payload (Mirai)", "value": "cf9102bd16826ac6986830b9b38ddc48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729736, "uuid": "5ba33a03-f2b7-4533-9766-4d4206d35a79", "comment": "Malware payload (Mirai)", "value": "80b8a3d60c861a03d56c31951fc2d3d511dc8948c87b0b3cbfb26e30f1676599", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729736, "uuid": "e1550354-5952-4f41-bce2-f271f7a1ec1f", "comment": "Malware payload (Mirai)", "value": "5eeb55e36ee1494782b587a86826eae48633cd03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729736, "uuid": "5eca7f8f-50d8-42fb-b7ab-10fd285e167a", "comment": "Malware payload (Mirai)", "value": "4ef848fea4b2d67d73a78b9a6681df4da957e84d02acec8474a3bd0dde199a79b555ea3e19902fb38dec83656b641afa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729736, "uuid": "7fcc719d-66ae-4a59-b375-ab11b1621c60", "value": "T1C403F751B8829A77C2E1137AB66E5A8D337163E8C2CF7217DD214B20BAD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729736, "uuid": "a57074f1-78b6-4603-a879-ccc0973bad65", "value": "768:EgA/dgCbIsG5f0OJnlUlcOlF5AdwADb9X/Wh2v+bxDRI5XoTSw/NjwW2:EfBbXG5fblUlfbgNO4v+05oCW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691729736, "uuid": "97c1d92a-0dbb-4092-b508-d59c8f7e0bc4", "value": 40752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691729736, "uuid": "860e50a6-12f0-4211-a1e7-2bf7769d30c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729736, "uuid": "b6e3316c-5307-4187-b6f9-ce5863ddde54", "value": "cf9102bd16826ac6986830b9b38ddc48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe140be2-3823-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691743773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743773, "uuid": "6dbab385-9d0b-4215-8875-7bfce0f2b8d6", "comment": "Malware payload (Mirai)", "value": "24b3320a0c95f63aa96fdb67ded7cc4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743773, "uuid": "f898b24f-c9f7-42ad-9ca2-ff9e5b34b5aa", "comment": "Malware payload (Mirai)", "value": "8131b5119e869e1ebf7ebce50837f12fa86fa24008d5534b757c23e91e8f401f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743773, "uuid": "3f257805-814b-4d48-b37e-b897dde8ddcc", "comment": "Malware payload (Mirai)", "value": "5e7c159d7d9a229422dd046b6c997dab89a6a94d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743773, "uuid": "92034b68-0753-4366-858f-082aea702e60", "comment": "Malware payload (Mirai)", "value": "e5faf10aecee50e91594df57d702e2cf226842c486f67e27a4e87ad77900b46dddaffdcfa9d9564d702bee6e16ccfc1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743773, "uuid": "aef961b2-2c71-445a-82fb-6a9635e7f34d", "value": "T1D2C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C52CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743773, "uuid": "b6cf7c52-dd7b-4fcb-99ba-a41437a2cb74", "value": "1536:/RHeTECAms/Y8Zm3lKYA43gMJwSkJ8EpvyDzUh8rmW+IFB1Df11hR/:/R5LqAmgMJM8EZyDw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691743773, "uuid": "b93b2f5d-cdc7-49c3-b481-b0b58f00cf57", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691743773, "uuid": "63cee41a-d027-4e4b-a7e6-2ab09b1934ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743773, "uuid": "ac4dc3cd-3dd8-494b-bcb0-75f9837af9c2", "value": "24b3320a0c95f63aa96fdb67ded7cc4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2baf29-384c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691761223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761223, "uuid": "a30ec13c-8b57-453f-99b0-7144e68e4966", "comment": "Malware payload (Amadey)", "value": "a162fd4460d6b44cd0f7f36ffb976c1b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761223, "uuid": "a1df54c1-48d0-41cb-b44a-6eb12c7cac7b", "comment": "Malware payload (Amadey)", "value": "816e3740e53eac3c5bd7e08c99259bb18d3aa38cd1922ac02f0f195f367f3853", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761223, "uuid": "16dae985-348e-43cf-8323-3fab74f1742a", "comment": "Malware payload (Amadey)", "value": "2d1a10d57118c0e3f01b98a7af46b97966607168", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761223, "uuid": "d02b1e11-ac4c-4f04-9711-4bf9d9a5b575", "comment": "Malware payload (Amadey)", "value": "48de91256b148ded9ed61d379f0287d597c079ec5c48d12970787fe173f68a15a8c786a5054c813076026a3b8b32ea06", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761223, "uuid": "a69f05be-2d82-4b04-a23d-c3c4f0e9fe04", "value": "T1356439417952C072D960A1721AB5BFF2C59D68249BB049DB7BC00F76DB212E77A30F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761223, "uuid": "c25dca53-41d9-45d4-bea5-0dedd1cab9f2", "value": "44e769941d2c6ad88bf42ac4adb36135", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761223, "uuid": "a56b528c-4b08-49a7-8cbf-4c62f7c42570", "value": "6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691761223, "uuid": "18f1b2ba-e9d1-42e9-b1ce-1738ffe2c493", "value": 321038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691761223, "uuid": "689590d6-05a4-486b-b1f3-c0f23c919193", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761223, "uuid": "2bf1c8a2-7515-4d79-8df9-d85e92a49afc", "value": "a162fd4460d6b44cd0f7f36ffb976c1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafa5edc-3839-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691753163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753163, "uuid": "f3754439-1ac6-4600-b484-7f7c9c6226a4", "comment": "Malware payload (NetSupport)", "value": "ff6d270e32c8f2854c3e17fbf4b28825", "object_relation": "md5", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753163, "uuid": "a39a6ea9-98d6-423d-902f-a01c5f522188", "comment": "Malware payload (NetSupport)", "value": "83c945991cd849b9fab91f17a651368293d0b07c03fde3857e6e09beab8e80a1", "object_relation": "sha256", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753163, "uuid": "a093d481-2ae3-4b43-a8b3-28f039985a29", "comment": "Malware payload (NetSupport)", "value": "36640bb386e0272fd988031e77a56ba46f16b947", "object_relation": "sha1", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691753163, "uuid": "a391fb5a-75ea-4ebb-aeea-494fdf8cda1b", "comment": "Malware payload (NetSupport)", "value": "89ed2e2d76d7b12a5dd39d85744284f57df2152e367a7c34e50342422adeeed95ab8264f40e3f38e5f804dbeedf072e6", "object_relation": "sha3-384", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753163, "uuid": "4ac5197b-25ee-48e5-a8e7-7af9c95c740c", "value": "T13545DB34397A7C2443DBDA1334F14B962CE9564FD1703A3B199AD8239A346C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753163, "uuid": "e027aa91-e9c8-4c04-aa05-e5e0508b38db", "value": "3072:+L36wc5enN6UuRDrRptTe8bpj6lDx8aUJkD21iuyL2c:+L36w4enfuRDrRpA2i8pJkK1jTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691753163, "uuid": "c2cc004d-172f-4442-a161-3dfdd8e7c516", "value": 1252770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691753163, "uuid": "924d09f7-8e6a-48a6-ba9f-81634a230e03", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691753163, "uuid": "c13f4b3e-c31e-4808-9a5e-4888a9944c00", "value": "coverage.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7039f2d4-3889-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691787343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691787343, "uuid": "c8d9909f-5134-449e-9f4a-b16d5dbf716b", "comment": "Malware payload (Amadey)", "value": "0a1802064f49f0b5da1d403ecea8ae75", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691787343, "uuid": "2b6e62a1-89dd-4996-8961-758ee56729e3", "comment": "Malware payload (Amadey)", "value": "861218f4f6bb6ae91e9aa87de1bec9631d46a16e27f616de0b8122ab9499ade2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691787343, "uuid": "f29c72ac-262a-4f41-a1ca-33ff74b4e760", "comment": "Malware payload (Amadey)", "value": "4afaeeafe7f21caeedf1bd4f692964aa9911f3ab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691787343, "uuid": "50848dac-7907-464e-86b5-dbcf21711e74", "comment": "Malware payload (Amadey)", "value": "dd313670ee87fa556c47d47a4035b6bc660aa7d982574e5fa4f396e102bb88500d698b2872a4eabee39ca5374f8565eb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691787343, "uuid": "da9c7027-9e89-4b92-bb82-2156a6a86eb5", "value": "T1CB03F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691787343, "uuid": "1f4e36e5-122e-4ece-b241-aa731a371163", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691787343, "uuid": "726d1e3b-fcf5-4d05-8b28-fcbe36cf9b32", "value": 39851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691787343, "uuid": "1f71f25b-460f-4b45-bf66-9600b9469655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691787343, "uuid": "b6ad430d-a25b-448b-abd7-9efb65359a77", "value": "0a1802064f49f0b5da1d403ecea8ae75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3ce7b3-3802-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691729413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729413, "uuid": "f5978815-b806-4081-b7ba-c6bf334c4ac8", "comment": "Malware payload (RedLineStealer)", "value": "7ddcb9a1fe843f1676612ee86489f322", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729413, "uuid": "d9f18f77-818d-449f-a4b9-4a09090a4987", "comment": "Malware payload (RedLineStealer)", "value": "879ac9b78fcedbc0534db2577cdf8bfcad6e3b5961c48baa4fe95bfb8de3917c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729413, "uuid": "00eca3fe-1fa2-4672-99f4-27a423137775", "comment": "Malware payload (RedLineStealer)", "value": "96e13284d422d0bbb34e448ed7694efd225d62f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729413, "uuid": "2b580280-3058-4252-85ac-007ec0b28a2f", "comment": "Malware payload (RedLineStealer)", "value": "91fa7b844cd5f99bf3976b1847d6a8ca88d6e3413981591d66aa24c75b389b306d949ddd1056bb03e59790097ae1e8c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729413, "uuid": "9deb55fc-c874-4de2-a591-fe34ab9c012a", "value": "T16874AFC27EA17C54F411CE329D3AC2FA263DFD618E18675A2228FE2F18711E1D163B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729413, "uuid": "bbd1274f-f448-488c-933f-1afccb69ae0a", "value": "b138440b45b6f5886dabf014607ee7d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729413, "uuid": "e3301197-c076-4860-ba3a-c9c0f9733c06", "value": "6144:+GG9/KTHajqTphLHuM4Zl8VnS4klApeiPs1j/0c2mh:PMyTHajqlYhjmShApeiPsFscb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691729413, "uuid": "4fd12e1d-b413-4634-b709-1e35cacb2024", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691729413, "uuid": "84e7105e-e644-4120-ab45-530abe017638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729413, "uuid": "13fd4d83-6edd-4f3e-99a8-d7882c74ae89", "value": "879ac9b78fcedbc0534db2577cdf8bfcad6e3b5961c48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe84e66-3833-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691750433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750433, "uuid": "c1d83f99-2136-489f-8e83-3ccd6a983e8b", "comment": "Malware payload (AgentTesla)", "value": "11018f0f592f4d0b7c63b3abf0e11dc9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750433, "uuid": "ac072b36-0b88-4fb3-8c20-47d6eb1bc076", "comment": "Malware payload (AgentTesla)", "value": "88008e6b0bc7310045ea4c82c96540c38466eca25384dd054ec42565ab58161a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750433, "uuid": "2c91370f-ad98-48aa-9eae-8bdeb54caf7c", "comment": "Malware payload (AgentTesla)", "value": "f88d818fb03969d7547e2e29c02ae83a16de0256", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750433, "uuid": "388b851b-3296-4230-adc7-25decef2af33", "comment": "Malware payload (AgentTesla)", "value": "6261eeda03f4c646eafbac87919ee2f81de40509b62fc51b4bb2de7fea8291c317747c972c40e5e91a58c73078857f9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750433, "uuid": "ffe6db16-58e4-4466-9830-4cb8fc8120ae", "value": "T1572501A7BE5DC2D9FE4E4EF84940A058C2A43CC57D30D909BB353EDDE432B698111A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750433, "uuid": "02011e73-6e4d-4be9-b6bd-68aeeaa536ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750433, "uuid": "2c2befae-8a78-416d-8cab-5f0011cf9e63", "value": "12288:pGFiXlqa0Uf8rjEkhFTDl6GHKFaQK8BceSZPzXKCI0xl:kMXlQUf8rjEkhFT5bz8BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691750433, "uuid": "4f9242ed-ae5e-4730-8fb5-a2d2dc2047e2", "value": 979456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691750433, "uuid": "fbf38c87-44db-40dc-b6a1-1434925a5d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750433, "uuid": "220c5a89-defe-42d4-a0f9-5356ae6bf262", "value": "Transfer Copy 009867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e56e2c-388f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691790041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691790041, "uuid": "c3fa61dd-a4ee-4ee7-9b51-3e8657141a5f", "comment": "Malware payload (RedLineStealer)", "value": "4257fad399db4c221f8594d56d3aaa6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691790041, "uuid": "2c0db215-75a1-4f0f-b35f-b8283b0c2179", "comment": "Malware payload (RedLineStealer)", "value": "8876c0dfcd6aeeff6056300858bae4e527a0fa4d69e7f6d40849d0d0d46d2fb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691790041, "uuid": "1fb5d0a0-ba0a-428e-932d-16e038d76bee", "comment": "Malware payload (RedLineStealer)", "value": "659e09c5d187a5a3648f70a03a1cf56c7d03602c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691790041, "uuid": "bdfc136d-9336-4dac-88f8-d5022930fab9", "comment": "Malware payload (RedLineStealer)", "value": "899c18ffa92afe28c1429dd6dc7c11f90237bf026b596ec54a486a107c854eb4bdbfd3eed8f57eec919900adc51c95d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691790041, "uuid": "1ffdb329-0ecc-4fdc-949d-dfc674d0502a", "value": "T198F41213A7E98533D5ED2BB048F606D70B36BC92583892672796995F0C73684E83633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691790041, "uuid": "22646ac0-c7b4-4e2f-8080-878b2ab7276b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691790041, "uuid": "620c1297-6a0c-439d-b67d-737eba664bb7", "value": "12288:cMryy90cHH+HTBfhIWsF5LxT2k8nCr0ZTIkK9C+Os+mtv8TZjk0Qw/d:WynHeHD8xFXr05IkKk+rRtyjIcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691790041, "uuid": "dccb8c16-a0c4-492e-91ce-1abda4606803", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691790041, "uuid": "117c2869-bdfb-488a-aeff-46891bdcbe2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691790041, "uuid": "79a86a3c-31ea-4854-be0a-45326518ab5b", "value": "4257fad399db4c221f8594d56d3aaa6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981edb3a-3861-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691770231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691770231, "uuid": "80b5348b-f9a4-4a3b-9527-3ac4b3e6d7fc", "comment": "Malware payload (Amadey)", "value": "4d6f2a0a5b05eb8cbe170ca84cf9c304", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691770231, "uuid": "7d6a4842-2b6e-43ce-8e38-850e21777fcc", "comment": "Malware payload (Amadey)", "value": "8a9981df9869042488f2940d31e4927d4c1e3483363eaa3c4eed35a8f8fc54dd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691770231, "uuid": "816cc313-0134-45d0-aad4-a6053263e527", "comment": "Malware payload (Amadey)", "value": "7f7beb889ec83ef8b6fd85f9258ce09fce9b481f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691770231, "uuid": "a64b017c-aed0-4ca1-9343-db1d5dd4a344", "comment": "Malware payload (Amadey)", "value": "2030faf647cc3557405e2f6b7229986e6733fa0c07a038392e2e3e85d63b048d64d3b6ce71859d4b9f180981ad6b6171", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691770231, "uuid": "b55afbef-de32-4dec-94ab-27161f735224", "value": "T1ABD41243B6D68472DC7457B098F713830A3AFCA149784B662695BC1B8DB2DC4EA3533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691770231, "uuid": "787964b3-06ef-4ad5-9bc2-943ae61369d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691770231, "uuid": "0352a047-e3d1-4442-82aa-eb646fae72fe", "value": "12288:NMrHy908Jiw9sD2+srHRBdxUKz/e7hk6KRrEXUp7WqDXf2LYdTXZp2+G:Wyniw2SprHRhUEG7h1KpEkbDu6FG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691770231, "uuid": "d4899a4d-2d46-4384-b1ea-04798eb847b3", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691770231, "uuid": "d6d29d91-100e-41a0-8726-074823e163b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691770231, "uuid": "1517d6f7-3b1e-4be7-97cb-bfd800ddb0e0", "value": "4d6f2a0a5b05eb8cbe170ca84cf9c304.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d9a522-37f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Ryuk)", "timestamp": 1691723165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723165, "uuid": "488e7ad7-fd00-483a-8b23-01a1fecf305a", "comment": "Malware payload (Ryuk)", "value": "4f707c67968a14d08cc42958d5341707", "object_relation": "md5", "Tag": [ { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723165, "uuid": "aa176dab-0a1e-463f-aefe-f3f43143d768", "comment": "Malware payload (Ryuk)", "value": "8da85cb00f7ba5e8c23b058d31a4b169c18936a8f7181015ce27e871d8b8cccd", "object_relation": "sha256", "Tag": [ { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723165, "uuid": "2da71264-3423-4c92-915f-5605c3e69025", "comment": "Malware payload (Ryuk)", "value": "accf64200195ef1ca9c7f497508c4bfb4e18da41", "object_relation": "sha1", "Tag": [ { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723165, "uuid": "c28c1208-a524-4fd9-99cb-a70743088bf8", "comment": "Malware payload (Ryuk)", "value": "1bd7e29e87a1801c98b4b2bafb6ac8190113746bc712db27931f61a6b0c8e38a7e02ca277fe6108ca9853f978c39b1ff", "object_relation": "sha3-384", "Tag": [ { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723165, "uuid": "e257e861-e7d8-452b-a738-b71db81e10df", "value": "T168144907F2E530F9D5B6CA39CD611612EB7278354734A75F035486A61F63A90EE3AF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723165, "uuid": "bfa9ac8c-2eac-40fc-bfbb-d8814e6656a6", "value": "2c376506d0893b193e99f43d861217a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723165, "uuid": "ba54acf0-d1df-4372-81af-f67f245f0248", "value": "3072:6qUhUhEnI2XCIaxTrjCgmQ8GiVDswVAETR:bUWEIKXwr2OmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691723165, "uuid": "5c4fa091-8e09-49c7-9021-64cb78c74e7b", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691723165, "uuid": "232ad28e-cc01-4b5f-a3ff-9fa93a199f87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723165, "uuid": "89f60d75-4f7f-4b35-8fac-816eb2e3711c", "value": "2023-08-10_4f707c67968a14d08cc42958d5341707_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873f917a-3821-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Neshta)", "timestamp": 1691742714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742714, "uuid": "46e28b7f-575c-432f-bc53-a29922e9d504", "comment": "Malware payload (Neshta)", "value": "9aabb6311022cad0605e56a834ceeb9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742714, "uuid": "0f5c8c2a-c6c6-46c9-952d-d1d5d42796bf", "comment": "Malware payload (Neshta)", "value": "8dba5c25c8f19e2be8aed3c06fd0fc679abeec44bd70c96f7193b04a5196bda8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742714, "uuid": "c68b5250-2a2c-4ea7-a413-17c28fbca4f0", "comment": "Malware payload (Neshta)", "value": "e19bb3c2a4ac351f70a296f168b3104f232817b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742714, "uuid": "583a58bb-1ed9-47dc-89af-3abc6dd461d8", "comment": "Malware payload (Neshta)", "value": "ab36ca0fc54a798568ee3ddc9d91df8da6eff409b1522d73b62c88f22b8d497946d40db7c0e978070ca327dbed58eb04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691742714, "uuid": "4f0efa55-c9f2-4439-ac33-c43fcf3ad8e3", "value": "T17C15D051EE78CF42E56B4BB8008EC34E87725C993537C63A59AA50C6D4933C106DFBAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691742714, "uuid": "c0ee3f46-2d65-47b5-ac4a-196a1c4abc06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691742714, "uuid": "3eb57a70-110a-45b6-bcf0-6eed705191b8", "value": "12288:r1PDog3ov8mSqpJVybQaxwqt9LszzdFy+oAfednonBJJfcWVVxtFKNCH/glqTjb:qrv8mSWbybRt9ofdFKAfeIcWXV7Tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691742714, "uuid": "a16b756c-ddf3-4151-9b9c-9b26a1cf7077", "value": 924160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691742714, "uuid": "3743ad6c-4d2d-4469-a426-c68b1cfc0b3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691742714, "uuid": "093514ed-21d9-4bbe-aef6-bb7bee3deb70", "value": "SecuriteInfo.com.FileRepMalware.27070.16388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec327b1b-389a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691794853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691794853, "uuid": "aaa02037-67f7-417d-a19d-2fc01cfd89d4", "comment": "Malware payload (RedLineStealer)", "value": "34b02e830ca7ff9c30cdb24bb380f736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691794853, "uuid": "ae296682-9231-45a7-8c50-e9c70deb4bd4", "comment": "Malware payload (RedLineStealer)", "value": "90874786ba35c410b06275c4c7d70c20fbbfcf8c73351bc22c2265aac4736045", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691794853, "uuid": "12989f08-3131-42ef-b8ad-0a7ee58ce644", "comment": "Malware payload (RedLineStealer)", "value": "32e29cca63b74bad5e4b82c849e5790e82b7e0f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691794853, "uuid": "4ed36c99-c601-4121-aef5-a98d1b627a5f", "comment": "Malware payload (RedLineStealer)", "value": "6298a9e53230be54def419fecae7803ecd2817728c030dc30b4ae4adbefe095c8f42237c9b8a830454dafcc703575caa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691794853, "uuid": "8a3a20f9-27cd-42bc-96d8-6faa0ef71132", "value": "T152D41203ABE99073CDB4273048F607D30B3ABD615838876B7795988F0DB1A85A97573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691794853, "uuid": "7fb403ed-c36b-45a0-b26f-4a3345ab4c17", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691794853, "uuid": "6d2ab862-b4ce-4828-889a-cb37436b7386", "value": "12288:xMryy90TuONVPPrcs80SOa8KG/e7sVNKReEXcp7yAm2PnHIEEp/U:HyePrc9O55G7sbKIEMFPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691794853, "uuid": "9d3ad810-efb8-46e2-b35e-f15492f353a2", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691794853, "uuid": "8eafcf72-cf32-4520-b1a3-0769182ceb54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691794853, "uuid": "b55b7e27-5da8-48a4-a2e7-25c8e3eb9735", "value": "34b02e830ca7ff9c30cdb24bb380f736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a3c861-3822-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691742985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742985, "uuid": "32ea2216-57fd-4a3f-99ea-4616f57df997", "comment": "Malware payload", "value": "7a2f9e0a3a03fcfbe5a40176a6b1d081", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EnergyEfficiencyConference", "colour": "#A49DCA", "exportable": true, "hide_tag": false }, { "name": "main bat", "colour": "#8C31F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742985, "uuid": "afe2d51c-8bef-444c-9cd7-5758ecf899d2", "comment": "Malware payload", "value": "90916deb1bf3009ef1c719ac87b92f16f88116216f9fd4d08fbf5fc98a21d2f6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EnergyEfficiencyConference", "colour": "#A49DCA", "exportable": true, "hide_tag": false }, { "name": "main bat", "colour": "#8C31F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742985, "uuid": "17019f92-8289-453b-84af-0533d169bfe2", "comment": "Malware payload", "value": "4ec56d8d1e5b900bf86f5a44d3f0f0d8972c5a80", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EnergyEfficiencyConference", "colour": "#A49DCA", "exportable": true, "hide_tag": false }, { "name": "main bat", "colour": "#8C31F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742985, "uuid": "f57eca98-572b-41ea-b18f-97b17f820c24", "comment": "Malware payload", "value": "2d7d2f5466be7d052138ebf867b34c92581b26d61f836975193cf3888e7108c31549ad2361f63e2c2d7430e65d6da80b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EnergyEfficiencyConference", "colour": "#A49DCA", "exportable": true, "hide_tag": false }, { "name": "main bat", "colour": "#8C31F8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691742985, "uuid": "d2a0fc35-ae9a-4e2d-a134-d1f19ddeb63f", "value": "T17553E1CCA1E6853B3C1600ADDE269E379EB1BC7EA834789DE5331245F585816DAF8C34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691742985, "uuid": "67c88ca6-c51f-41a5-8cda-f349b5a8c83e", "value": "768:ummzOK1742Fq7ScBs9bDiMpozwxQP1EjQN1EjsE2zOK1J6mmzOK1742Fq7SYBs9L:CRI+cBWHQF6jE6joGRI+YBWHQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691742985, "uuid": "3f776251-e286-4d0c-8fa8-a5cda63b08e6", "value": 63465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691742985, "uuid": "fe08c481-484b-4927-ae83-dc4a29fada4a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691742985, "uuid": "4a5f781f-026b-4d6b-b3ba-3df24b4a857e", "value": "EnergyEfficiencyConference-FirstAnnouncement-2024.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002ada81-3832-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691749789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749789, "uuid": "3949d2a9-13ae-4f8c-8208-5711990324fb", "comment": "Malware payload", "value": "1496b939a358ee2046b647b5b4a81237", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749789, "uuid": "1a112fa5-835c-4505-93f1-0075a3a6ba59", "comment": "Malware payload", "value": "9108870b9c23c8b8d8c35454310325c0518bf100aed1a3b926cd2a603630b503", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749789, "uuid": "f1ae0113-df14-4b72-b618-e4dd9648a216", "comment": "Malware payload", "value": "7b9edcc3beb10fef1a6b5e00a74a027432b05376", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749789, "uuid": "98df33c7-0eec-471e-934c-6cf4f6bd791b", "comment": "Malware payload", "value": "ee8d32c2aa6b166bbab97a124c7fe86437f34a312a5784382a107973b40f2269f621392ef354a8cc5f855b9580b25fe6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749789, "uuid": "56331659-2f31-416c-8f6b-0e2d826c2d44", "value": "T16375CFD27E5C086AD8EA01778E793FB49A2F7C64BA34211F202176EBF9337410D59A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749789, "uuid": "6786affb-f4b6-4929-b91c-30cc5d6a9225", "value": "b6bf355ccd65a9e5de1baa167785f485", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749789, "uuid": "6a86e85f-abfd-4b14-9a73-e303310ced84", "value": "49152:CaIuSwIbFLOAkGy3zdnErPSCTomFDS+BHEuSlVnPgIQroDNa:8FLOAkGkzdnEVomFHKnPwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691749789, "uuid": "a9cafed3-b281-42d5-98af-ac81b62579ae", "value": 1677456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691749789, "uuid": "e26d3161-b536-4c16-866c-8d7774924cb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749789, "uuid": "b4aa138a-9807-4f4d-a163-8029746a1264", "value": "SecuriteInfo.com.Worm.WORM.Lodbak.Gen4.25409.6438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cda7b0-37ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691720908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691720908, "uuid": "1f2182e9-0748-40dd-83f6-974e75262905", "comment": "Malware payload", "value": "c3f9358760006c7346a90396a5bc519e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691720908, "uuid": "e6f5fa98-b50b-4959-ad22-4ddd50c08f6e", "comment": "Malware payload", "value": "91b5e1c6cea17d2a51f81c96838b4307a299e44e6ef13981fb79ccb07257fab5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691720908, "uuid": "d422d3e4-deda-449c-bd3e-dd82020e23aa", "comment": "Malware payload", "value": "00dd6c7d2b4285b82af8d5d4413e8dcc5e53bf46", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691720908, "uuid": "75bd1030-0fc9-4ef4-8e2d-36dceea108a1", "comment": "Malware payload", "value": "827461537be2ee8255f1468bce459d572a3c69d48969cf471ae9fde94a405a2ed7410234e33b979998d41f85abb84c49", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691720908, "uuid": "0ca0b99d-ccc8-4f14-9ce8-442f33c61e22", "value": "T136238884139C9FFEF60E31BD45846C750CE478B8336F41A9DBC69C9EC419E8522A4E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691720908, "uuid": "7e2beb93-de69-465f-a1b7-ffed959aebca", "value": "3c99606240c35ab29d3f57141a743150", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691720908, "uuid": "d1fce631-aff3-4967-8850-aeccbb8baf67", "value": "768:yRIV8lVl+20XGpsIgJsmY+3RUpJrlkjefjKTh+5PAqB09E9bq:yRIV8Ll+24JsO3RUpUeLqh+51B59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691720908, "uuid": "96c9af34-6aca-423b-b2a2-4aa0cb89371f", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691720908, "uuid": "5c90223b-b708-41e1-9053-41483ff1145a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691720908, "uuid": "4c65cd49-ceec-409e-b9f5-ba4e9f8179da", "value": "SecuriteInfo.com.Win32.TrojanX-gen.16290.15680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa2477e-3855-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691765134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691765134, "uuid": "35c8640c-ca40-40a3-b29b-300c79872e06", "comment": "Malware payload (Amadey)", "value": "97662ef173a34d4186af3d4290f1a8eb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691765134, "uuid": "220f3f5e-e88b-492c-9ff4-3c1c03d32cd4", "comment": "Malware payload (Amadey)", "value": "931e87f0d7546965a3376fc4c4891c6dc103e39d80d41b327c86fb9c0295fc7a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691765134, "uuid": "975ac426-6f7a-43d1-ba03-2f1a256f93d2", "comment": "Malware payload (Amadey)", "value": "fb80ffac2192da279c05577df686717ab6a92fff", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691765134, "uuid": "afffdb57-a66b-4838-9ad2-37f3c8641a72", "comment": "Malware payload (Amadey)", "value": "69ed886d121b8033c93eb8d6c1ecec8e19995e53cf695b90497ec3cfcc29dc0bc7593ce73ca4f27213ddbc25d14b4f77", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691765134, "uuid": "5e8c0fff-e779-4130-950e-1ac21003ef4a", "value": "T156D4F103BDC1D5B2D4620832571A6B21793CBE202F65CEEFA7D43A5DD9221D0EB317A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691765134, "uuid": "be7bd4f9-1be4-4b2c-b0dc-7a55b3e25ed0", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691765134, "uuid": "881386ec-797c-4869-950e-dbffb9c93961", "value": "12288:+ToPWBv/cpGrU3yDT+tjIhaEuG2Gwz2eEZtxSxeICe:+TbBv5rUlIaG2GI5wIn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691765134, "uuid": "c84f38f9-50ea-4fe7-8dbc-28102789c4a8", "value": 626450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691765134, "uuid": "fd95944b-b2ee-4134-9ec5-0a53e189d8b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691765134, "uuid": "14ef09d4-b2e1-4292-bd43-13eb561a505b", "value": "97662ef173a34d4186af3d4290f1a8eb.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb46d6cb-3834-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691750962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750962, "uuid": "fe561288-c052-4788-ac21-c75f4ec35a63", "comment": "Malware payload (AgentTesla)", "value": "87cdee5501bef0ce7b1fb4fb10cbef49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750962, "uuid": "d8db5f22-e28a-413c-a1a6-86a894dc12df", "comment": "Malware payload (AgentTesla)", "value": "944c553300f736ef3424512d2b120cd4dc2e52c0d47dda98d6d1c11ad6b1d03e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750962, "uuid": "01d9cdff-45b5-4edd-a080-d9b333935a14", "comment": "Malware payload (AgentTesla)", "value": "13505131582b8e298077594d6ee4e5a68b9b95a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750962, "uuid": "3c3b96a8-961b-4f46-ad09-a1b9d21c0543", "comment": "Malware payload (AgentTesla)", "value": "25bcf8053055bc8e0d9032ae5bbeb49e6103bf93c5d93303e808078aa0ca596a9e8459d30b1d8c5268db94b4061f2cef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750962, "uuid": "607d34f6-2fdd-4033-86c1-2b534f602331", "value": "T13715CF60AD7DBA42F55F0A74008FD70D86738886353AC73A576F5186C7C32C616CBBAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750962, "uuid": "8d06422d-4763-453c-8706-af08b97cf193", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750962, "uuid": "93eedca4-ac22-4e06-9681-f05c8b2cbabe", "value": "24576:91m0Qo3HWAOiDbNrBWWhDld+XF5eTjGR:9tLW6vBj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691750962, "uuid": "da91629a-6955-4181-a51e-fd1b65953a7c", "value": 934912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691750962, "uuid": "ad226ee5-eb0d-491f-aae0-d1a5738324b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750962, "uuid": "93d8d282-6b72-4a4a-8b5b-6f7810b0e281", "value": "230811_Ricevuta di pagamento - Banca Intesa Sanpaolo.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28196e2-387a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691781039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691781039, "uuid": "7aadfa42-dba7-478d-bbe5-6d54bb5922b1", "comment": "Malware payload (RedLineStealer)", "value": "c8da62823dc6e0be61569af49ca08c7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691781039, "uuid": "f1709e9e-db9c-4749-8772-85ea748547e9", "comment": "Malware payload (RedLineStealer)", "value": "95f620bb8a3d4fad49de18eadcfd0a58f393f38641ba31bd07e58101f8abb9d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691781039, "uuid": "d2dc4b89-c9a3-41d6-8c74-1582e0309b64", "comment": "Malware payload (RedLineStealer)", "value": "0b55739ff8932f7e605760a72e11c6d3ccb921b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691781039, "uuid": "0f372f6c-03a0-4ee3-bfe1-bf4a0790df03", "comment": "Malware payload (RedLineStealer)", "value": "673dd450978f3f8c69c71683e26355e8bf46445b8ad0a7cbc10120a382bbc88fe096fb5431cb853d85ec644a9da7ca05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691781039, "uuid": "a6262a53-cf41-45e6-b192-3f56a0048ef3", "value": "T1420523015BE88071D9FC2B7068F602831B35BDE1DEBC839B2706989A5DB25C9993177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691781039, "uuid": "ae9d5cfc-8f58-4c8f-8e98-b6067fcbaf0e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691781039, "uuid": "247440ea-8f48-4de0-ba9e-0812f3788904", "value": "12288:xMrcy90flHFFB+5nb5H52zhOaK9O6ittQb04UDf/GM+zBEd6//Cxrw:dyqBFD+5TJaJ6itK0XL/tqj//Cxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691781039, "uuid": "64b11864-1b00-4617-979d-820e1d2330c7", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691781039, "uuid": "24bed042-f85f-48e7-a80f-3034db93d5a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691781039, "uuid": "fc6f1906-35e4-4f1c-ba2a-f449ec6674af", "value": "c8da62823dc6e0be61569af49ca08c7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73ef148-3822-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691743251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743251, "uuid": "5a07de75-71b7-4d05-99b1-cb19ee3911af", "comment": "Malware payload (AgentTesla)", "value": "d3ce9f854fc241d10cb1792784c08d99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743251, "uuid": "2d23c080-5aeb-4773-b1ef-06e97a13dccc", "comment": "Malware payload (AgentTesla)", "value": "9605975e8a60b03447b1b508f4fa2c0640ff6662481b622b8db8060302b01fd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743251, "uuid": "5e97a248-0958-4a46-89a3-fdfc5604f19e", "comment": "Malware payload (AgentTesla)", "value": "f383f59154a998766de188dfa0934ee90f4b9a23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743251, "uuid": "947d8052-bea0-4611-a8fc-8bd14bdce673", "comment": "Malware payload (AgentTesla)", "value": "27d1a2d94b079497905329692970b3de4239108c7d3a6608665a7e0b6ac7d91c6cde4a80f675044481a5b73815836ae9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743251, "uuid": "d6229bc8-bc97-4827-a4a6-9f4d43f432ba", "value": "T123258C1B79D0294BD42E423E007C6B6CAAEED90D162FD924742CD3A7B2F664C1D5E70B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743251, "uuid": "2337ec5b-da3d-45e0-b789-2520b76ac09e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743251, "uuid": "032e022b-314e-48dc-bf28-cbb2a0bdb840", "value": "24576:gr5z72PKizashhDYbVBC7A5U7sLeCbRGg0gc:M5z7PAasPDYbVU7A5JSCQ3gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691743251, "uuid": "9b370ee4-fc2d-468c-9b5f-ae87fc732434", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691743251, "uuid": "c2461120-1409-4f7e-9575-7bd32e90e8da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743251, "uuid": "fe2ee7a3-1978-47d1-8ab4-414b913c8f2a", "value": "Invoice AR20230714N.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f374e6-389a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691794554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691794554, "uuid": "e21c6e73-f234-4bb7-aceb-deb3f4d97a4e", "comment": "Malware payload (Amadey)", "value": "12eb8703a9d144307c6516231ec47b2b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691794554, "uuid": "df02cf20-b05d-4ffd-ba1a-92be7b113647", "comment": "Malware payload (Amadey)", "value": "960df509c14096625135e9de09a90cc9e79ad0b2852a24d1abf8c1c58d049a37", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691794554, "uuid": "3ed3d3f6-2ca2-47cf-95a5-a60b981b8e3b", "comment": "Malware payload (Amadey)", "value": "5a4b09057eae91775c9ab3dd735dc2e4a2708ead", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691794554, "uuid": "42e889e7-0818-49fb-b271-82be8b0a53d4", "comment": "Malware payload (Amadey)", "value": "317f3f1a667840ab0e489569d2977d9f7a4f74681e479815b20142c41dd89ebd558d61c5cbb05a557f5ed7cbb90566d6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691794554, "uuid": "bd7e30e2-4836-4529-9df9-318f261a6a71", "value": "T1CB03F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691794554, "uuid": "14eafbe6-8696-4cd6-967b-1b04fb9daafb", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691794554, "uuid": "9e1439d4-c030-43ef-b22e-e12111aabf50", "value": 39597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691794554, "uuid": "0a920816-f80d-48b6-8713-879b7afdbcb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691794554, "uuid": "cb718fdd-4730-4d71-9334-95ac0bf0a352", "value": "12eb8703a9d144307c6516231ec47b2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce1e606-384d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691761729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761729, "uuid": "414062e4-2e9e-4f70-93f0-568c6a6e1540", "comment": "Malware payload (GuLoader)", "value": "d51d8387bd9e85c1203b153d4b5cc41e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761729, "uuid": "8d9ac431-034e-4bdf-bb8a-10d8b6244bec", "comment": "Malware payload (GuLoader)", "value": "967770f916b503c55258513e6165d6333fea33f66d392be70aa4b91b2e4fe6a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761729, "uuid": "1bdfd427-e85f-4446-8672-a50e3661184f", "comment": "Malware payload (GuLoader)", "value": "04e060084c1667cc4c2a0964d84353345a9bc940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761729, "uuid": "98091290-4dfb-4f65-8272-b916add07f98", "comment": "Malware payload (GuLoader)", "value": "2e6c851c48eaf9dd0ff0d0d3a7a78fe74ec781c87d9cb6ba22486e198001f8fc1951f546a4ad4b245a54ab07ba6b0301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761729, "uuid": "977eaad5-28d4-4199-bfa2-b7b65ce5519b", "value": "T1C99523EE75BBEC91F1091D70A521BA3C1173D618247AC79E4748AEC93CBECA6F43411A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761729, "uuid": "ebc6b02f-af4c-4257-be89-974cea5cdcb3", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761729, "uuid": "4f1be35f-afb2-45c0-a679-9a3fd294b12d", "value": "49152:Y+rxPhOd3sI4+hKa3OVplQNTySl+XuQDc0h+DP:YCxP9+YuIp+Ns+Kc0h+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691761729, "uuid": "0a21f7ca-abd9-4782-8b6e-7171030e918c", "value": 1955528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691761729, "uuid": "c85d7d7b-9f7f-46a6-86bb-9734a0248c95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761729, "uuid": "fc66e2ae-60fa-4f62-b63a-36e1d9e25294", "value": "I-ID-4175285786-D07450364_20230803042004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218aa8a1-3850-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691762730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762730, "uuid": "ca52e0b4-247a-4e0a-9ff4-01a69adbc824", "comment": "Malware payload (Amadey)", "value": "4c610e08fcea6c43adc0354bc889a6ea", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762730, "uuid": "d9847c17-bd86-4299-964e-89260faac277", "comment": "Malware payload (Amadey)", "value": "97acc40979e2c0035df522facaf12fcf594154899ea1c092c1cd9e802f6521f5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762730, "uuid": "d2ff7a7c-19bc-4e77-8b50-fd753e402db1", "comment": "Malware payload (Amadey)", "value": "8d6725fe10e74c1dafb8a52d7f7c81ae94d44bb4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762730, "uuid": "533bf8ba-8cf5-4963-90a9-2a7938db9030", "comment": "Malware payload (Amadey)", "value": "a2b1b5d08cb8ea02fdc62a06e37363cf3b409c05996947bb6a3b31958145c6de364faa9b6b14ea91c794dad625604418", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762730, "uuid": "1b09b680-dbf9-4c12-8f0a-1c5031b40dc3", "value": "T1C9D41213BAE88062D6F9177018FB12871A35BCA45D78D3AB2782955E19337C8FA71337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762730, "uuid": "dafe36d5-fa48-4815-9be7-fc0e4c7c167f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762730, "uuid": "3824714c-5941-4d23-bedd-64a7048c756c", "value": "12288:OMray90Wu8OeXdJgqqXVbkNlSoCl44Q+ZYmZNtYZ1mQEWZ0K9Lo:IyFuQXdCqqXWNlSXlPQ+SmvtKHEWZXLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691762730, "uuid": "fde43b0d-013d-4a97-ad3a-e5583b8a5448", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691762730, "uuid": "06f060c6-fb6b-44a2-94f4-a04bb587a6a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762730, "uuid": "feb71148-1248-4c8d-8620-505ef42b07b6", "value": "4c610e08fcea6c43adc0354bc889a6ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c8ffbf-383d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Neshta)", "timestamp": 1691754708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691754708, "uuid": "ffd1f0a3-f60a-420b-a7b7-8eef069b23b9", "comment": "Malware payload (Neshta)", "value": "9ae4842303e0ad115bdd254913a4bb21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691754708, "uuid": "abebd000-baeb-475a-bf72-fe870189829b", "comment": "Malware payload (Neshta)", "value": "995a51be969ea8a589668c591764d0675368c72f46539744babd58722a4c73c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691754708, "uuid": "51de1307-9e60-40f3-9e0f-7b8ed43b07b3", "comment": "Malware payload (Neshta)", "value": "acd68f1ed49882bf1c7a0b6609eab9ed0fcc7758", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691754708, "uuid": "d4fa1b83-27bf-4ee1-9038-69540f70e963", "comment": "Malware payload (Neshta)", "value": "068391f5b8f258fb062eae2cdb6c24c7fb67f8b8693bbe97e62bc1c68ddaab5afb06fff77168e88dff9ebeae3c122738", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691754708, "uuid": "3542995c-5a3f-4f0f-a8c1-5f95c273aebd", "value": "T1B115D060EE39DF82E56B4BB8508ED70D83725C893122C6395DAB51CAD4837C106DB7AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691754708, "uuid": "9536d589-cd9b-4ea8-85f5-55b8d3f94236", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691754708, "uuid": "7def38a0-612f-43ed-bab8-7499a38a0be7", "value": "12288:N1PDogWdQyMffjBAVY7s45gr/cUepSDzj5NRm+mmo6rkmkraub9KSUEYbrvClqTj:MdRMfIY7ssURjdClmk5sdrhTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691754708, "uuid": "5b8bd110-ff39-4c3f-af9e-bba8fc0b3e7d", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691754708, "uuid": "3e3cc83c-1695-4961-9bb3-98f54aef684b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691754708, "uuid": "bd739b10-3b84-4c98-b52a-5e16fe094f14", "value": "9ae4842303e0ad115bdd254913a4bb21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e184507-3894-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691792145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792145, "uuid": "35a886f3-4c6e-42bf-a5ab-7b2431c6f988", "comment": "Malware payload (Amadey)", "value": "b425689b410ffdb093bfc4a4ecdbd627", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792145, "uuid": "ea23a363-f1d4-41a2-8252-fed9892c0f06", "comment": "Malware payload (Amadey)", "value": "9a9a05d1de3b25de07c0dc6f600f6654baf16df322e56f8d2fbdebb3cb9128cb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792145, "uuid": "9a824683-a03a-4ea2-8c7e-cedf287e2ce8", "comment": "Malware payload (Amadey)", "value": "7fadc9d8bf36f9334337676722f7d2459f954887", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691792145, "uuid": "61ae27f6-946b-456f-8ce8-d694d8011be9", "comment": "Malware payload (Amadey)", "value": "81446981f29383a9b7a859a171d612f7154446d267262c5d52ad22c5cda60dc8586c2c468ba43f1ab31c7c30901150da", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691792145, "uuid": "db826e5b-ac05-42f1-8ac3-00975db4bbcf", "value": "T11BF42342B7E8C176EDF92B7049F302930B367CA16C64C3763B86A55A4D32A85E47437B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691792145, "uuid": "2ab02058-0458-44c3-810b-a2db583f1704", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691792145, "uuid": "21d4993e-546b-4371-929c-45015bcfcc1e", "value": "12288:sMray90vJJzITDFLzu9+D1aEq95Vjy7LGzh95PDFh6dkEhZP3j5qH/Gbx2DPXP8:Oy2JFgxa9hVKLGtTDFhqPbiebx2L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691792145, "uuid": "1d19caf3-71fe-4de5-85b8-96101b76e03c", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691792145, "uuid": "6868939e-8c11-4782-a653-f3e1479f545e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691792145, "uuid": "e1eead94-367d-4614-a95c-908cc7fb82c1", "value": "b425689b410ffdb093bfc4a4ecdbd627.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7464e71e-3834-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691750843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750843, "uuid": "43d8f04a-1892-4d24-bc0a-edca72ee5add", "comment": "Malware payload (AgentTesla)", "value": "2e42301bb9145fa9629837577f636a7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750843, "uuid": "d06447ee-ee55-4f0b-85df-22e89d35b55e", "comment": "Malware payload (AgentTesla)", "value": "9bee15aa43bcdb1c361ba488354de254e7860b9f006ad7ce7602adc6d7667e62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750843, "uuid": "791e174d-38e4-47e5-8c8a-2db83a3db61c", "comment": "Malware payload (AgentTesla)", "value": "12abf8993338b013191486080c3d8ecdf71a5ed6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750843, "uuid": "c365c008-837b-4080-8716-4833de8107ed", "comment": "Malware payload (AgentTesla)", "value": "6fbe9a4f9f3597adf6339dd02e223448c9d6f31bd97f201a18caf406b199da158c1e321b2f809ee4f36afe845fd2e4d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750843, "uuid": "eaa49537-2861-45b3-a4dc-19101fd81e3c", "value": "T1DA04F907B58B8AB6E35C5736CAE701040BB9D58276A7D6C9F98F93E648033FADD04607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750843, "uuid": "f7972820-c959-4b8c-bcfe-22a43bba63cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750843, "uuid": "d4e386a8-af30-4aef-8294-68c9ce197fcd", "value": "3072:rup6fiPfXgWDRdpq+sZG1IWkfEDZDIU7osipKUqJz:K8EfXgWDvpq+6kIuZDIU7orK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691750843, "uuid": "28e4170d-7bf0-4b42-8564-07f17cd1a7b3", "value": 181760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691750843, "uuid": "d8c6980b-9a58-430b-b85b-4246d71ce8d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750843, "uuid": "ef822914-aa22-4cfb-ad6b-a44aaf0a7c17", "value": "Ferlam Technologies LLC 11th August 2023 Product Order pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678b47e1-3843-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691757264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757264, "uuid": "8fce91fc-eea1-49b5-ba2f-cac0c670b7c7", "comment": "Malware payload (AgentTesla)", "value": "4c05e47fc2e656df12938d7f81ed51ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757264, "uuid": "a1a8248c-ef4e-4781-afd5-84696f77093d", "comment": "Malware payload (AgentTesla)", "value": "9da5b7337f022a122afdd84c2744861da80dd7575f24c9a6abf9b00b2a0d2870", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757264, "uuid": "f2d48fcf-1b3d-4733-a197-f089b879216d", "comment": "Malware payload (AgentTesla)", "value": "f053cf558ab7ea59c44da66fd757f367880880d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757264, "uuid": "0062a12c-9354-4104-abfe-ad39121fe6ba", "comment": "Malware payload (AgentTesla)", "value": "b6d7691c7eb2c40881a592c6879a3a88727b248bdb5cf0de6fb9c4593cae95971d75b072e69dc355180fde291467b4ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757264, "uuid": "c75d7455-433c-4f88-ac2a-e96a2b23013d", "value": "T198E4CF60ED39DE42E54F4BB9008FD70D82725D4A3626C23A6AAB50C6D4877C206DF79F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757264, "uuid": "85a6db94-25fc-4e85-9ab8-1e7dde92912b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757264, "uuid": "1c3f6b2b-594a-4a47-a924-ed9a0f9494bf", "value": "12288:n4qum4UrIhggCp9KBaNYB0gEU2gTIDzDx7BSbOlqTj:4qum46gCpz+evdKIjx78bVTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691757264, "uuid": "8fc088fa-3014-4469-b0bc-a410c8370288", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691757264, "uuid": "daf5e52f-b5f8-4cf6-9f06-67bfc83ff27c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757264, "uuid": "7c8f7c19-9817-48f9-8edd-0b25a19202a9", "value": "SecuriteInfo.com.Win32.PWSX-gen.19792.12817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2927a790-3844-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Neshta)", "timestamp": 1691757589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757589, "uuid": "36cff7e3-e31f-4eb1-a37f-684413659f47", "comment": "Malware payload (Neshta)", "value": "ba2b37ae83f07749c8ae0287d5344c90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757589, "uuid": "38f3e64e-d0fa-498e-ab3a-df1fe706f02b", "comment": "Malware payload (Neshta)", "value": "9de15a5c7e9cdefb9a48de4039027de8687838849d9588434564a343d15a9355", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757589, "uuid": "cf9489ff-f9af-419d-bf9c-f7747402c88f", "comment": "Malware payload (Neshta)", "value": "487daab3d122fc23cdf0c671430df6d46e3d2c56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757589, "uuid": "14ff9ddb-46be-4697-96b9-99a812fd2fdb", "comment": "Malware payload (Neshta)", "value": "1fc921044034d760131e95a07847c568a555cb2318c43be0101c0cc0c9ce8ea6d88ea494121d1cc4415f39706fe515f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757589, "uuid": "ef0fcbbe-9e71-4a00-a869-50382fd7bed5", "value": "T1B1F4D050EE79DE82E54F4B79008FD70D82714D8A3522C53A6AAB50C6C4977C206DFBAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757589, "uuid": "3f5be7da-8405-4aa0-8130-ab7c71ae62c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757589, "uuid": "38093ad2-d7da-49f3-8a20-b2203b0aa881", "value": "12288:ovRRMweXMw4NoV1VSMC3BmMoq669cfRYv/kpm/6G51xwxEdFBJuHJZlqTjJ:2fMlXMw7te669cfRY+G51xwqdoATjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691757589, "uuid": "c19c5738-6760-42cc-8c8f-663543a47f71", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691757589, "uuid": "1859f75b-96fa-488c-a11f-e76029204753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757589, "uuid": "083fa00a-ea14-4330-bc50-649f47d0c2b9", "value": "ba2b37ae83f07749c8ae0287d5344c90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9f2879-3825-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691744601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744601, "uuid": "be76dee7-1e2b-4466-815a-c25f4b38e8de", "comment": "Malware payload", "value": "73cf9417cb6c8e5edb615c32e54cf7ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Statc", "colour": "#6F63E5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744601, "uuid": "3bec3dc9-e604-4f86-9e32-a8eeeed59742", "comment": "Malware payload", "value": "9e867a93b0496b019e18dd781615f4b14b7ab105e05897e1ec6f9233e9823c8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Statc", "colour": "#6F63E5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744601, "uuid": "2b7b9d09-7f22-4d51-89d8-a0fd6f0d52ec", "comment": "Malware payload", "value": "ced2debc3f89c80181013646b2578f06267193d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Statc", "colour": "#6F63E5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744601, "uuid": "57ea0caf-b2b5-48af-ae80-87a5f317a250", "comment": "Malware payload", "value": "b1a791b2fcc69794c334531012405761a4ed6cfc22c9a03c3ab15d60f54c788d41175b2238554cd54d53a147c27106df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Statc", "colour": "#6F63E5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744601, "uuid": "f67057ac-f41c-4056-b78b-3217b4253833", "value": "T1C805191AFBE611E4F5BAD1389A93312AFC7138654734A7DB46905A0B1F31BE49E3E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744601, "uuid": "bf8d8877-3bea-47f3-848d-18cde04c9143", "value": "842c1d39a22d44b972448d6697b23c40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744601, "uuid": "974fb97b-01a0-4a6d-9dfe-8a74ca19590c", "value": "12288:S/iVDvVp4zXMWs0/tm5BViXhCy3Qz4EohmZzb/HOi+:S/iVTVpvF0l6vyAzlmSai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691744601, "uuid": "35772ce2-1d48-40cd-89bf-c213e4b2f8bd", "value": 851312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691744601, "uuid": "aefeafcf-df24-4635-b74a-1766b06792a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744601, "uuid": "e901986c-d0fe-4a00-b1ea-93163ace6122", "value": "helper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d2be9f-3873-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691777738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691777738, "uuid": "9d4c9ad5-e7b4-4243-a6b5-3eafea5ff0d8", "comment": "Malware payload (Amadey)", "value": "8e0cf22fee900aec3113e424e31b5e03", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691777738, "uuid": "c0061d04-df33-4930-a3b9-a9d0a3a92608", "comment": "Malware payload (Amadey)", "value": "9eafb7111c4e8777127bbd0cb884b9e0cc80efdbab663e31d390043c8d0c2c68", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691777738, "uuid": "1a139fc8-c1a5-403b-b425-6eeb8536642a", "comment": "Malware payload (Amadey)", "value": "ea25c9013308655d85f36c006dec77a9a58a0c65", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691777738, "uuid": "3f6f6ebc-6a4a-424d-8800-3b9ba05165ad", "comment": "Malware payload (Amadey)", "value": "e30cf4e71403069c4c31dbae1478c8adcb376229f92e64de0bf7fefeabdf39bc55ee67aa6cb5e8776e08e0283ecb98ed", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691777738, "uuid": "19dd2c98-b56e-4f85-b5b7-e883fe35d0f1", "value": "T1C5D41212A7DD8073EDB617706CFB02D30B3ABC915D7897AB235AA4194C72AD0A971337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691777738, "uuid": "211ba931-aad9-47a8-84d7-f1aaa7d62177", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691777738, "uuid": "358fac41-a537-4e7e-a7e4-b8dd19955057", "value": "12288:GMrly906hu4LxXs7OkKw/e7W/KKRpEXfp788sxPYgyuXaCQdt:3yzh67OkPG7WSKjEBmJ8uXabf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691777738, "uuid": "e68c6d4e-6150-47e9-8ca9-586fc4268c0f", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691777738, "uuid": "e6adf611-5d16-4f89-be16-dc93a35d7d1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691777738, "uuid": "f3b32245-deb4-4439-8dc7-e484893de6bd", "value": "8e0cf22fee900aec3113e424e31b5e03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f051e6e-3824-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691743801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743801, "uuid": "d72cec48-3a1f-4f8c-b451-91b492ca343c", "comment": "Malware payload (Mirai)", "value": "872d96c47e30739fcbca51d7f9eff657", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743801, "uuid": "68a59b94-20c6-41fd-8c17-c3e8a24c69dd", "comment": "Malware payload (Mirai)", "value": "9fea55b5dd337dcd5c00f4b9c1a09ad2ed5cb7f2c69dc21a7f50f55af0809f89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743801, "uuid": "820f1ace-8a78-40a6-b5e9-396fd7299257", "comment": "Malware payload (Mirai)", "value": "c60c8f11d35b074dc7bfba5c29043692cd9b86db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743801, "uuid": "adfc51d9-29e3-4627-88fc-19943c9da4fa", "comment": "Malware payload (Mirai)", "value": "80dcc8c819ce5aebc85f014727dc180d72c7668c78a2394f663096da68bfebe5eedb16f9f9443f227345f11d9f56d9d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743801, "uuid": "5c248058-f791-42d6-a308-7bac23a94bec", "value": "T1FCF33A05E6408B17C1E2277AE6CF824D33339B94A3DB33159938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743801, "uuid": "e77c1aee-9916-4b47-9996-8a50c1fde2fb", "value": "3072:f1g2iIFdVzqKA7Y6ISag0/RgqnyLRM/9lzNmFwfBxKQodn:tg2VFdVzBA7fISaneqnydM/9/mFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691743801, "uuid": "9f6c0e8b-3985-4316-beb6-9e74dd9c1279", "value": 159896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691743801, "uuid": "d5cdf38c-c5ae-4324-b42b-35928870f96f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743801, "uuid": "fc2f6f4b-25b3-43bf-8cc4-ac586b29c548", "value": "872d96c47e30739fcbca51d7f9eff657", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3fb081-380b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691733190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733190, "uuid": "bd5d95d9-f774-41b7-87ca-bcbfe976c1cc", "comment": "Malware payload (AgentTesla)", "value": "d377565b9e65d25f1a3c0317007ff4d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733190, "uuid": "6ca596ba-7af1-460d-a5a5-3f234353ab42", "comment": "Malware payload (AgentTesla)", "value": "a0b6b9a0c87f57a88be1c4d631fb3d4f181eb545e7266d5c7463ff169f4b358b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733190, "uuid": "8a67f5b6-6e8c-40f7-84d5-8406a8ca3cef", "comment": "Malware payload (AgentTesla)", "value": "af583b76174d3d71bbb5a8d5efb2b79ba37ba13a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733190, "uuid": "ca81952f-cc4f-4268-8ffe-8f5f24976a81", "comment": "Malware payload (AgentTesla)", "value": "a298392e127921fbdfb9a1e2876153490bfc81e8b7702f71a647dae127c7cbf41bba06f2bd1e3cab874a71def2d54189", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733190, "uuid": "4630d228-17da-434a-b55f-827e932641ce", "value": "T12815D060BE789F86E56B4BF9108ED30E87715C893527C53A1AAB50C9D0933C106DB7AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733190, "uuid": "45fcec5c-47d8-45bc-8307-af44bbb44a38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733190, "uuid": "3d286653-af40-4da0-8549-b1dd7782a3fe", "value": "24576:dexviwekalEKQP6RGVRW2vGbKvc43UVK45oxTja:oviwekalPZSRWkmKvc43UVB5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691733190, "uuid": "e16f2490-40dc-4cf3-b605-e132f61329c0", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691733190, "uuid": "616e339f-2024-46be-ad64-5aec0a71c71c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733190, "uuid": "e9d9148a-0a16-4e4e-9815-a965763b5cb1", "value": "S00479527.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b877f24-389b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691795147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691795147, "uuid": "fc1287c5-9aa8-41b0-9122-ca80f8c5fc89", "comment": "Malware payload (RedLineStealer)", "value": "06583360c0d6e32c90cdecaa4a1d11dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691795147, "uuid": "61e1c5f0-2d3e-46d1-a9ce-d4b790474bdf", "comment": "Malware payload (RedLineStealer)", "value": "a175a6cfa9cb27c54052c806312c08f88a1dc7f3662ea6fa5551353d6c119b22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691795147, "uuid": "98b0c567-e5ba-43f1-a79c-70da0c9220fa", "comment": "Malware payload (RedLineStealer)", "value": "11b8e54296307f69f310281656ea4315d5e7308f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691795147, "uuid": "53790e00-5fba-4fa5-87f9-f26fe18be7b1", "comment": "Malware payload (RedLineStealer)", "value": "1bb03ba7f3d2a6485a0b344dd1fc3bb01821d20d66c32f3fb055caf22e12f30bb5b30af82d6e4c40ce020d5bcac67f66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691795147, "uuid": "fb1f605c-b467-4823-aa25-73c2e9b093e4", "value": "T12AF4229B7BE48022E9F6277068F2039B1F367CA55974477F1381A96E4C71685E83832F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691795147, "uuid": "7f52f595-f13a-4be0-bfbe-e85fe2fafc16", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691795147, "uuid": "bae86e0b-ef61-47c2-a03d-751123ee7aa4", "value": "12288:IMrYy90gYbF3aXqWzdHJ9mW2lsM/k2FJ8xYZXTkRHcU23XIfeOlJD9n5+33v:gyeF3aX7/9m5iakoixYZ48U23WeO15+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691795147, "uuid": "d1f4400d-0140-4648-91d4-42ba9778692f", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691795147, "uuid": "2cae5d2f-a72d-4c01-93d1-6e0eb451cf63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691795147, "uuid": "baedd4c0-72e5-460a-9a38-f7ecd8de8426", "value": "a175a6cfa9cb27c54052c806312c08f88a1dc7f3662ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b773db4-3893-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1691791496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791496, "uuid": "9aeab68d-4d2d-48c1-a1e6-45b1874bc4d9", "comment": "Malware payload (Smoke Loader)", "value": "a76e515e1150c903070a1eb1b2d216c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791496, "uuid": "37493e9f-f062-4e78-8a94-90741061d973", "comment": "Malware payload (Smoke Loader)", "value": "a3b9b231eedc6701cd76d624ed7dbfab8614e8a07088512b5e6ef3aa44235f50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791496, "uuid": "25144128-6d84-448f-a2e0-56159f45418a", "comment": "Malware payload (Smoke Loader)", "value": "e747dbe088744a6de47ffcc9072404bfa60545ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791496, "uuid": "75c2aacf-83b0-43c0-9a45-ab3149c40e45", "comment": "Malware payload (Smoke Loader)", "value": "03d877f654a8298881d4ac82ae77689e6f22eb4695cb3be0a47016b616b6d21175b3361f9f2f13bfb3eb71c5c7e68022", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791496, "uuid": "314457fb-2ba2-4041-8117-391e5a164c23", "value": "T12644CF213A82D072C41B41349825F6F46B7FB8729668C58B37A43FBF6E303E16766395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791496, "uuid": "250d7c9b-7ecb-4a41-91d6-6abb49b5abfb", "value": "b843f9632af58019508eefd6a2b3c3d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791496, "uuid": "4b7172bd-2f32-491a-b1dd-30f77b336639", "value": "3072:YQ9Xbck2cLeyJkXQ+mqweLJXyRe2AE463tT0vLbgUWlrba5h2OT:YIB2cLeXQ+mgQe29ZPxO2OT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691791496, "uuid": "7759ffbd-d444-46d1-854a-f1483204e6fb", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691791496, "uuid": "82fdeb14-b5d0-487e-9c6a-dd4031861135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791496, "uuid": "33e2c876-259b-4656-b682-4e6e5485dda5", "value": "a76e515e1150c903070a1eb1b2d216c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d31986-3803-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691729686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729686, "uuid": "87552575-3da9-4630-8bdf-6ee8f77c334f", "comment": "Malware payload (Mirai)", "value": "923d8e294fbbe89e0496731b76f59893", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729686, "uuid": "304d33d1-9892-4608-84e6-44a3e27e1e0c", "comment": "Malware payload (Mirai)", "value": "a88bb3c4fd3313289a3934a13f6d3c423cb9680d5987632772a63e8df212d4ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729686, "uuid": "1e8b8862-2a80-4881-9846-e2ddde61c91f", "comment": "Malware payload (Mirai)", "value": "fc69aa6445d3ff078f56dd506f7085c023fa0660", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729686, "uuid": "2f794928-b78e-4c7b-b8d0-24f209fc15a6", "comment": "Malware payload (Mirai)", "value": "35bcd23c156caa99b57f3f34fe9fc66443ad4518f55d8c3550f591468ea5e01c0e53efe083e7220168f4e028a07883e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729686, "uuid": "f1ad7465-d935-4b9e-a123-60235b9c0eef", "value": "T1F8632891BC819613C6D1127BFA6E028D3B2613E8E3DF72079E225F2137C696B0D37A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729686, "uuid": "da940c95-2455-405e-b1f3-6e54ad0cb635", "value": "1536:ZZ1ltCm9v09nDaI/KrV8YqWzTHcOVNu3w3qvXW1:ZZkK+rWzTHcSN8jXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691729686, "uuid": "32b1c0aa-02c7-4b92-a3e1-e6013a91116e", "value": 66908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691729686, "uuid": "5726e63a-46df-45d9-9d97-5292bd882176", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729686, "uuid": "d6f8ede0-93fd-4a0d-83c7-604f8af1bc60", "value": "923d8e294fbbe89e0496731b76f59893", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6143f061-3834-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691750811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750811, "uuid": "972ed937-1571-43ec-af82-04b1f38bbf53", "comment": "Malware payload (AgentTesla)", "value": "35f2e6822481eebdfde012a451934e16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750811, "uuid": "8a7ab11a-4875-4f08-bd17-6fdf500a27da", "comment": "Malware payload (AgentTesla)", "value": "aaa666a06364fb87939e053b728ff0118aeb6eabb1a73ba7810709fd43965fc8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750811, "uuid": "8e9151ee-9d72-404d-abe0-b7582e0fa8b1", "comment": "Malware payload (AgentTesla)", "value": "435e92761c66804529a31e989449ffc6e1619e26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750811, "uuid": "bdfdffa4-802c-4e3e-a526-b29d07f4df40", "comment": "Malware payload (AgentTesla)", "value": "f12b0f29d8cbae8870509061ef9f0b3950bbfce7181cc807c5918ac409a878e790f9abe559ff1fab22b3187f92a5b434", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750811, "uuid": "487a0543-6187-47af-943e-6f72b1826fbd", "value": "T1301499E0317D93CFD1A28DB10F898AB079F135AC98C4160DA0F69B2ED3D6355589C9FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750811, "uuid": "465fda1d-74bb-4faf-9f0e-447dbac7d1a0", "value": "1536:l+jUt+7t8hxAY1c9wqvnAv77vvvvv7vvvvvvv7vvvvv64+mhhhm+DtqOgE:l+o47t8hL+9wqY+mhhhmitqOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691750811, "uuid": "bc534844-804a-49bd-aae2-333aa949d368", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691750811, "uuid": "c5b09f0a-3fe5-4f46-9c95-5a2a9bfdba7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750811, "uuid": "d3f20f1e-7a96-4faf-9841-806318f75447", "value": "finance.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6765d07b-389e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691796348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691796348, "uuid": "9eb48222-3a83-4071-9917-63695c78f296", "comment": "Malware payload (Amadey)", "value": "bb92eec0e4628c08f7f3aea3676dc7f2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691796348, "uuid": "02bc4abb-2695-4c86-b3e8-8e15a13a4788", "comment": "Malware payload (Amadey)", "value": "aaff3398128eb3c18f7dfe394b60492daaad72fe71569fc155b34fb4b343d03d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691796348, "uuid": "616e3cb7-2d16-4b8e-bcd9-b027b4f646a1", "comment": "Malware payload (Amadey)", "value": "f68b740fed5998d0342cda83c75fa85603d9d41b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691796348, "uuid": "702f0566-0be7-48ad-8676-bac35a9dc454", "comment": "Malware payload (Amadey)", "value": "6648798ca3c0d629a2f6c07933c755346b3db018ef0929be3a33dd75503ab05bf61b0ba4edc87a2bbdb554386ad5b28f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691796348, "uuid": "be2d5a4e-8808-4f08-87f3-59af5416bc86", "value": "T18C6439417952C072D960A1721AB5BFF2C59D68249BB049DB7BC00F76DB212E77A30F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691796348, "uuid": "47b54f94-cadf-43de-a804-e202de122eb0", "value": "44e769941d2c6ad88bf42ac4adb36135", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691796348, "uuid": "e20bf302-9bac-4821-86a7-95132ebc09fd", "value": "6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691796348, "uuid": "efeaea83-0979-4b0a-81fc-a650a8fc3062", "value": 321142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691796348, "uuid": "6bc0fcf6-d0f9-42dd-a07e-38257a9fb89b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691796348, "uuid": "d77f1b81-8ac0-407b-9c4a-9503ec090ab2", "value": "bb92eec0e4628c08f7f3aea3676dc7f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f3d9f2-3867-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691772938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691772938, "uuid": "668f268a-4289-462a-9738-81446991f7cf", "comment": "Malware payload (RedLineStealer)", "value": "5378e7f1815bcbf3844f21f8c7094d2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691772938, "uuid": "33f794e1-c9bc-471b-ab69-4c3869d05336", "comment": "Malware payload (RedLineStealer)", "value": "ac57dd911a8c1808db3c417e20e59b82b8b93f3fef423dc553029443ece8d190", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691772938, "uuid": "441d2319-f029-4a0a-aff9-debb6715626e", "comment": "Malware payload (RedLineStealer)", "value": "bf1cee56768196cd8ca118e16347aa0e9e908512", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691772938, "uuid": "4151945a-992c-465b-9641-430f782aae00", "comment": "Malware payload (RedLineStealer)", "value": "af4da9c100805344e72823513734da89bdbc4008f835b9dcc50fe03a7f5cbd5b0762f8cd772338c7b839f518b66da640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691772938, "uuid": "e80b3a21-0aaa-423f-b4fc-ee2bcc957db3", "value": "T196D41203E7E88172D9B927704CF706D71A373CB09C64D32A2785A86A1D33599E97633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691772938, "uuid": "10536611-8217-4331-9197-233f18444f22", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691772938, "uuid": "7750aba1-211c-47a8-b3aa-2ecc80e77969", "value": "12288:AMrzy90e4x7wPu9jAIIYCgk22Fbev3iFikP+EWUtxUKD1:jyHqZ98IIn22FbevSpiUDD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691772938, "uuid": "d3fb4816-3940-46c0-bc37-f0fd581c4caf", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691772938, "uuid": "668ed1e4-0b29-4733-8832-3c6fce46392b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691772938, "uuid": "5cdd1daa-13f4-4e96-b60e-f4d141b934e3", "value": "5378e7f1815bcbf3844f21f8c7094d2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee592d1b-37fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1691726137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691726137, "uuid": "942feed2-94df-44a2-bf5e-7fa738d7c506", "comment": "Malware payload (QuasarRAT)", "value": "fc44d05db7c9bc9dcebef7e3a5b96d4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691726137, "uuid": "b0fccf90-3956-40be-bd8a-dd299fec2724", "comment": "Malware payload (QuasarRAT)", "value": "ad9918b49fa95dfe97c75e43e108213059e53dde22e8afb73e63d44eb0699e1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691726137, "uuid": "29a3d03c-b293-485d-b680-f95173aba6fa", "comment": "Malware payload (QuasarRAT)", "value": "59f021c6e90eda72da09f14339c6a18e0c95c052", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691726137, "uuid": "4c331c83-e82d-488f-9bb6-bdace51404f2", "comment": "Malware payload (QuasarRAT)", "value": "319ec1f71938ed1bc7f6973c374f1a6f83fbdefe9a22799822782a8bd944c3e89c0d9fe50b911ee813c89adb921153b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691726137, "uuid": "f94510f9-c065-42e8-b3bf-e86be5e9a625", "value": "T122A4D0C26E917864F422DE329D3EC6E7263EFD614D2877992258FA2F05710E1C273B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691726137, "uuid": "9485c184-8683-4f59-9e22-173b7f263788", "value": "2c86f6022110f96a017da9bcdba46b29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691726137, "uuid": "f14b66ba-4e3b-4380-8da5-b3a6f57d5d52", "value": "12288:IRdPFQ5NAb6jLjFQhdSf14ERIZWScCH9aQ8XEPtZ4R:IR05o6vE/ERLzoatXEPteR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691726137, "uuid": "2e828fbe-b3e9-482a-a75b-e1f10760809a", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691726137, "uuid": "88f282d9-eed7-4864-9d19-98ce96cec9ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691726137, "uuid": "4b5af3c3-cc08-4c1e-b80c-576e88c663ab", "value": "fc44d05db7c9bc9dcebef7e3a5b96d4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ab3345-3874-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691778338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691778338, "uuid": "42f0168b-5791-41b3-ba51-c5c38074cffe", "comment": "Malware payload (NetSupport)", "value": "a406fde5447c79aa54c7a487c114bcac", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691778338, "uuid": "85b7805d-10d9-47a3-adef-3f8268e029dd", "comment": "Malware payload (NetSupport)", "value": "ae915c486fed04e57bba734de64d67017d95dd93b88770a53b88bd8b9906f897", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691778338, "uuid": "ee748223-7b5c-4533-b963-d9c4af3ba2c0", "comment": "Malware payload (NetSupport)", "value": "0fd2022c1b84d5922cd9532787536c14cfd7863f", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691778338, "uuid": "454c6b1b-7d11-444b-beb0-11a277a121ca", "comment": "Malware payload (NetSupport)", "value": "11bb8f923ed2154134c2e2f833f154ac06230c99e177ef0804f3b4c1e13ee20cc269af307cbba903062090a132e85899", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691778338, "uuid": "5e24c08f-82ad-4e57-9446-e3ed7aac146f", "value": "T118317E3726E5020CC2B5463B58B1BA13972AB80DD90F8B8F32505E781C5958CB925F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691778338, "uuid": "3e00b2df-9a0c-438d-b3ea-b24ae5afdb6d", "value": "24:8N6ZsxEeA0GN7oKIbaghW8nA+WsWV+/CWvyDaBwAC7l7pEQeyTppTpZab/2XT:8Y0Z+jv6WNDaBwACh7iQ9ab2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691778338, "uuid": "d4fc6760-8d58-4fc7-94c5-06c7a5921a1d", "value": 1557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691778338, "uuid": "6a82f1fd-4c8f-4814-9e60-f0af32c42b41", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691778338, "uuid": "4b6ab769-733a-4f1e-ab93-7fc4ab99a232", "value": "representative.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d091884-3842-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691756763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691756763, "uuid": "7635673f-c804-4943-8e9c-d1bcc583f033", "comment": "Malware payload (NetSupport)", "value": "e0f8f9993b9679a6be126eb8373e4430", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691756763, "uuid": "620050fb-e43f-4cf7-ad4c-8be10a98010c", "comment": "Malware payload (NetSupport)", "value": "af74806e377e710459f4d98d4f9d0f00d39fa0d3f01cab6559c32110bb96046e", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691756763, "uuid": "a9477a39-c10f-41cc-abeb-7e004ba646a0", "comment": "Malware payload (NetSupport)", "value": "85bc82d30e0f6c000f0663c199d40de624556acd", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691756763, "uuid": "3eae69c5-ff51-471a-a263-adca5bbe508b", "comment": "Malware payload (NetSupport)", "value": "541dbb24d3f28631a4eb4d19b4defb184892813f3ecdcce28d69985bb3a102f2d4453090d057cb94d997d19f5bb0caa3", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691756763, "uuid": "91ea8be1-6e46-4097-b982-a178c804a82e", "value": "T1B1C53312A751238BF8A7963BF07EAC63662B089C838A9517323F2771D3ED0675037765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691756763, "uuid": "0e91b9ef-9685-4990-8821-2d42a46570b3", "value": "49152:VkAogfES9q/nf91gLqxPXd6fWfCHqouofXF7NIDrbTAz6TSM//B46EYCLNs:OA3fES9qX9vxvmICKofXF7iPbTGARREu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691756763, "uuid": "cd444264-98a4-47fb-9aaa-90b560d60a92", "value": 2656008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691756763, "uuid": "4e9f7a62-a8bb-4068-a737-39eb3ba69fe9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691756763, "uuid": "460641c1-36f6-43d4-ba03-07595aac30cc", "value": "SquirellApp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee740b9-387a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691780738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691780738, "uuid": "be2df301-3128-4c78-ab7f-859f6562414c", "comment": "Malware payload (Amadey)", "value": "d71515c33e6e14eaf7d2ab2554a36aa3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691780738, "uuid": "c0818dda-5f74-4ea6-8b01-bc75daad0c6f", "comment": "Malware payload (Amadey)", "value": "b1cd15500694ceef46716c96007d334b3b2f737e181f085d05617ebd72f73688", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691780738, "uuid": "bf9529ba-9771-4054-aa70-42caf27b9000", "comment": "Malware payload (Amadey)", "value": "f903229cbddcfa9beb999f3bcfae7f95949e0792", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691780738, "uuid": "b155a15c-2b28-47ec-98b3-468943d5b9bf", "comment": "Malware payload (Amadey)", "value": "a2607ab5ad658826d68e8e48c3b506eaebc24ca5b191c04def57f44b345e971e42ef9645ca09877392554f2ff962a892", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691780738, "uuid": "c119296d-8e5e-48fc-b923-9f74a136489c", "value": "T1686439417952C072D960A1721AB5BFF2C59D68249BB049DB7BC00F76DB212E77A30F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691780738, "uuid": "c4cd0dd7-db22-46dd-9af5-d380e5ffec6d", "value": "44e769941d2c6ad88bf42ac4adb36135", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691780738, "uuid": "e6b1707b-382a-4495-9635-87dc51ef518d", "value": "6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691780738, "uuid": "c95888d5-4b0d-4feb-a3d0-72546e34e9ab", "value": 321195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691780738, "uuid": "e3ea6106-f307-4960-8ce9-19f81e5f72cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691780738, "uuid": "1d93ce87-c36e-4633-a0b3-9d7ce0945837", "value": "d71515c33e6e14eaf7d2ab2554a36aa3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390dfebb-3851-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691763199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691763199, "uuid": "4fcbf61f-01b9-43fa-b0a3-f0b809082364", "comment": "Malware payload (GuLoader)", "value": "bb3919a1ab9e5e2d9a777df8049bbcd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691763199, "uuid": "68da3276-acdd-438a-823e-ac3681fe77df", "comment": "Malware payload (GuLoader)", "value": "b22cd64c838d61f149c5fdb14e2c634e29187b449ddc98af44c9dafc4f5237eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691763199, "uuid": "6912620e-753a-4c99-8e7d-2d7be6a6b0b6", "comment": "Malware payload (GuLoader)", "value": "2d23ba88b16287483d43ed30880aa0e68132260e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691763199, "uuid": "b8de912c-5bbf-445b-a78f-2568777d98b8", "comment": "Malware payload (GuLoader)", "value": "7ce9fa706525356419a87398bb035fb15b1731274d095f5230db67abde7eb704686ca6f2e16a97bce907be58e8271296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691763199, "uuid": "17bfa7b5-8413-448f-a48f-4dba9b281835", "value": "T1A2741245A14185AFDBE44BF074392D1A16E78C6A583A520BF29835BC3B7BF83742DE07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691763199, "uuid": "9238d1bd-c937-4824-9238-f346cbb9fbfd", "value": "7c2c71dfce9a27650634dc8b1ca03bf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691763199, "uuid": "2b2e4711-7528-4525-a573-f65583ada5bb", "value": "6144:zQLFhJT35fS3OoJPFQQOc5YO7Z/GTk/rJrAlImvBePVmntEgkq1ZY9zpIHuY:EFPT03TdFlzSONG4drAemvBePVckq1ZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691763199, "uuid": "d372f98c-9747-475c-824e-1e12ef208979", "value": 347824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691763199, "uuid": "c944f061-f4a3-441a-98b0-c0c6d5925125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691763199, "uuid": "aa68b372-35ee-4c37-bf21-9b58278bffc0", "value": "Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ed5d46-37dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691713159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691713159, "uuid": "7a435c35-23d5-44d9-95f3-7c8d805dc1a7", "comment": "Malware payload (NetSupport)", "value": "163b7346917aa5936bac2b3cb67df947", "object_relation": "md5", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691713159, "uuid": "21b6b6b5-f880-4907-b002-156bfafd5e37", "comment": "Malware payload (NetSupport)", "value": "b237a8ffc9f5e6745ebad7d1a8a27905f471ac89af9dd5a744222a7ad2709e34", "object_relation": "sha256", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691713159, "uuid": "13315be3-b49c-499d-a5aa-5a78a4a3a313", "comment": "Malware payload (NetSupport)", "value": "7dcca7b175a4ff0a5fb56498c71178da9a79b0d3", "object_relation": "sha1", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691713159, "uuid": "39885a28-3237-4471-96dd-4f847f7108c0", "comment": "Malware payload (NetSupport)", "value": "2725a4aa2a1847d943f7165c1e440fb8e316da149316cb654332681470091d8169f3321b288a55fe05ebd5cae75b8873", "object_relation": "sha3-384", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691713159, "uuid": "bdc9e976-4c7c-43ee-b109-1cb561a38f07", "value": "T1FD45CA34397A7C2443EBDA1334F14B961CE9564FD1703A3B199AD8239A346C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691713159, "uuid": "344c654b-fd02-46ae-bcb6-808765bb1d12", "value": "3072:32fol+tDk3g2YsUgeahAAZHc2yGDVvIffEYH:32fol+lwYsUghzpIffEYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691713159, "uuid": "250a20ec-5a8f-409e-b1b2-44435381e7f3", "value": 1251278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691713159, "uuid": "52505dc0-585e-4119-aa07-bac76a9cbf25", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691713159, "uuid": "63eda625-fb88-48d5-83f2-3430d4f197ac", "value": "twilighttwilight.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8a86a6-3824-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691744035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744035, "uuid": "b87ef8d5-0367-4d13-8f19-aedccfab8828", "comment": "Malware payload (AgentTesla)", "value": "af3a6d859997312179af2fe70050de16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744035, "uuid": "31694e8d-1435-4b2d-8961-86f0e5b667da", "comment": "Malware payload (AgentTesla)", "value": "b2444eeadbc421c94ad3d16e895f097b6f7e220c9b18c62cabf12a41f54fa046", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744035, "uuid": "e3a91973-cef0-44ed-8416-760c2ae0839d", "comment": "Malware payload (AgentTesla)", "value": "6d127a508b75173937cd3222974b26d266a7706d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744035, "uuid": "83fab6be-1183-4446-a139-1826190777cd", "comment": "Malware payload (AgentTesla)", "value": "4bcfabd88ef0ef4bfd2e138e18f8a289f3afd25c4d1e649a0bfdf8c516836f998ff82ede3d5f186b886b912135fdcfce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744035, "uuid": "323929e7-5514-4952-a95a-f11f360b3344", "value": "T197C4CF39503C87AFEB53DB76E835119222F013A22AF693CCCC7A655F3D79238A2545B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744035, "uuid": "1c479f37-55ac-4337-afc6-87caab634d32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744035, "uuid": "6c15bcf0-8545-4045-b10c-b58a4a1cd25b", "value": "12288:JqTrQaSejL8Z9bHngyXw+PyXkSD2EU8SOJfNvdRdHHZJ4s0IP0YJsI7DEb:JqTrQaSejL8Z9bHgyX62EzzNZHZJ4xt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691744035, "uuid": "9a96e2e4-ec37-4536-826a-c41c9cd37039", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691744035, "uuid": "8c4778b8-099b-4e87-9b9f-eec50df4987f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744035, "uuid": "5a7b9cdb-0534-4771-9d9b-6fe11e6cab32", "value": "Shipment Import Invoice & Clearance Documents.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0cbf81-3803-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691729707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729707, "uuid": "e2dc2ee1-07f3-4c82-8291-60ced8457745", "comment": "Malware payload (Mirai)", "value": "e8147f5239dbc60bdf805cbdd26009de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729707, "uuid": "b10f6414-7c8d-4386-b329-7cd7788e1ffa", "comment": "Malware payload (Mirai)", "value": "b4eb87c876a1e77f933a2abb3b42c3dc93b5a8a96c4a120335f1966ad80882b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729707, "uuid": "95a9e332-c19f-4d57-9382-70917d52de0a", "comment": "Malware payload (Mirai)", "value": "cfacb63a4ef2f8de1d24d86e5de4cb10867d7d1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729707, "uuid": "c3efe4f0-1564-442d-8a6b-6bcfaf6896d3", "comment": "Malware payload (Mirai)", "value": "6ecc3205b34eee1372410bc281342151ecdf8b402974e0ad0c1ab2dfb1ee070bc1c90641aee504edd68051bde6f2edba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729707, "uuid": "0d8dd52a-3e79-4ad2-aead-bc514440cff1", "value": "T1BF438D36E96E1E74C04641B074748EB56F23B5C883972EB61AAAC2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729707, "uuid": "1fd67084-f09c-46bc-8b09-a8c879b3eaf7", "value": "1536:Naa0brW/Od9hlCRrWYTXKwXQCcpvDCM12+WV:Nv0brWGd9XZYTawapvDM+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691729707, "uuid": "56aea239-8623-481d-b7fb-e19f6af3b4d1", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691729707, "uuid": "a51787ef-e9c2-48ab-b1b1-15436818d4bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729707, "uuid": "9be7d7bb-8ff2-4240-ac52-63b515051acb", "value": "e8147f5239dbc60bdf805cbdd26009de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1cfdd6-3888-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691787040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691787040, "uuid": "fd707d8e-ff2a-4805-89cb-916553b035ed", "comment": "Malware payload (RedLineStealer)", "value": "5260075ad1853a679f70c62067e8cc31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691787040, "uuid": "0e4ef7b2-b961-4f0f-8e31-b2bdd71a38eb", "comment": "Malware payload (RedLineStealer)", "value": "b80bf3a20f884450d50c51208ea13bd20b47e3b8dc6f0d988dde0efea773f409", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691787040, "uuid": "f1fa437a-948c-46c3-9b66-afc359705ea5", "comment": "Malware payload (RedLineStealer)", "value": "a011e8f359b8b7bcf4c8051d08ef6826c6b76aa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691787040, "uuid": "f6cf5b80-64e0-4ab9-9ec3-b7998bf55bcc", "comment": "Malware payload (RedLineStealer)", "value": "ba6227eac8080a3395ebde9b4d10f761d8279b11a4b0ab9617a2892c2b4bff566c1fa49cd724a875b5f6e9d70a55daf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691787040, "uuid": "40cff33b-d586-4462-bcc0-7a6fddcc1b54", "value": "T1ACD41202ABE98063D9F027B058F707830B35BD611E78976E3756A85F0C729D5AA32737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691787040, "uuid": "c5d31227-1750-457a-ac98-90228f62c2b5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691787040, "uuid": "cbf977da-dc98-4071-8dd5-918efa718de4", "value": "12288:sMrWy90w/AEFM+ivOsQW4syBeb6Km/e70FiKRcEX9p7jrDhgLFTr:CyZXynOsQLJG70oKuE/TOLFTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691787040, "uuid": "30771bb3-b34b-4350-b5c6-6501c41fb07d", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691787040, "uuid": "46de6ddd-7eca-4ba8-a59c-7fae6ffae998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691787040, "uuid": "5d90922a-4d1b-4955-8394-ea4eeec4c309", "value": "5260075ad1853a679f70c62067e8cc31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c732aa-3823-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691743757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743757, "uuid": "fc4dc829-1f6b-4ed1-a504-5f24df9ee677", "comment": "Malware payload (Mirai)", "value": "2b23cf4037e7e7d951513f32d3b1ec61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743757, "uuid": "c9d621d7-c042-4335-a97f-c7acaa28e6f1", "comment": "Malware payload (Mirai)", "value": "b8baa7b5d0d60070ef78ad846e17198e891093a84a00e3029dad0ffd77c78b7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743757, "uuid": "3097f483-3012-4eb1-80cd-a27cec98186c", "comment": "Malware payload (Mirai)", "value": "23eab5808b55ed1403277bdc3db35ed56ca76d78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743757, "uuid": "531de77c-c696-40b4-9337-699e7e582c62", "comment": "Malware payload (Mirai)", "value": "b9f16a83237f7f68f826c8f2fac554f72654947591696514c221b73e477be2829d0edfabdbfe03722a30d6793dd0659a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743757, "uuid": "db19d168-7dfd-4682-9d4f-4ba8dd16ff1e", "value": "T191C32805D5508727C2D3237AE79F865D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743757, "uuid": "c1f135fd-11a5-45a7-8a33-5639d59467e8", "value": "3072:WkYPgPggnAb0JWaY/VfSEDx0dn+mTQOY5NX3cn:lYPgPggI4Wa8SEDW+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691743757, "uuid": "1f3b376d-3add-4966-bbce-441a89956bf9", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691743757, "uuid": "abec2f21-a5cf-4d4b-a996-373a0b9827fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743757, "uuid": "258c6cc2-5609-4628-8ae6-da0b5b8615b3", "value": "2b23cf4037e7e7d951513f32d3b1ec61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a68d485-3851-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691763228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691763228, "uuid": "123574b7-1cf2-434b-a057-2522d4d89b49", "comment": "Malware payload (Amadey)", "value": "836eab313224aef51576da601d6122bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691763228, "uuid": "c0f77e3d-3e51-4a9d-97c3-93c0ce92c3fb", "comment": "Malware payload (Amadey)", "value": "b93fce4601e18397615dcd878d95edae4dd18d7d15c6fdd63329df32a1acb112", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691763228, "uuid": "c2f27e61-8a9d-47d1-8e4d-c5a88147697f", "comment": "Malware payload (Amadey)", "value": "ec58acd668da217e33cbae25c37ce88a03513269", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691763228, "uuid": "05b98f23-0b7b-424f-958b-4eec7a109999", "comment": "Malware payload (Amadey)", "value": "4089fc0e2f89b5825cf878872cb9838d6231e629a10e7fe03babdc61d1c960568bfbc796fa42c4c2efe7ac56d051e65c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691763228, "uuid": "182f4bc6-d224-4365-ba90-5cd9f034e289", "value": "T198F4234376E48033D9F06B7068F612D30B3ABDA14E7C976B174298496D73990A936B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691763228, "uuid": "916d94ec-b99f-4832-bd40-2430482cc4ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691763228, "uuid": "62b5017e-de06-4135-b548-74d440aea554", "value": "12288:9MrMy90iiFuBm2gr5cOtxBKgqEjgxLxhe8M34YtdZzbucnEwRqOgq:1yThgr5cOLQgqdxA8M34Y/ZzCcEwRq3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691763228, "uuid": "9b6d41c8-8e08-4cb7-a133-4e4777a6b313", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691763228, "uuid": "f02dadb1-f599-45ae-b2a1-ba948b69abcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691763228, "uuid": "41a7ee52-160f-487b-b4e0-bc14df424638", "value": "836eab313224aef51576da601d6122bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b97b14-3822-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691743198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743198, "uuid": "3e67584b-4dfa-49f8-a6a5-168fb74cd5d7", "comment": "Malware payload (AgentTesla)", "value": "92dcd8b39dc0831b697f4e8cae32c4f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743198, "uuid": "926f7c91-5790-4acf-9ce8-34396396d0e2", "comment": "Malware payload (AgentTesla)", "value": "bb3ad299931a36ff4cf024e92ab9cf3e395fbff5d8e5cc4b5686447524732646", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743198, "uuid": "817a7e89-3d40-4484-96eb-7a202744a1b8", "comment": "Malware payload (AgentTesla)", "value": "620b3b17281c0f0d353b413afbac40b657d301dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743198, "uuid": "e82fa885-40fe-4974-9705-48e1dc280abf", "comment": "Malware payload (AgentTesla)", "value": "91b15d405bc13c0810f894244d677409795d8a253e574ff976bfc542617a1f999eb69d2cbc705fb9635cfa6a4a5b4a4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743198, "uuid": "27c13219-81b2-4981-8774-0e7bf7a1bb13", "value": "T1C8050726E77B655AEF19A5E89E2F843238D6DCC0F0B1C588A7E72C0385C23514D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743198, "uuid": "c0d76922-5b35-4d49-94eb-e866abfe1c9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743198, "uuid": "07d02654-9805-43d8-bc64-84e5e00243ab", "value": "24576:lOYWRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUO0UFypAFpnhBkNZFDPKr:ldWRs6CE3jLbO9Rs6CE3jLbO0xAsP5Kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691743198, "uuid": "912bda97-2975-4730-b059-47e434787eb0", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691743198, "uuid": "96415a77-6fb5-4272-a89d-a7c8eae80539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743198, "uuid": "cf60474d-0c8e-4fd3-b686-4890eca0eac2", "value": "92dcd8b39dc0831b697f4e8cae32c4f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a3055c-3892-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691791248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791248, "uuid": "3cf5c966-c634-40f4-87dc-1a8d63ded47f", "comment": "Malware payload (Amadey)", "value": "3917cd7e2e96dee7eadf69e60bd48aec", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791248, "uuid": "2fd5f396-a2e9-4932-a755-b909f44506cc", "comment": "Malware payload (Amadey)", "value": "bbeeb00be61c754f77097106cd327dff72cc3a5ed058e05e13b42316d62d945f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791248, "uuid": "2a63900e-86be-4065-aabc-3482320288e2", "comment": "Malware payload (Amadey)", "value": "3346f3a4a99e0b8061d6e87c079e3b4c9cab6fb2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791248, "uuid": "089c16d9-2a0b-4f2d-aa2a-fca39127a3e3", "comment": "Malware payload (Amadey)", "value": "f250ae68d23efc7c6c82fde1940081b2014150feb168b4193ba817a79dd217d6afe31cd2aa0493981c7ffdf2714bc309", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791248, "uuid": "9fd09fe2-e95d-4693-bf52-b3c2d0b36ab9", "value": "T12AF41257A3D886A3D9F1273024F703D32B36BCE15CB4836B27D4685E48B3685A63536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791248, "uuid": "7956f760-c772-430a-b25f-07b0ca849cfe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791248, "uuid": "b22b468c-5c94-4d00-bd27-7e7260d2dfa8", "value": "12288:hMrCy90gr+DIuRQhqGMuA20Yteq4R35eVB+dD3NSbfMV3cRJBqgSJnFt3KD:ryhrFVhqGM520YtyJBd3NSzG3qqFFt3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691791248, "uuid": "38d975f9-3b03-42a6-a135-3d952a7a9e38", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691791248, "uuid": "bd53444f-0183-4f83-b5f4-8f4d31977046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791248, "uuid": "67a85a72-464a-4935-bcdd-8c175652ccf2", "value": "3917cd7e2e96dee7eadf69e60bd48aec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf7dcb4-37f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Autorun)", "timestamp": 1691723447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723447, "uuid": "8a966a08-fb83-490a-a77c-14422cd4ca51", "comment": "Malware payload (Autorun)", "value": "a6bd6d0e423b7119420162cd93c980c3", "object_relation": "md5", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723447, "uuid": "44ec8675-b4e4-407e-a7cf-ccee7dbbc895", "comment": "Malware payload (Autorun)", "value": "bcf198dcad63d6b5498c5ec47b74ec71795cded5113ffeecb511f6f1fc63ab48", "object_relation": "sha256", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723447, "uuid": "04830fae-3413-4b4f-8d46-4e4c7737ffdc", "comment": "Malware payload (Autorun)", "value": "b9639dd9b43fd1e0d90098a34bd1a84a96855e57", "object_relation": "sha1", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691723447, "uuid": "8e57b4fa-ed8f-49b3-9aa0-01ab2cc6092b", "comment": "Malware payload (Autorun)", "value": "7098a10b97ea5c808bfeba1b8d8561cb28d9e06ff367b0587629ecfd9e76d694bb1ed11454b42b4656a6446fbe29419d", "object_relation": "sha3-384", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723447, "uuid": "ee461578-db44-428d-866a-ef58e74e2bdb", "value": "T17DD52960E6909839F6EAD578605EBF1518D27C1157C22D8DA4CCBB246FF0BF8E6B3190", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723447, "uuid": "d3f9c388-3d5b-4b04-9c43-d88c5bce3226", "value": "12fcd3183e0fb67f1e38925ed5c0c47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723447, "uuid": "be897db6-ca54-4a28-a9b6-d0c5a6c8c091", "value": "12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCp:eEtl9mRda12sX7hKB8NIyXbacAfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691723447, "uuid": "4eb455bf-34a3-4a0a-a0d2-63dfcc9cc161", "value": 2944442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691723447, "uuid": "8a5dc0b6-f572-4e2f-94d3-e58b2a7bedf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691723447, "uuid": "2495cbe5-55da-4fd0-a5d9-e9a188f39c14", "value": "2023-08-10_a6bd6d0e423b7119420162cd93c980c3_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1125a9-3821-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691742615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742615, "uuid": "876c9b38-cb76-474c-b607-baf3675df21a", "comment": "Malware payload", "value": "8d6705a38e95ee5c4cd131cbd93cc62e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742615, "uuid": "5c3b97c4-53ae-4e83-9e29-da3f9106ade1", "comment": "Malware payload", "value": "c08a1a8a0273a9b9c9dd0246bffcdc3ead97570d130751e70da4f6ce396c9685", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742615, "uuid": "a39eb68c-63d6-4c97-a94f-2db0c3abe69b", "comment": "Malware payload", "value": "e14fcfa61b5388a56f4b1a5cd80fb37f8edaa50d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742615, "uuid": "29c195f7-f90a-47f1-8d77-ee27cdbece24", "comment": "Malware payload", "value": "6f4ac9a934272e82b8706cfdf720a3a6c62f5bc7b9dbe794313a89db43fe9e189e23935b459d2ad9d4a55231026f8057", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691742615, "uuid": "f0e7b05d-485e-445f-86e0-dc2b80402b21", "value": "T1DCC60147AB0DD92EE47B4073CA261033F16E8E15464397F37509B30D28BB99A8F65BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691742615, "uuid": "6c822355-09e2-4c60-87ab-83057cf4064b", "value": "196608:v51jAycmO4Sv9dS5/87a3ESxw/xeeAcYaV5yETwd1:xvUv9gwaUfe5cI8wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691742615, "uuid": "9511e9a2-6dd0-4927-b917-6e4c9e6b52b1", "value": 12361645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691742615, "uuid": "dd313eb9-2bd2-4a03-9331-9b6b0a58d60e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691742615, "uuid": "ca723ca7-088f-4b06-b33b-38642857abdb", "value": "Easy Volume Booster_1.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12f2b0f-384d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691761790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761790, "uuid": "1c7083f5-efc2-4dcf-b3fa-2fa5dd14303d", "comment": "Malware payload (GuLoader)", "value": "9e62a7fe9993ebbf6d18ae2f3cc632a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761790, "uuid": "80bd042b-1c6d-4b3b-b0b3-264afe4c5f18", "comment": "Malware payload (GuLoader)", "value": "c2474d740f9b7e58ef44270862437188e7ead5bccd91c7f420601f5e40ecd32a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761790, "uuid": "87cae57f-babb-4b19-9f33-315a689a2815", "comment": "Malware payload (GuLoader)", "value": "8fed09dba46ca2084862e1c02829703d7b8e12a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761790, "uuid": "e6c6b604-0093-4e15-9027-7532075903e6", "comment": "Malware payload (GuLoader)", "value": "33d26461d8f66c2c5e63f88077ca9c665c59d2d995e58bc505170590fc30ee7d29b6c608580a3ff965894d318403ac7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761790, "uuid": "cff6775b-a8f9-4f85-93b9-00ccad2634a7", "value": "T1B574127B51A5E6F3D338C7B4943B26BB1FA85136114123973780E7B239CAAA1D60B316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761790, "uuid": "a15d1d9c-2885-4ec0-982d-372178db34e2", "value": "7c2c71dfce9a27650634dc8b1ca03bf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761790, "uuid": "47183071-24ec-40aa-822c-23a076d8e418", "value": "6144:QQLFhO/yu4l3/9fyqvdOlNXHzbqv8fVWqj82oUwGomTWWBOsvZdRbvpy+:1Fbu4RZ5dOTyv8NWaJoU5oUosnhRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691761790, "uuid": "f4d837db-50e1-4adb-8659-304fdfeeaa06", "value": 356752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691761790, "uuid": "e327d6a4-6c18-482f-9db4-bfb318c86b5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761790, "uuid": "c96cb105-c0b9-48f4-8d9c-503e6bde3965", "value": "Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79f7ed0-3864-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691771599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771599, "uuid": "a4f9f45c-9c27-40a9-9178-ddf3cec00ec9", "comment": "Malware payload (Amadey)", "value": "18cd6fceb5601ba45c40b33d28a87f92", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771599, "uuid": "834d620d-9303-46a9-9460-59ce55376e43", "comment": "Malware payload (Amadey)", "value": "c28beecf5755aefbd585bd5e88e910c7ffb78780b48d2b01d116583c684741c8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771599, "uuid": "ef578e74-0234-40fa-ac64-ef2638ebc7eb", "comment": "Malware payload (Amadey)", "value": "96b066c21782d85638a7be4e6a359dff0e2b98d6", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771599, "uuid": "b9c9e68e-d9d8-4be1-9974-0215ba67ba09", "comment": "Malware payload (Amadey)", "value": "ac84c64e98e3cff3dac7fb4bbf9cdffaa28de3aff40482853a0419e30f13c537ae4bfd6e8db21c33ffed420846041c16", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771599, "uuid": "a3dd98bd-b50f-4fb7-8ea6-0db2bf50badf", "value": "T17E357D1BA26601BCD4BB9178CA235A47E775744603309BEB17D05AAA2F13FF15EBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771599, "uuid": "a83b71ef-6acb-483f-abe8-a26aedb4dbc3", "value": "907e684baa019f5bd80cf160486e7eec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771599, "uuid": "e76c4ad4-ea18-455a-b0d1-2cd8e881b3bc", "value": "24576:eaS3LyrV872cT+RZCPrZ1sw1yolNVAmthaH:xV872cTsZKZ1sfWxthaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691771599, "uuid": "1579d04c-fa03-45a1-a9c7-a2c82cbaf832", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691771599, "uuid": "50956465-ec55-4ae1-8284-6cdd7835ab53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771599, "uuid": "f5dd1963-9b94-4413-82a0-12b739e3bcdc", "value": "18cd6fceb5601ba45c40b33d28a87f92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317e5c2b-382e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1691748154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691748154, "uuid": "fbc9b5cb-0891-40fb-8193-ba1ba42e5e84", "comment": "Malware payload (RiseProStealer)", "value": "28dfadc84ad49d87e8f99a49a101a746", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691748154, "uuid": "2cf33661-19ca-4df3-bf98-3e64cb4b1394", "comment": "Malware payload (RiseProStealer)", "value": "c389312be0cbad3f143a736d435a4de10f7cd79f075ebcdc0d7ef05e169e4d3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691748154, "uuid": "9f11cc8b-b52d-49ee-9192-5837c2c83f8d", "comment": "Malware payload (RiseProStealer)", "value": "9ecd0596f676f172e5ff5e9f0df06ae8aa5e8f36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691748154, "uuid": "8fbd4ef9-74e8-40d1-a160-e6d20eb49606", "comment": "Malware payload (RiseProStealer)", "value": "572dbcbca9bfec2cb088953503c0ecbb2db900951991b4977f138325ba0c5d3226ff6623069b1b3b978ca6598acdf182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691748154, "uuid": "fdbcb0d9-af40-4a18-aae9-5de280e56082", "value": "T1C896238218CBC1F4E2C51975C61F67DF13B7957B8D808824BEC47D8B9161F72A0BACA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691748154, "uuid": "aad368dc-4939-4b0c-b322-fc4525890ef7", "value": "80fb4762ce369ec9129cae7e9bc907c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691748154, "uuid": "8b561e55-8e4f-4a69-aa0c-3ec2c5f34222", "value": "196608:MTNcj+xSHinGaRZHA8p0fvAzh0iun2qYx6oAem5T8DPrFwM8hsUAVNhS:wWy88g8sIF0Exx6oaT8DxtPUAVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691748154, "uuid": "ff83ce38-d7d0-4a58-a6a1-d0a8c2767f85", "value": 9341440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691748154, "uuid": "501e0ba9-74b8-4cd6-8abc-42f3ff8b771c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691748154, "uuid": "2277f3ca-0759-460b-abc5-237b2e7d117b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0fc24b-3803-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691729730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729730, "uuid": "bf42c5ad-91d5-4ff8-8c0b-995c337a127b", "comment": "Malware payload (Mirai)", "value": "fd3077b3930d67adffb6b2a24aae6bc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729730, "uuid": "dea76647-d160-43b4-b3ff-002697d3d47b", "comment": "Malware payload (Mirai)", "value": "c461a6a934421ca28420fbe4bba454d7f5296ae0f4c402b8fda596362f4581fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729730, "uuid": "3fb0bf29-22bb-475b-9124-09c2b538f4b3", "comment": "Malware payload (Mirai)", "value": "6907e19125dec6836c1d5c7922dae59d37b7584e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729730, "uuid": "a624e724-09c7-4911-87f1-f9259650ccb1", "comment": "Malware payload (Mirai)", "value": "4192d6faf97323efdddc86b2144feacecc1e43e6aa24a3214fdb41d9e081b35149afdad243febf996a5c72295a5a8f48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729730, "uuid": "b48169c0-823f-4c25-ab24-14148829945e", "value": "T1E783D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729730, "uuid": "f61bfba6-bd98-49d4-95ba-518437e76024", "value": "1536:iVLympdK7Zkj752dCexuV/8UZlDwfkJ4MYfWx:iVLygcYFezxu5VD1eU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691729730, "uuid": "3f40affe-2659-4692-b8ce-f26a3d73e0c1", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691729730, "uuid": "cb8a0189-8db1-43e9-88d6-fd98b6a81b30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729730, "uuid": "d1d4e9aa-97a2-4567-a672-2311ea609ceb", "value": "fd3077b3930d67adffb6b2a24aae6bc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0140cdc5-3831-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1691749362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749362, "uuid": "1ce7ca92-f1a8-4cfe-8933-066c25ff091f", "comment": "Malware payload (Rhadamanthys)", "value": "6a7b4e0786929ef29e6fe1c8ff75755a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749362, "uuid": "fa35810c-b147-4895-b7b4-b69e41af5851", "comment": "Malware payload (Rhadamanthys)", "value": "c46f2fcce113e720cfd68123663b96ea24203591c40caafa70cb518fa9e31fac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749362, "uuid": "6337ea60-8ab4-42e6-b963-b9c227e0a23c", "comment": "Malware payload (Rhadamanthys)", "value": "a447c2d854795bae0f8344a51fd11a3b1e2dad1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691749362, "uuid": "af4fdf6a-8af8-4fc2-8009-8315b621bb85", "comment": "Malware payload (Rhadamanthys)", "value": "095a2e954e726e5008ab83df8b54b6bc42e5835fc098944736cff265fed7c80e2d245cfd86ddb5832543eb38734e1d13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749362, "uuid": "88aba431-0dcf-4dc0-b600-cf395afd372d", "value": "T1A2A4123235A3C071C06940B15838DFB45B7FB6311576858B7FAA06BE6E703C26F2B666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749362, "uuid": "fa0bb056-4a58-4fe3-8fa9-ab0833cd037e", "value": "b2ecd2f1e677ff2d380d045dde6c6686", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749362, "uuid": "842c6de1-5fb8-4758-87a8-1fe6e414038a", "value": "12288:V4Wbl0LciWPh88hsR4fHy+03iH49/Bou:V5l0LOhTfS+03i8Jou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691749362, "uuid": "1e799943-36c6-42ad-bd10-c8138523532c", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691749362, "uuid": "6f8e0270-636d-4c68-b241-4e093e62b8cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691749362, "uuid": "1002fcf2-6678-4a59-92e1-842d097a37a5", "value": "6a7b4e0786929ef29e6fe1c8ff75755a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01d12ab-3844-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691757923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757923, "uuid": "c20ae07b-55df-4d3a-b1a9-d0b9feea141c", "comment": "Malware payload (Amadey)", "value": "540ab1b3ffe5d5d6773db4dae1ae6242", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757923, "uuid": "85bb1312-baa4-4d88-acea-a13c907b8188", "comment": "Malware payload (Amadey)", "value": "c6687cf86289be29bdf0c28b729c952b8305ae7fae44501dc2eec83b5340aab2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757923, "uuid": "35945fde-122e-4868-9407-2f842c972d61", "comment": "Malware payload (Amadey)", "value": "0cf90d603cf69a5e7978c290c75e9a5e4395d286", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757923, "uuid": "edbe8bc1-f9c0-43bb-98a7-dba9ff658e93", "comment": "Malware payload (Amadey)", "value": "1f721ee768b90679facbfc1e3a5ef0f23782a276201fc32d536a410db8fd54301da216ba148095ac314905a2fdc6f6c9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757923, "uuid": "1f3663d7-5ac0-4ee0-9e02-9e6234625f7b", "value": "T1EBD41203EAD94433DA702B7058F717870B39BD9658354ABF2786B84A1C72AD4B97133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757923, "uuid": "c22a1bf4-1a62-4246-9313-1bf49ef811cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757923, "uuid": "6b162c17-6577-4366-b632-2e61ed6d05d0", "value": "12288:5Mr0y90NL3F9ckukXXFtRKO/e7MuyKR+EX3p7ZUmfmb3tuXjo5UUw:NyCzjcTMTR5G7MJKIEZmmfkcTiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691757923, "uuid": "6bfe88f6-34ae-453d-8652-420548f6d544", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691757923, "uuid": "a57d9907-c01b-4414-aebc-cb23657a846f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757923, "uuid": "069531f5-cddd-4f7a-b674-a16f125ac6ee", "value": "c6687cf86289be29bdf0c28b729c952b8305ae7fae445.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24761004-37f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691724510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691724510, "uuid": "6a091c0f-260b-4e55-a458-28a0d58f679b", "comment": "Malware payload", "value": "8e34ff74a574a3f8d9e03956c76d261a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691724510, "uuid": "d6d2eb65-8074-48df-9264-865f3f7806d2", "comment": "Malware payload", "value": "c68c061f05a086695c77fbb53dd73ff7949fc168a2a3331240bc74fefafdadb8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691724510, "uuid": "5587acba-3259-4619-a437-41565af3a24a", "comment": "Malware payload", "value": "51229115c768c2c7de5bb11722848d6688e2c08b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691724510, "uuid": "5e04e549-a268-435f-938f-e672e5d6d7d3", "comment": "Malware payload", "value": "1ea07045f25880d44e839ca91a90982d388ee481a83cd57a554fbc4158adc189b4ac52217271ab7d40cc0d95577938ff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691724510, "uuid": "13e3823f-21af-449f-bca6-7a0ec7a54ac7", "value": "T1C82387C0179D9EEEF20A20B844856D350CE479B9732F95D9DBC69C8FC419EC522A1E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691724510, "uuid": "d0b9150c-99a9-4b0b-aad5-3798c22a99d9", "value": "3c99606240c35ab29d3f57141a743150", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691724510, "uuid": "aed3d17a-c50c-4680-8918-03e7b89261e4", "value": "768:m8dm21hH3DOgg7kl0Jgjvpao6CPzsd8fZaH6lInaq9jhdQOmubq:Fdmut/g7ke0RaRsCAnlIbNhCXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691724510, "uuid": "57284303-f453-40ad-9b44-a62354fa727e", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691724510, "uuid": "6f7d0c6e-60c8-4d6b-b109-34d8ffedea48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691724510, "uuid": "0671d5e4-260c-408d-932e-5dd66a511eda", "value": "SecuriteInfo.com.Win32.TrojanX-gen.10614.1519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f940f4-3803-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691729700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729700, "uuid": "5197f6cf-be0b-4254-adaa-5622771e2868", "comment": "Malware payload (Mirai)", "value": "40e06f0eb5f5fa08ea7e5c4419e6e647", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729700, "uuid": "043b52b4-4c15-45de-8fb3-37a751ace0b7", "comment": "Malware payload (Mirai)", "value": "c724639f58c5d2b39902894e1046e689a204f95975890adf0bdc9bc2d6433822", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729700, "uuid": "da5e2a17-f1c1-4f93-a84b-4ca60c6acfe9", "comment": "Malware payload (Mirai)", "value": "9c0e908eff01d5d200b02c820ead2c7bb9932c25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729700, "uuid": "f45a7656-bb70-4d83-9b24-ec03591d8ffd", "comment": "Malware payload (Mirai)", "value": "d2b6bc79abbaabb288bfad5d463f4980f17efcee9abe90abff0cd8310f71690f3bbcde71c82357f0568142b36af56737", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729700, "uuid": "538335b1-6cc4-4889-ad1e-1822467c6d0b", "value": "T17A83A51E7E218FADF76D823147B74E25A69833C627E1D642E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729700, "uuid": "03b09e41-65b8-44fa-b1ae-d92a332b517a", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/deagYwH2RHgMg4EH6ITq7ZDYovZ73x/nL8y8QY:Rakdn2Eo3eDSdiTqRYo99Be037WZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691729700, "uuid": "069710fa-ea48-45ec-86f1-f2ace8003521", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691729700, "uuid": "b73a21f0-9503-4b0b-83b6-de450e880aee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729700, "uuid": "5f849506-81ac-48a9-b348-de4deae99325", "value": "40e06f0eb5f5fa08ea7e5c4419e6e647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1725f4ec-3865-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691771732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771732, "uuid": "8be34a28-8b1d-4a26-a0e3-87fe231b3402", "comment": "Malware payload (RedLineStealer)", "value": "07271fdcafff6e3897c71df0a47c8eeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771732, "uuid": "b25089d8-837f-46e8-afca-83c4fdc56f78", "comment": "Malware payload (RedLineStealer)", "value": "c8412f49cbe82d10e22d888f8626dd2c43d5e98c20524530aa6d45e09f74bfb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771732, "uuid": "7becab92-db98-4170-bc5b-0f1eb48cef8d", "comment": "Malware payload (RedLineStealer)", "value": "4c296dd1bf3f42de5284707c7ef95897f9c50799", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771732, "uuid": "8e476b09-0308-42f7-b799-2ce185484d1a", "comment": "Malware payload (RedLineStealer)", "value": "4e9d725a7f689294aa877e29bf7cdc9b2808d1984f8c3005b116f6e082582abad7e46a6b4fb9f86615da1909c1fe366f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771732, "uuid": "c5e06023-83c7-4e32-9598-2c8f0e2d4ab5", "value": "T178D41203AAE98073DDB5277168F713930A36BC6158B9835F2349AC5E4C72AC5A93073F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771732, "uuid": "c0910162-c4bc-4b2e-a6a8-0f410ae914b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771732, "uuid": "7b2e1e41-54da-4fed-a3d5-69fcf12891d1", "value": "12288:JMrgy90qfEwHd7DI+qAdAHnGnvd427LKr/e7yLWKRZEXqp76jxhaOtXoQC9oI5/t:RyTS1fmvd1oG7yiKXES8t4SIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691771732, "uuid": "92a36759-d2d4-4abd-a40a-e90b0a24f160", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691771732, "uuid": "5bb908d3-c59c-4c74-8df4-b1645149bcfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771732, "uuid": "a511861a-6000-44e1-8482-bfcdb77ca504", "value": "07271fdcafff6e3897c71df0a47c8eeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af76e37-3865-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691771846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771846, "uuid": "96aadb19-103d-43b0-95b4-e3839a64c0d8", "comment": "Malware payload (Amadey)", "value": "4c1e14380f4ba4aa5018e1dc7705b987", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771846, "uuid": "f82bd649-7d62-4c8d-91ab-1410df9789cb", "comment": "Malware payload (Amadey)", "value": "c859fc5f8152939cd66236aebebde905457ca017e02c0e0c7c706d13e94fa7ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771846, "uuid": "c246e899-9929-497e-b941-1484bfeee60b", "comment": "Malware payload (Amadey)", "value": "6b2a9685e092337a922935f3cef205a01d3bb358", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771846, "uuid": "3b06779c-1b02-4da5-9a4d-63e174e5487d", "comment": "Malware payload (Amadey)", "value": "c77ab82348a15551480a82b4bb1d18fb2be49ead25de4fa5e0d03cbd2f62405b43c80e951da6979ee3cbfacfaa29c8b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771846, "uuid": "8c460e69-8329-4e1a-ada3-89fdf4f34780", "value": "T130936B1030D2C471D57E55351878EAB68B3DB914CFE08EEF27551A7A8E702D1AE32E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771846, "uuid": "9f27aecb-abe0-4c69-9689-4d4a37319bbc", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771846, "uuid": "25c3854a-74fa-4f24-84ee-ac0e7e3ee430", "value": "1536:buON8V8ybtiqY2bpxLW9woUsScAbcauNhV2ZszsWuKcdJUAaI89p:buhVZbtvbpxLHoUsYuNhV25LJUAaI89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691771846, "uuid": "294c05d3-2148-4972-a592-8bc18717691b", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691771846, "uuid": "a696679e-a477-4892-9be6-f21e12219f05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771846, "uuid": "a1d56f39-4975-4c5c-8dc0-cf07c080ceed", "value": "4c1e14380f4ba4aa5018e1dc7705b987", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e2063d-384a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691760488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760488, "uuid": "74f38fcb-3905-44eb-b776-52af22bfd3a9", "comment": "Malware payload (AgentTesla)", "value": "1c57c9c459a4297055eb52dac3a4d4d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760488, "uuid": "caaf7932-7204-4d58-b175-81b9cd13d241", "comment": "Malware payload (AgentTesla)", "value": "ca944d2c5a9eff2ec157e63cb5d4b756dd0abdc3c2bac0444b61419e4f225acf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760488, "uuid": "1170d275-c5a0-40a9-a281-5d4f80ee7d1c", "comment": "Malware payload (AgentTesla)", "value": "f8f003112e1f3c7ad2dcc636b49dc2843e63f948", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760488, "uuid": "dbd20fac-adb5-4676-98b1-f34d99d32af7", "comment": "Malware payload (AgentTesla)", "value": "20d3f2311a38ca06e0f5233ae87ef1086d7fe72518276072a8b28c3e50990df7f708a309c3b441ed7e2b39792f05d6c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760488, "uuid": "7ebdfab3-9ee4-4343-b99c-be595c88e913", "value": "T115F4D060EE399F86E54F4BBC104FD70D82728D8A3626C63A1A7A50C5D4877C206DE79F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760488, "uuid": "8c93295e-d55f-44cf-823d-d7692179ecf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760488, "uuid": "56632eac-23b4-4341-9c2f-37ce83a73fb6", "value": "12288:GpoIUx+e4SkpzWMZzQIaEXXlJNYTD/sz+JETo4JPoz8p/I3eNLkDD6lqTj:soIUd6WlHEXXlb2syOdE8p/8eNLODxTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691760488, "uuid": "9d79f5e1-a790-40a4-8829-7b8844cb5b0d", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691760488, "uuid": "77e0c09c-afaf-4112-8211-5ea3e869ed40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760488, "uuid": "5ac986fd-fb2a-4f64-8420-ed25e8c2ef54", "value": "offerta di prezzo (260001919-230810).pdf(62KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed690551-389a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691794855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691794855, "uuid": "1f1cd279-0c6b-413a-8469-f3d654379389", "comment": "Malware payload (Amadey)", "value": "6503e3028db25f2b584c1d751072d3e5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691794855, "uuid": "289a9ff8-54f3-4d7b-9c23-90c80f5abd6e", "comment": "Malware payload (Amadey)", "value": "cabe1d66ec68f4669286d5ef6bfa5d7195dd2fc8a065bd8fae98a807798965fa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691794855, "uuid": "8667595c-cefd-4d7b-b18d-0dd2897944e4", "comment": "Malware payload (Amadey)", "value": "e4ddce5409a4ecd4c9a966cdb592f2643a4a6905", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691794855, "uuid": "33a02693-db28-45c6-85ff-0b7a47557346", "comment": "Malware payload (Amadey)", "value": "c77c46c5efab7467e277c8b07b2a859bee2c5747231cffbbf26eb01392393d7cc53c5498a62fdb78d66a9645e25827bc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691794855, "uuid": "df120e79-3d58-40b0-ba12-67283fd63dcb", "value": "T1A26439417952C072D960A1721AB5BFF2C59D68249BB049DB7BC00F76DB212E77A30F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691794855, "uuid": "345a15fa-6b00-4d9f-894f-6727a2097bcf", "value": "44e769941d2c6ad88bf42ac4adb36135", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691794855, "uuid": "dce067ee-5b83-4c52-bdfe-e0ef989ff381", "value": "6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691794855, "uuid": "f565f894-e009-4077-b97a-21b951a919ae", "value": 321176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691794855, "uuid": "9fb0d60e-4be4-4cea-ac23-ba4cbc0b8011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691794855, "uuid": "39863d4c-f4bb-43a7-ab9f-221c41ffa610", "value": "6503e3028db25f2b584c1d751072d3e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4dfd6e4-384a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691760427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760427, "uuid": "a68da81e-2334-4127-878c-709633d1ac76", "comment": "Malware payload (RedLineStealer)", "value": "0921114ea822f53b5900c337c5a5c1e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760427, "uuid": "7b6c9f18-55fd-4b87-84e0-01e8e77ef1b9", "comment": "Malware payload (RedLineStealer)", "value": "cae5f39a29434b4ef28e43df63d0c89612581432ff9bf1f51fde4f1691071261", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760427, "uuid": "a482425e-a325-4c5c-8e24-76a9b355b8b9", "comment": "Malware payload (RedLineStealer)", "value": "78b42383bb71532bd03f4f12468238eebea55f14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691760427, "uuid": "764a78e6-f243-45a8-bf19-b4fda0091717", "comment": "Malware payload (RedLineStealer)", "value": "940481fbdb211b5fdea35cc6edd43dffe4f79d207801b5528db6f47f316252f9c2336b3458b41b1f71abdd93ca10ad28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760427, "uuid": "3c195e19-6349-44ac-bf8d-a757a756813a", "value": "T1E9F41212AAE9A167EDF62BB098F603D31F36BDA25D34936B2741904F0C726C86435737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760427, "uuid": "df65fc28-166c-4862-97a0-9c39d7e77a35", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760427, "uuid": "079dca0f-c830-4ec4-9057-418913b6ce55", "value": "12288:dMrcy90IFnfsyGr8b5oJQzLzqil+sqGGspYd5f8CEhLkob2k5JulSJdhhj9:ZyTBf5/b5oJQzLrssqOpjCENkob2k5Jj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691760427, "uuid": "173d9b7e-c2d9-4345-a541-2cd05917b38f", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691760427, "uuid": "87ea6553-63e3-487a-bdf3-aa63de0da1a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691760427, "uuid": "333dae91-0834-43c3-bd0e-2e7860c97b7b", "value": "0921114ea822f53b5900c337c5a5c1e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab6af95-3835-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691751498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691751498, "uuid": "30650c25-abd6-446b-8395-db3b6985d925", "comment": "Malware payload (DarkCloud)", "value": "dc8e0e6acdc89fc080804f25f48cc35f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691751498, "uuid": "750cfe85-d0b3-4c8e-9b2f-77a70f1e21ab", "comment": "Malware payload (DarkCloud)", "value": "cd1442921d3d1bca3022a4f7e9fdb445f331eda90eff09f92f8692f4d2ee1a8d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691751498, "uuid": "ee43f35d-efa0-4a2e-9fa6-f835c63062e0", "comment": "Malware payload (DarkCloud)", "value": "489fe3683ad2648f0ffadeee98eb075b84618213", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691751498, "uuid": "7784b23a-c920-4ad8-9ea2-ad2bc3d2e23c", "comment": "Malware payload (DarkCloud)", "value": "cc3be7c752d68cedacb7a2b65c9c666f80def18fd2f45bf05320088133c37200f5a159aa2e9b5266605a50f93f0e60ba", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691751498, "uuid": "b8e7458e-f3ea-402b-be92-8cb79ac67cbc", "value": "T148353922E77B6559EF29A6E88A2F407179C6DC80F1B1C58CB7E76C0385C23114E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691751498, "uuid": "092c08a0-a91e-4188-8449-d88d6bf0750f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691751498, "uuid": "d5db88a7-94d1-475d-b98e-aec5d56206a1", "value": "24576:choAYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOWOgugOZPs0EC7Dnkdt:HxRs6CE3jLbO9Rs6CE3jLbOGug/0/Kt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691751498, "uuid": "e042ad5f-db56-4d76-9810-3d19c4778162", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691751498, "uuid": "bd4401df-3c2c-4ac8-a724-8ba5115f3c21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691751498, "uuid": "7fb1f79d-ede3-4c37-9bd0-91edad6d168e", "value": "Payment invoice#05450865.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337d5559-383e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691755029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755029, "uuid": "963a655a-e731-4031-a9bf-cba710f0a470", "comment": "Malware payload (AgentTesla)", "value": "d46a579137a148c1299530a936cda056", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755029, "uuid": "744e1a1f-209c-41fa-a8a8-835d1528d1f3", "comment": "Malware payload (AgentTesla)", "value": "cdbacfe5f977568b37bc4dffbe12ddb09f0b2c5fca3fd9dde6bf8019041d2ef3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755029, "uuid": "87b801d6-866a-4480-887c-59f75d959cd3", "comment": "Malware payload (AgentTesla)", "value": "436e064bfb86d74dbb54ab27b9bde1977104b2a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755029, "uuid": "71cbcec9-9d66-4517-85c5-09b5e2f3e6ac", "comment": "Malware payload (AgentTesla)", "value": "a7885cffa3d06d20b0ecd3d6a7adc6eab0186da3f176002643bcac9217bedd5621a56f6d8b1636e4eef0ba2c692a206e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755029, "uuid": "2ca6bfde-8d67-4ee3-a50f-899fc50796ff", "value": "T1E0253C13D73F54B5EE24A3FC491E48F174F59C88E0A5E14867E62C3AC4B93114D2FAAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755029, "uuid": "b5863f32-275d-4c67-a5e6-fc34a7e480bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755029, "uuid": "cf642e1e-8e6c-484b-9498-032cf8cc2689", "value": "24576:96gYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOVUF5W2cE6lQW3b9c1CF:rYRs6CE3jLbO9Rs6CE3jLbOV7m6/3JGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691755029, "uuid": "9023f8ed-1661-4afd-a89c-9973ad3dafe0", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691755029, "uuid": "a43594ba-5b83-4d7e-bd98-b4d7a4ffaab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755029, "uuid": "fa3d7e6f-af27-4815-a319-e119603ec428", "value": "Delivery Note Ningbo.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77933c39-3874-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691778336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691778336, "uuid": "f29ef8e0-c847-42bc-ae4c-a29dd703bc7a", "comment": "Malware payload (NetSupport)", "value": "e2a98c878257dda2427d7f3763d6136f", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691778336, "uuid": "36f097f8-f4a2-49b4-b6e5-d83b9073e833", "comment": "Malware payload (NetSupport)", "value": "ce57978cb2f9943273a7a87b281e32bbf6096e61199c4b6b31c13698afa1e847", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691778336, "uuid": "6834c2aa-c2d4-4a06-b2a3-a6dbddb2885e", "comment": "Malware payload (NetSupport)", "value": "cc026593bc0b4cb764ff7d3cf92ea081a3e33b2e", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691778336, "uuid": "1c733aa2-7fdd-44ef-8745-98f0608db1f7", "comment": "Malware payload (NetSupport)", "value": "a39506ea6cdb3a5f7c11d8a31c3bba544b5360cda5cfde67a977ac34b85988988131b1acc14e546a05f2ec90beac871a", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691778336, "uuid": "cce0592e-30a3-44a3-b59d-a4447bfa3171", "value": "T1DDC02B34872EC078882705394C0C8DBCF8121045515FCD7153E0268CFC86C380F48496", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691778336, "uuid": "6f733b73-3a09-4bff-8e49-a36494c3903c", "value": "3:HRAbABGQYmjUTjKPnd1KEgOQiRFHvUo1YSo/QJ6o/KbyYesbBSn:HRYFVm86d1fXtjvISoIJDQyYesbBSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691778336, "uuid": "f0b66765-76e2-4dac-82ef-31d8916867d0", "value": 149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691778336, "uuid": "76a9865a-20a9-4c1e-8b72-406cea114a33", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691778336, "uuid": "ff04e9ce-a396-40a8-9702-c2d14e3e0249", "value": "downloader-V.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618de710-3820-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691742222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742222, "uuid": "6dff4937-443c-43b4-95a6-6f591ac67ffa", "comment": "Malware payload", "value": "e6789b64f02226e7d59f92347208abce", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742222, "uuid": "45d06424-33ec-4a0e-84ee-042e43efc617", "comment": "Malware payload", "value": "ce76937b222eeba8b1d92b3ecb7571febb9f2b545e16b58abf27b5f9e26cfa4f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742222, "uuid": "0089d0c4-5eba-4e30-89ff-889e5e9f3751", "comment": "Malware payload", "value": "ca45da065895d9fcc7ea6dd7ab4bdc378796b4c9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691742222, "uuid": "87f941d6-860b-41b8-8b1f-f252b7bb1e87", "comment": "Malware payload", "value": "4490f2c617ece58a648ecd9831d46970712e6e896f44ffbc2e8d800abc5cb2808a8311299fa1ad036cdde4bb5118e694", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691742222, "uuid": "10f21e22-9aba-4b57-8d47-fd0302fe1fc5", "value": "T11D435B33A612FDD13B3B2E80F1442D254CA17957D7616228BEC41C993AAAB04DF7ACF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691742222, "uuid": "8132b1e6-4a1a-4ebe-ac18-f8adf0c58358", "value": "768:Gz5khmEqERx9sZhLmoeMGvm6BmYXOf1WaD2/LdbL+c93MgjWNMuKLk/41Z1XRzpy:Gz5kXf2rejBNuQa6RkAh6+bXRzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691742222, "uuid": "dc3aaeaf-4234-4b00-9c12-adde47eaedc2", "value": 56978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691742222, "uuid": "40102a8b-c6cc-4149-b4c9-812350a1e21c", "value": "text/x-asm", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691742222, "uuid": "6b142461-5a6d-4c7e-816e-bb0b9928a2bf", "value": "1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed08a5d3-388c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691788841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691788841, "uuid": "73493792-80e8-4309-b162-637079471030", "comment": "Malware payload (Amadey)", "value": "07e6914d5f9b75a83948aea01fcb2fee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691788841, "uuid": "1d619768-9837-4ae1-b6d6-e4db0de60d34", "comment": "Malware payload (Amadey)", "value": "d0491b5863b283ed5aefcd10d520a08930f7fee1ec2615e7ae8711bae8ae2104", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691788841, "uuid": "496ae134-e392-48d9-a4e6-ecce0859dfc0", "comment": "Malware payload (Amadey)", "value": "3f4818f6d788deed0080a46ca88e118a95ed3760", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691788841, "uuid": "2b712e3a-de56-41b0-b14e-332b19e9fb0e", "comment": "Malware payload (Amadey)", "value": "f1dead426e5e06a9a3f8eb4fb536b169c302cfb8700970bb03df49a0c00cd01b10f1268625f1dbb21af0807920eba2a6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691788841, "uuid": "943b97fa-47bd-4ac0-bf3b-5cc00b4a4cba", "value": "T12813F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691788841, "uuid": "cf79ac31-cb6e-426f-ab3d-049d74898d56", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691788841, "uuid": "f79f5922-5b9b-4a45-8043-65134cb31308", "value": 42982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691788841, "uuid": "90e91614-9678-40df-a4aa-5a16c80879c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691788841, "uuid": "aacd8eaf-7c63-47aa-9a31-2fafe2addc33", "value": "07e6914d5f9b75a83948aea01fcb2fee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fa587e-37dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691713154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691713154, "uuid": "85e8be1e-63a6-46d3-9239-19c5be4d4b58", "comment": "Malware payload (NetSupport)", "value": "643fff71bee1b24e675fc5a92bed04a6", "object_relation": "md5", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691713154, "uuid": "58689d10-e0a6-4081-8348-263fe8cb3cda", "comment": "Malware payload (NetSupport)", "value": "d086b384a6e802f4772b06ab41942757f2a9ba4805ba24443417fa2cc4abf607", "object_relation": "sha256", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691713154, "uuid": "09151976-9b94-403d-b351-c6201a2a769b", "comment": "Malware payload (NetSupport)", "value": "57e855bdc1bbcafd751714d3bdba193d0bb06a66", "object_relation": "sha1", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691713154, "uuid": "8a5c32ff-0a95-4ade-bb53-d61ed3dd20f0", "comment": "Malware payload (NetSupport)", "value": "4de50360504388dc753ce7d3cdbfe2550d38e1ac7b5bdc18b6a93ad78b3846dd33077593cac0da7db12a5b93206b2071", "object_relation": "sha3-384", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691713154, "uuid": "3eee48d2-e984-4917-abc6-2a766808b120", "value": "T15511881521B01B08E3F1873B14B1F102963EBC4EF85ACF4832519A9D18186B0BDA2F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691713154, "uuid": "db309daf-9951-42a7-bb66-d59052c59b3c", "value": "24:8NeZsx/TffnKaue+/lkIyXVqpl7pEQCab/2XT:8LTXBu7OEL7iQCab2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691713154, "uuid": "117a79e7-c1dd-4c68-82df-5c8c6491cc93", "value": 1092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691713154, "uuid": "deb7bb14-55be-4073-aec7-8393923cc7c0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691713154, "uuid": "673f4883-3d61-4bbf-a674-0d868df3ff97", "value": "Install%20Updater%20(win-stable)-compatibility(mac).lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a8497b-3834-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691750837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750837, "uuid": "1d81b710-bb09-434a-bfe4-a38b49c6b429", "comment": "Malware payload (AgentTesla)", "value": "615c13e909fe1ad30dc6884b0d69fad5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750837, "uuid": "c4443351-e2e3-4ed8-b229-1487679b5d99", "comment": "Malware payload (AgentTesla)", "value": "d1ff12469dd5ebecc7952c5f11e42e4f231f89eaebc04163345ab8637b782235", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750837, "uuid": "eb038be0-120c-40da-aa16-8fa6f279fac9", "comment": "Malware payload (AgentTesla)", "value": "625082c98b387aa1ca4dd762d41bdfed518990e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750837, "uuid": "bde5fe0e-9b98-400c-9013-5441d87828d6", "comment": "Malware payload (AgentTesla)", "value": "0c55aeaa911eceefc894fac58288639f306e034bb824658a20b2f952da923b02a0118900fd19198399437bc6bdbe012b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750837, "uuid": "b0787b8e-d292-47b0-abd2-fbae39e523a2", "value": "T1E77302A3077B3ED795D7CA96C60ABE90912EDC886618FCB17989C310BD1174C2C79DE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750837, "uuid": "5bae863a-18fc-4a80-b596-130675e57844", "value": "1536:2+K4wh80Vb/SCf6npOoMS8gYEzfYtYdS61wCjsmOjrSuFDQu4VfQ:dt28+b/SKoMRvtYdS61dceupQV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691750837, "uuid": "8ef12856-da0f-4e57-84a5-c71da6aa8d03", "value": 75422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691750837, "uuid": "ab948729-dd0c-4c06-8525-c8dfab211c04", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750837, "uuid": "82f509ec-ee10-4324-965b-97ca614febf2", "value": "Ferlam Technologies LLC 11th August 2023 Product Order pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65cfb053-3864-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691771435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771435, "uuid": "d216a78a-4aa8-42e4-ab93-85231b3fe4fe", "comment": "Malware payload (Amadey)", "value": "3c8d65b2c3441f9698f5e6fcaf1323f8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771435, "uuid": "6e5e95c0-6a1d-4f8b-9881-876319766e01", "comment": "Malware payload (Amadey)", "value": "d76feca1a5f56b91dfb3acd1a1bd24ddccd47fbaab11000e6dbe8340072363b7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771435, "uuid": "3d93f1ff-4b49-4fe8-b3b6-af3344db046c", "comment": "Malware payload (Amadey)", "value": "16da0719b2f16d3e678b1bb2b141c3a204f54022", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771435, "uuid": "5a13b9d0-ac99-46ce-a1e9-cfa6635d5984", "comment": "Malware payload (Amadey)", "value": "715dd0d3a3fb63922c085fc60b180bdf46e1869f02899eac8c4589e43eb760afc432577ecaf06fd6c61cd4fa39db0a35", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771435, "uuid": "5d9a3454-70ff-4693-8685-677f21ee1fd6", "value": "T1B6F4125396D85476EAF927B00AFB06C71B36BD909C74CBAB33456C1E9D32884E43172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771435, "uuid": "4f363e5f-cefb-4efe-8dda-8c39b13e1f7d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771435, "uuid": "71d49e65-bd78-4d7d-abe4-58c401a467a5", "value": "12288:mMrEy90/fhjILU+KBYqB1wJUx5PCTV4kC/zObCvj5z:my+aKBhBmJ6gTV4n/KgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691771435, "uuid": "af5d202c-9815-4803-9c3c-5763df4e240a", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691771435, "uuid": "60cd3f13-e5bc-4e02-b853-08aea1452f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771435, "uuid": "a5fa0d0c-7fed-4468-901c-b88c02a136da", "value": "3c8d65b2c3441f9698f5e6fcaf1323f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdd3b11-380b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691733087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733087, "uuid": "a4a7ac8e-62f1-4779-9e04-ffec7033274f", "comment": "Malware payload (AgentTesla)", "value": "0d35c9f13565826bfb29b02b8e8c0310", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733087, "uuid": "24e32a80-f7f6-4539-b70e-ebe8b2dd5e59", "comment": "Malware payload (AgentTesla)", "value": "d81a8f445244b53f79babe1fffa8f5dc26f064a6c9906c48a2f69dbf543d30f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733087, "uuid": "4c04d5fb-8a24-41b3-b3e2-940fdf4badf0", "comment": "Malware payload (AgentTesla)", "value": "1322819d385ff9250ec45fcbb3becc69fd8dc9e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733087, "uuid": "88871ea6-4aef-4326-bf05-07ee655bfbf2", "comment": "Malware payload (AgentTesla)", "value": "0d1941bce5823090f477895f275e2c21153983a273b94b3c98e5c96eaa83390e3b6e9d2efb04a9d66f1c6a2cc3078854", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733087, "uuid": "84025232-c946-4c7c-873c-5d34e1068d9f", "value": "T1BC051822E77B645AEF19A5E88E2F847238D6DDC0F1B5C588A7E72C0385C23114D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733087, "uuid": "88472105-685e-459b-9d27-71300fd0a8bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733087, "uuid": "f7badd1a-43d9-422a-8d69-cf943129de9a", "value": "24576:YYYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUO+UFBUSY3ycdYWvq6mvmi:fYRs6CE3jLbO9Rs6CE3jLbO+wbcycmg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691733087, "uuid": "431ad0a0-4a3a-4ab5-a617-5826626f741c", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691733087, "uuid": "fa98bda0-53e9-40b5-a4bd-08e0e321f43f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733087, "uuid": "3de572f3-1a17-494a-b1f8-96c3b2da9c2e", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1552eb9f-386c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691774736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691774736, "uuid": "12e659e3-6d57-4b19-8174-cff7b953cdc8", "comment": "Malware payload (Amadey)", "value": "324bdf33b0b615a6bbef3e71ec1468a4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691774736, "uuid": "281e01e0-f3cc-4a1b-af6c-3546472506dd", "comment": "Malware payload (Amadey)", "value": "d87a9ad1fe9c5535602d36e14d7d071b2408ae066f8446bb1eb4e21fb0e41791", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691774736, "uuid": "b4695af0-79d6-4303-899a-a9475b72d7ba", "comment": "Malware payload (Amadey)", "value": "2e6915aef3ec455caf9c39ee110f82aa124e173e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691774736, "uuid": "2b795a50-7240-4aa6-b45c-e15d4bbe05d3", "comment": "Malware payload (Amadey)", "value": "486fcc6ee93140bbaed32c89319b3ffd2177df69f7129b1c8c6b52ace677a421f482cc1f16d7f8c8c755cde12d48d08e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691774736, "uuid": "5d1e86b3-9723-4d2c-9ef9-535d2f9bea9a", "value": "T190D41203AAE98032E8F61BB05CFB03D31F327DA29D7492676751689D4C732A0A53577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691774736, "uuid": "f108ec01-c8b2-461c-a7e0-28d8c2547eaf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691774736, "uuid": "54312e1e-4971-4eb4-a6ca-83bcae6e0fbd", "value": "12288:GMrey90QyLJhHoH0YyYcw5rpdiI8i6sszncclDNvlDQ8tCXP:Ey6m0hPGV0I8iDyn5lDNvpQyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691774736, "uuid": "dc135299-f237-47a3-becb-0252b158dedf", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691774736, "uuid": "e988b85a-dd2e-4615-b58a-083a7361e165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691774736, "uuid": "4dc28b9b-dd7e-473b-a83e-05c5a2e50a8c", "value": "324bdf33b0b615a6bbef3e71ec1468a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d950653-3834-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691750805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750805, "uuid": "59b19d35-6732-43fe-af33-1a64b1d79aee", "comment": "Malware payload (AgentTesla)", "value": "6e5ff99fb7274c16eb6b4a52e2935a20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750805, "uuid": "2b45933b-ce92-4720-a85c-2a5492c658ff", "comment": "Malware payload (AgentTesla)", "value": "da777b118df10a78790553cb4a3927650886008ccdc80ce80e90a8256a6cd23d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750805, "uuid": "18f11995-12f2-4c9e-b0ca-941c229b0798", "comment": "Malware payload (AgentTesla)", "value": "40246a56559c89c101229c6ecf994f97c9c54d4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691750805, "uuid": "35128632-debb-4954-a58f-0d55ade04ecb", "comment": "Malware payload (AgentTesla)", "value": "4d3ae7339ec697cb2ab620edc908983de636456a6e0e1709ca5bcda48540529dfeb2dcf97066e69ab0030a9112bfd7a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750805, "uuid": "b84acfa0-a09d-4919-af78-70d85057db97", "value": "T1D5459AE0317D93CFD1A28DB10F898AB079F135AC98D4160DB0FA9B2E93D6355449C9FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750805, "uuid": "dcf9c420-2bfb-4bb2-ae73-61be5a96103f", "value": "1536:Vh+jUt+7t8hxAY1c9wqvnAv77vvvvv7vvvvvvv7vvvvv64+mhhhm+DtqOgE:Vh+o47t8hL+9wqY+mhhhmitqOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691750805, "uuid": "3c5b663a-6a16-4a26-a7d3-0f7c9bf39d6f", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691750805, "uuid": "b0201650-d22b-4915-898a-1e5b10539d72", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691750805, "uuid": "ba8da350-cef1-4de5-9b7c-82040d29250c", "value": "confirmation of goods and payment.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a13547-384e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691761831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761831, "uuid": "7ff7ca8e-656a-4bd4-9deb-f734cb9852fd", "comment": "Malware payload (RedLineStealer)", "value": "7418cf7263f033f12d0d4618fcc9dc3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761831, "uuid": "63859b50-a516-489a-8a67-45dc5e2c12ce", "comment": "Malware payload (RedLineStealer)", "value": "dada1745b9f6b74b38d3283e7ff9e5b86057e1ae53d1ea80d44ae2e24f55a386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761831, "uuid": "9a162260-595d-41c3-8bc4-f404a12d808c", "comment": "Malware payload (RedLineStealer)", "value": "cca8733c71817073288cd12a0ea700b93e087365", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761831, "uuid": "41d39e26-6fcc-4b8d-8481-c1448d4ad11d", "comment": "Malware payload (RedLineStealer)", "value": "e50198d3475abfbe3b1b3a5d52d5cedd707ef2a9ed6d8bafe9115abdf634b75dac79abb3222b299854190a37b5fdebb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761831, "uuid": "9020017d-7d4c-4309-bcd0-092bf43abbae", "value": "T154D41252EAD98063CAB417B06CF603C30A3AFC91597C97772395984B4CB2696F872737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761831, "uuid": "70d74a70-8b61-4f39-b338-e27ce76f48a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761831, "uuid": "60d647a8-6129-4199-a5a9-049eaf4ebdcb", "value": "12288:zMrGy90GGgmyfMbxHbmB0aKv/e7/ENKRFEX3p7IVqyBPQw8IVSW:FyjGgmTbZacG7/sKLE5Qd7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691761831, "uuid": "67feea78-d2e0-4604-883f-64f86ac7b83e", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691761831, "uuid": "088427a4-721a-4b53-8a8d-d4608ee6761a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761831, "uuid": "a4e1914b-316e-4617-ac7e-b169c1539fa6", "value": "7418cf7263f033f12d0d4618fcc9dc3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d008e0-3880-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691783360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691783360, "uuid": "f766e694-0342-4eab-8f11-70180647600f", "comment": "Malware payload (njrat)", "value": "3a5e863fd340ed83d844839092a57716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691783360, "uuid": "db2d05e4-07ee-4c6b-aa59-b80e94ee5761", "comment": "Malware payload (njrat)", "value": "db09709a85d82075be16e8b4810d04a14dc478d720dd8f5680d32d8afd02f3cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691783360, "uuid": "da1389d2-c743-4860-b229-af62d45aca1b", "comment": "Malware payload (njrat)", "value": "331c9bb86b83200609aa4b6d36ce9f30270bb123", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691783360, "uuid": "2975f3f7-fd1e-4e2e-978e-c371cef229b9", "comment": "Malware payload (njrat)", "value": "9f890aa033ddd45bef2a22725c31d82cda7f7460fcb0998f2ed7d434e5ee8d6ee7b9c83aae282ff86019e388ce98d659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691783360, "uuid": "e1ae3b81-3b37-4a2c-ae88-f59df871a59f", "value": "T161E2F74677B58229C6BC1AFC8CB313110772E3438432EB6F5CDD98CA5B676D04255AFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691783360, "uuid": "7e09844c-a7e5-4b8d-9869-e57e876b85d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691783360, "uuid": "e8b3581b-1153-47a8-bf6c-86df28b857f0", "value": "384:a0bUe5XB4e0XypOjfmiaXLilpknDzWTPtTUFQqz9RObb7:DT9BunjtaXWlNLb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691783360, "uuid": "03ced645-533e-4de2-a250-de85998a340e", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691783360, "uuid": "99967bbd-0905-4fe6-be2f-3f2dee7d3191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691783360, "uuid": "4a05e7c9-c7c4-43d8-9e53-4920263b73bf", "value": "xzr8LT5enhh7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0531a7b-384e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691762138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762138, "uuid": "82a42420-639a-4c59-bcc8-53ccdda92520", "comment": "Malware payload (Amadey)", "value": "fa55abf2cac741fdb6a865c625a23dcc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762138, "uuid": "d1a82af1-1e3c-429f-9437-e2fca2b3fd56", "comment": "Malware payload (Amadey)", "value": "dc477d69707d6c57f26de2c303e9e2a1b20f00352bfc67ac9e8ae46ba22602f3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762138, "uuid": "907858ec-13f9-4647-bf8c-ca39174b5855", "comment": "Malware payload (Amadey)", "value": "ad5dab44b7c7f7ae81a38b529a96eb23e1ce3664", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762138, "uuid": "c3b243bb-70fa-4000-a30c-52d380580975", "comment": "Malware payload (Amadey)", "value": "e6eea46501604592b0e2721233dd583af544a3ebc7922b1f7006c8e532a4d7d1bca0e1c6d5bb361ed1da97eee6c69289", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762138, "uuid": "5ff3d940-0179-4ab4-8e45-dacc2df176c2", "value": "T175D41252A6E9C073D9B527702CF502D30B39BC711D7883AB6B95948E0D72AC9BA31737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762138, "uuid": "ebe21d2a-7910-44c2-b8bb-25bc148afe73", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762138, "uuid": "c1d1df73-b5b0-4423-a114-016c70d9b560", "value": "12288:4Mrwy909lXoF0UNN4Rzi5JUbqDeiZlJVmMygG/JnjX0g:4yOOCUMRm2bqDeiZlJV7bG9kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691762138, "uuid": "555b56a5-e40d-494d-a628-5cad3b035259", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691762138, "uuid": "3f0815e2-e9e5-4b27-bd0d-1eb5c306d3dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762138, "uuid": "a6fc952b-7e30-4b41-9825-f960a6098eb9", "value": "dc477d69707d6c57f26de2c303e9e2a1b20f00352bfc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ab6f9b-389d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691796047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691796047, "uuid": "34e890a1-cae5-4448-8832-e7c6f9a09fb5", "comment": "Malware payload (Amadey)", "value": "d2e682854c976bb4ec74dcc9cfb867ae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691796047, "uuid": "51ba38e0-d4e6-41c7-a1d9-7c371913f098", "comment": "Malware payload (Amadey)", "value": "ddcaa2edd53d06020a19bb40fd6e0ec001c0de100817834f6a66e64e37c7568b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691796047, "uuid": "e248cefc-46c9-4cc3-ab10-4f101c3f40a8", "comment": "Malware payload (Amadey)", "value": "bffdfa9eabf8c8545f90f3b21a661c8dd96abfeb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691796047, "uuid": "fbe7827a-7aff-4db5-a175-0847da1f5e0d", "comment": "Malware payload (Amadey)", "value": "1dab962615c38b398971298e7016665d51210b0078230422f9b806686ee33ec0ed413475aa973e9d31a0bc3d7a84ef38", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691796047, "uuid": "7ab20aaf-68e7-40f3-b42c-27226199bd69", "value": "T1A4D4120366DD4076DEB5677064F307930B3ABCA15838879B2785A84A0CB3A95EA7173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691796047, "uuid": "28efece2-dd50-4ac6-b0c0-1623f9ad53cd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691796047, "uuid": "1cbb78eb-9794-4fbc-aa59-fc58dcf977fe", "value": "12288:YMrDy90cY5/Gvb3xNQKu/e7vvXKROEX4p72YSHeauon:7ykeD3xG9G7v/K8Eg/S+xE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691796047, "uuid": "f92ed58c-30f3-47a6-9b7c-9fa463e9009f", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691796047, "uuid": "637f62a5-de97-4eb9-a69c-0d5daf10a33b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691796047, "uuid": "b9cae342-6207-40c2-a9fa-ea65b97e61b8", "value": "d2e682854c976bb4ec74dcc9cfb867ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e348974-3825-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691744417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744417, "uuid": "fe2d9c44-b392-48ba-b3cb-db7e370ced3c", "comment": "Malware payload", "value": "ea34de22fd3ea5cc61ee8b3d78b6b007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Spacecolon", "colour": "#772F99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744417, "uuid": "753dbe05-31ec-42ad-bcfc-6a45a5b36dd1", "comment": "Malware payload", "value": "dde40ae4ab92898f2254a188d34e418e69f856084cf44c4ceb8510db2eaecba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Spacecolon", "colour": "#772F99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744417, "uuid": "e38b8a0c-ef32-486d-97f9-127895170a06", "comment": "Malware payload", "value": "ec2b09e9cf073881878a1addb4c937a33f8fb9b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Spacecolon", "colour": "#772F99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744417, "uuid": "54bfea8a-5d16-48c6-b649-cd3c09512c93", "comment": "Malware payload", "value": "6963a95370f99d93975ae64940218625157100bc14fa86ad536af3a2f814ee76c79eb2ae45f76da7934f8f99ef7243e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Spacecolon", "colour": "#772F99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744417, "uuid": "c716c902-b02c-4de1-b7df-935a169b0e70", "value": "T1C9568C12B780D439D0661635D46763F94B7BAF34E6298C8B56F07C88BE7A582273E307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744417, "uuid": "95436e60-b6bd-4493-ace3-a8939f9ecef7", "value": "cd9b75e44e0ce95d77a298584ebf120d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744417, "uuid": "a742a2e5-c6d1-4c4b-be77-928335fa81a7", "value": "98304:2ARVAa5q0gZsBkkgetJnI1Y4+2uASjar:m6Bk9I2uT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691744417, "uuid": "6656fc45-97ad-4a5c-aae8-abb2fe99bf61", "value": 6174720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691744417, "uuid": "b067950b-866c-4a14-8534-a43c9f5af5d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744417, "uuid": "78a1c598-5391-4c5f-a1cb-fb2d53272588", "value": "Project1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ed215d-3897-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691793344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691793344, "uuid": "6edfc7fe-922b-47ff-989e-59267ba7f2f4", "comment": "Malware payload (Amadey)", "value": "a7b909568ac1fe53e87209e4247af1e2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691793344, "uuid": "308b2953-1a99-477f-ba2c-6c1bb6f2e93f", "comment": "Malware payload (Amadey)", "value": "ddea13478bf0ee20775335b7d03a0e36cb7b9e86d0b7d8b80302284043d9babd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691793344, "uuid": "c5c23437-fbd3-4bc1-8f7d-79688a12c272", "comment": "Malware payload (Amadey)", "value": "4b1cfdbc970818efa59f5106992d4474527b6d5c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691793344, "uuid": "f77ee1ed-d9b7-4df2-870b-440bd26710b5", "comment": "Malware payload (Amadey)", "value": "4284836047ad974a1ecbdabfda769e6a82a7599f6055a473815b9ef393ec612c2f6ca6ea861da8b8fc3d2d5ad3cb2349", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691793344, "uuid": "7f3fecac-7bf1-449f-96e5-d1f12deaffb2", "value": "T1C5D41212ABD89072E8F6277058F713D30F36BCE099A493BB3651D99E08336C0A57576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691793344, "uuid": "79a451ed-9a5b-4ef0-8566-f6d0f0ccf0e8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691793344, "uuid": "4d4ac07f-05f4-409b-a593-cb55951808c0", "value": "12288:iMrCy90OPHk9LEKcNc/WpCSh7QE6nbYDTkxUsAfQXX6Kubx3tn0D:8yZH/Kkc/WppQE6bATkKwDO3tw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691793344, "uuid": "0da41268-fec9-465f-a464-2b9b9504aa0b", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691793344, "uuid": "3a605545-58ef-4154-b736-9f85c27bce06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691793344, "uuid": "3d8b5b74-fca9-412f-8403-523c8ad6411a", "value": "a7b909568ac1fe53e87209e4247af1e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d30c50-3824-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691743808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743808, "uuid": "8d734641-847b-42a1-bb4c-99686e5bdc47", "comment": "Malware payload (Mirai)", "value": "10c0c185889c3e7d54e4ff36b0f59c30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743808, "uuid": "9a2773f2-abab-408d-a252-c2f621733ba9", "comment": "Malware payload (Mirai)", "value": "e1cb8cf85745f7a771b33eab060e04556b1b33d186a65ae069377668fcea47b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743808, "uuid": "0ab80cfd-2994-48b7-bea7-5a175e9dcaad", "comment": "Malware payload (Mirai)", "value": "8fe16e712cae7edca759c2481eda7d997520840c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743808, "uuid": "6514c760-1987-4937-8ac7-49e8f5386235", "comment": "Malware payload (Mirai)", "value": "4cab417b4dabdfb64059d7c3b20c1ad13d4a3eecd52aa0028ce121d842acf28cf24fd7865e8432c4fcd9917c8a4fdbe6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743808, "uuid": "24d1c0b2-0b49-471b-8cd3-3d5b73b64b92", "value": "T171832B43E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A313CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743808, "uuid": "8d2d3dd5-0ac3-4b16-b570-716d207e1fc2", "value": "1536:ClNtAyOXSU3rUk954CKmg0KfjyJChujEaX9LmkxVqOEeofzee:gbOXSU3rUkmmbJy94LmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691743808, "uuid": "227d160f-91d5-4fc1-81b2-a06023a531c6", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691743808, "uuid": "fcaa72e3-ca9f-4178-b53c-88f134ae26ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743808, "uuid": "c230bde8-9cab-4777-a8b8-e57064d8556d", "value": "10c0c185889c3e7d54e4ff36b0f59c30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd66cf4-383c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691754399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691754399, "uuid": "7a9a86ba-b643-4ca6-bcfe-757479c4d82b", "comment": "Malware payload (AgentTesla)", "value": "c8a27e60c51bd2f7b17ba73eca3a72e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691754399, "uuid": "2223c540-7d45-41fe-8b09-1d0fae633898", "comment": "Malware payload (AgentTesla)", "value": "e24555189a0c9c86d7248ac09b8321551327c3d2896dff4c4ac4681c1dd63b10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691754399, "uuid": "417f1930-e1df-4052-a0cf-73e4343722f7", "comment": "Malware payload (AgentTesla)", "value": "0ec1f8176e36869b6234911ad4993753d777cbcc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691754399, "uuid": "147660d0-608f-42b3-bafd-1809054a2757", "comment": "Malware payload (AgentTesla)", "value": "b7edd67ecfb4e02bad3f09ce10c821c44f3d5e734a1d7a6be8e999a8566840d4f397333195b42b167c2dda837075a799", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691754399, "uuid": "1026a252-b590-4178-9ad1-c9698d44cfda", "value": "T13204D70FF94B8AF1C2995B77C5EB05040771D681B2A3DB4A798EA3ED6C433BA9D01607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691754399, "uuid": "3e630667-5278-4c13-b098-2f665aed8caf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691754399, "uuid": "81c64d5c-3a69-4932-8a7f-bdc6e66780b2", "value": "3072:+ExSRCHpyx4kWMt4zpD9B820v/1l527+qmva0//l/AxiKc7zN05+ls1Ti0dp/c:HERCJq4d7WL/hA2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691754399, "uuid": "49505d17-f915-42b6-8b1d-f5396cbb67b3", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691754399, "uuid": "ef4e4fe9-7cbe-4f0a-9f64-b63a594f3584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691754399, "uuid": "425e0bd8-f28d-47d5-9692-7a68b1adabf3", "value": "Zahlungsbeleg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d14bbfe-381b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691739986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691739986, "uuid": "6fba7d20-d681-49ca-ae6e-314afcd49000", "comment": "Malware payload", "value": "ef4de2564a76edbda614ea54b6d78a76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691739986, "uuid": "3c003a5d-3a21-4bae-8987-88e96c5d1fd7", "comment": "Malware payload", "value": "e35c87c08c28d8e1796b43484b54dfa8f13adb80f1e1e4161d306ebd762f631e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691739986, "uuid": "daa37e60-5e08-45f7-a6b4-c7291a80742f", "comment": "Malware payload", "value": "33d6dce4d95b954a5a926afed36e13d7b8a306ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691739986, "uuid": "7c7ec467-cc71-46cb-98ee-832b324195ab", "comment": "Malware payload", "value": "4165faf5ec183ad49b9df96f09d77dd92449b04ad2c57f974b0d0debfb81320682c3688b02f3a49fb0496b057bd24aff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691739986, "uuid": "7ed6eadd-664a-4488-b0dc-093c1f5d1b93", "value": "T1BE049307FA9B89E1C289173AC5DB41840775FE81F297DA4B7A8F23F548437BA9D02607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691739986, "uuid": "4f9827d8-ffa7-42f1-81e1-c4af2ad8edf6", "value": "3072:fMGOMJJoLOJaemiXSOidqw0uV+jhWDUZGosgy/m:f9XJZUN0m+NWyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691739986, "uuid": "4d2190d7-7f40-43b4-a277-c3b31fe91215", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691739986, "uuid": "0c81c42f-9dbe-4d1a-aca8-2d08e21cb69a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691739986, "uuid": "3e2742ca-45dc-4a71-9bf4-6b3cbe623df6", "value": "SOA-S0047952700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4802deb-3885-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691785713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691785713, "uuid": "54dcd28a-3e08-4811-bdfa-e2c5acf69ecd", "comment": "Malware payload", "value": "0b91345a80aad6fc542206df79f205d9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691785713, "uuid": "62f904fd-5211-4da6-a71c-06d638bbb4ec", "comment": "Malware payload", "value": "e53181c8bea048f7773afd03db35fbb2185403f21739634cc8325fa9d819e595", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691785713, "uuid": "236bb4d0-de79-431a-a5b4-55ff8aa58007", "comment": "Malware payload", "value": "f8a6792712c138716d2a6b558f45fe53a1bb315c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691785713, "uuid": "fe6c87de-c452-41c7-b4f9-31a13fd6fc58", "comment": "Malware payload", "value": "0716f96c2342010b56f67d3bc1882c7066d3f901724cee66543ebaa33951e4edbc44d0879a179acf5bbd34d4411862ee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691785713, "uuid": "6c195c7d-e2cf-47a0-8a31-db5bb47dcf0e", "value": "T1DD649D01F184C572E52A28741630EA714DAEBC301A6F999FE7C94C7A9F34BC29724B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691785713, "uuid": "be9fe473-f7ab-4323-b0a7-36e871ebe429", "value": "032b5e3a4b10d75752624e5eb0d27310", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691785713, "uuid": "ffd6eed5-8204-4429-a732-8f3f034aeee6", "value": "6144:Wl03E+qRHwsGcKhxhDqh0Ej00c/JOMVEBe:Wl0U+CHwFcKhXs2x7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691785713, "uuid": "ad7f7de3-3867-43dd-9c4e-27be81a11928", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691785713, "uuid": "1a6ad9cd-5574-4e8c-858f-5c7ffd835ba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691785713, "uuid": "5219259e-2ec1-4e19-a9a5-4ea9a4902b62", "value": "SecuriteInfo.com.Win32.PWSX-gen.31538.3030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734f77dd-3807-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691731514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691731514, "uuid": "0408b191-d8fa-4421-9eed-ada8e3ed8514", "comment": "Malware payload (RedLineStealer)", "value": "0c8972daf5bfd9c451bb35a829a0a76a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691731514, "uuid": "7c3f403a-a7a5-47ef-9e0d-58100fc823eb", "comment": "Malware payload (RedLineStealer)", "value": "e70a0a203a7ad5a9b8526cc0615b51bbe5358418e277014847db9b4df774c271", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691731514, "uuid": "298a6baf-f2ec-4b00-a647-6030b4a29dc2", "comment": "Malware payload (RedLineStealer)", "value": "903243415cc34a7069d4bd8bd6935ffed1c87ae2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691731514, "uuid": "0c84a373-9a8f-4573-9e63-288d63a19ce0", "comment": "Malware payload (RedLineStealer)", "value": "c1442532b7bda9eb8b7876cef2d153261c15bb498a4057b37b6c18cb39b2d230c9dd3a3e80b59d9b2e751210d6a99fcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691731514, "uuid": "05a387f6-97b3-481d-8743-5a0f809720a6", "value": "T15064E0A13F93D071C9AB46704931EF642B7FB87264748C8B37A4CA7E5D346C1A72934A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691731514, "uuid": "422a0da5-7c8b-43c1-9612-c47290c9bf6f", "value": "b2ecd2f1e677ff2d380d045dde6c6686", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691731514, "uuid": "99663486-03bb-4d02-89f5-8727f8aca5c3", "value": "6144:6z8ULN2/mUYEs4uKmypfkftJJGG4TdudygqdKzHKZ:6PR2/m7OrVEtJgG4gIgqdKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691731514, "uuid": "84d76b3d-295c-41d5-8fd6-a2221da7060c", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691731514, "uuid": "aaeab6f4-3a11-4086-8432-798f9925227c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691731514, "uuid": "eea3f44d-6296-488f-86ff-e50ddbfabd08", "value": "0c8972daf5bfd9c451bb35a829a0a76a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0972c1fe-3847-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691758824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691758824, "uuid": "2b84d9a1-131b-422c-bb85-0a6bdbdb5c6f", "comment": "Malware payload (Amadey)", "value": "0d8c9d569be26b558758cf9ae41f6f32", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691758824, "uuid": "e34feef2-d244-44bb-b11f-5755a8027a8d", "comment": "Malware payload (Amadey)", "value": "e71433ff6592e96e9182e19a58d2a521e55642f35483023df01cd6b89e3a4214", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691758824, "uuid": "2c8926e4-fa45-4842-8214-a150246a9c68", "comment": "Malware payload (Amadey)", "value": "1dd93b4e0de4189419dbeb37abcc975854cedd98", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691758824, "uuid": "6e50da38-733a-4003-84be-6949993ada31", "comment": "Malware payload (Amadey)", "value": "3990c738dfa56b31a593313ee12d6ebd68f96af07c75142869a76a28ef39c0d2742c36b22704aff0de271ad78a11dcbb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691758824, "uuid": "11fb80c0-fd0d-4eb9-b942-f2cc3dc2dcb2", "value": "T174D41243A7E94473EDF217B468FA02830A35BDB14C748B6723896C6B5472ED1A93533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691758824, "uuid": "6168cbfd-d378-4ceb-8dd3-0150716d59c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691758824, "uuid": "7ff0eec7-dba3-4b56-b5af-21f1ab099d80", "value": "12288:0Mryy90khbj+OKlDtvL21SSHc8CwTmKA/e7dDJKRhEXMp7VJetOID05EgV10pERi:WytZj+NlhvL2178MmPG7dtKPE8SgsORi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691758824, "uuid": "f358449a-9034-49e4-a94a-c9fd1597808d", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691758824, "uuid": "307cf4cb-ea9e-4b9c-a270-3b08ddb50f3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691758824, "uuid": "ef61e01b-c1b2-45ef-b0b3-595f22f5bf89", "value": "0d8c9d569be26b558758cf9ae41f6f32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05696e08-3864-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691771273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771273, "uuid": "21970683-bed1-42ce-8b32-b57ac4884f9b", "comment": "Malware payload", "value": "ad90cf327107b24d28f01cde88fb6248", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771273, "uuid": "619e4624-d3fa-40e4-a5d0-74bc510f1117", "comment": "Malware payload", "value": "e754df289cc66e256c6b9e0f6e1ab979e6aa1d8c504fa66971063c9c51991acc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771273, "uuid": "142217f5-8b80-4a29-b52e-53c36b30865d", "comment": "Malware payload", "value": "03b1affd9afd62bd4c0a328420e5c4340df6f5b9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691771273, "uuid": "3610eef2-ab88-4890-a957-f1eba217cfa8", "comment": "Malware payload", "value": "27d18be90a68291be5e326929d1849cf818ceb2558175c3f5f53acf39d3fc0aafc89e63c860d9b5c02b1dc71efe78c9d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771273, "uuid": "6c1819e9-857d-48dd-bc3d-f18f9f954f9c", "value": "T120748E01B284D5B2D57A29341120EA714D7DE8302E2F999FEBC95C7BCF38AC19624B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771273, "uuid": "f2e3e2ab-9ab2-489c-b136-695a323688e4", "value": "032b5e3a4b10d75752624e5eb0d27310", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771273, "uuid": "da8e4fce-357f-4476-ad11-91a97f9deeaf", "value": "6144:IUs6Lvan2DtPqnMaqy1cps3shPT0NI10cm7gKlP8zFLPw:IUNLv5DR9Vy1Es3shPXo7Cs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691771273, "uuid": "b2803496-c883-4854-b20c-dfed4afeae81", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691771273, "uuid": "18e1bf30-d984-4152-ad5c-e18e2b066192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691771273, "uuid": "fcd114cc-d5b3-41e5-ba56-2f79d46c9a8d", "value": "SecuriteInfo.com.Win32.PWSX-gen.30928.22399", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f8d6dd-387e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691782461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691782461, "uuid": "ce58a111-2f0d-425a-9411-5d81a6af5771", "comment": "Malware payload", "value": "e37c35d72029ee64e9b86adc6dfb53f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691782461, "uuid": "d5c94264-3bba-46a8-9090-27e232ae375c", "comment": "Malware payload", "value": "e936c50b852c04e153e12893717f7ef6e059dbce99fe615243d1109c5cd1de66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691782461, "uuid": "a90dedfe-d38f-463e-880a-4ea6e524156b", "comment": "Malware payload", "value": "96c572d1c7813e821bcac26460a4b8777c4e7cf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691782461, "uuid": "fb77cd6e-899e-452b-930b-bb3f5ba00744", "comment": "Malware payload", "value": "29595ae69d770f3c465d1d18bbb33f65fe8b38716b13317866f99aa0dd04742552b018f6549844bbaecbd734b4aa04b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691782461, "uuid": "faaf06cf-8d35-4b0d-a2a3-2eaf39c0f989", "value": "T141E218467BE54225C6BD1AFC8CB313200B72E3478532EB6F5CDC88CA5B676D04255EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691782461, "uuid": "71847cb6-dcf2-4ea3-8503-3b34dcac809d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691782461, "uuid": "eb25b55c-e3e9-4e76-a96f-efa8e4f1e181", "value": "384:00bUe5XB4e0XGODB4GepWTvtTUFQqz97ObbbF:RT9BuVmDulbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691782461, "uuid": "427d63ca-1f83-414b-89c9-8c401a367971", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691782461, "uuid": "bf71b8aa-5027-4e6b-a796-eb0a3cb2c589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691782461, "uuid": "de8f5954-0ff7-42a6-be4c-113af90d53ce", "value": "xaKdKZI3e9WD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448153de-3803-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691729718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729718, "uuid": "e884b984-b0f7-4eab-a83d-72331b5609c6", "comment": "Malware payload (Mirai)", "value": "86abc72ddba74a3899363b13d356afac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729718, "uuid": "9799441b-3dde-4f52-9455-db5f7a938a6a", "comment": "Malware payload (Mirai)", "value": "e9f3ee3aed2eee18bd62b87439431e383d6ccd2287dce0157c6f0daa6db78e76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729718, "uuid": "aae20754-f4df-48cd-b80e-1ce60a6b87b8", "comment": "Malware payload (Mirai)", "value": "35733ccb6dc5afda7579533891c4c989a61e138a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729718, "uuid": "911fd1e0-5b64-49c8-b39f-e2b8c21611af", "comment": "Malware payload (Mirai)", "value": "72aabf0c89575cb4777dc4af04e878c234811e631c4c28fa9ba2de34c8f1447874c300085fe9c27b55b49766605fdcd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729718, "uuid": "0ab2ac3c-84a0-47cd-a125-cf056b4b24b9", "value": "T14D633A21BA761E2BC4C1A47621F74B25B2F143DA26ECCA0A3DB10D9EFF719446543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729718, "uuid": "291d2ca4-08ea-4d4a-99b2-097f0d564730", "value": "1536:lGRaTYmol/hGIAs4PNvAyQdGm75123tStll:lya7hJgGmVDrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691729718, "uuid": "da565a90-b9ea-45f8-80af-df01acf51a92", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691729718, "uuid": "b6651b0f-a8a4-4295-b3ca-975879ae095f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729718, "uuid": "5cf3e987-ff3f-41f8-86a9-61e8cc5f38f6", "value": "86abc72ddba74a3899363b13d356afac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b234a5-3811-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691735677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691735677, "uuid": "22613fe8-e5bb-4a78-8c83-9d35d8ead809", "comment": "Malware payload", "value": "5fe30ee66a76755a5adcee9248a13ebd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691735677, "uuid": "0aaa5fbd-e482-4543-80f3-bbfd86f7c057", "comment": "Malware payload", "value": "ea82d577f0f93ab3336984924c53bf411207d309dba7eb7ac93678834ccbb467", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691735677, "uuid": "4b7e3358-67d0-491f-b936-3026c9818a41", "comment": "Malware payload", "value": "0b3a4ea44693d7ff375754188a81962f5b6e7aec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691735677, "uuid": "e4f8b12a-31ed-44c9-b474-73af114d663e", "comment": "Malware payload", "value": "343352c87395d78b208c522107e7704064ba740c7b670a396ec0ce9e6e79c0fc0f1734ad86ac78ebe99a864792470370", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691735677, "uuid": "19fbf777-2e90-45c9-9393-02b9bb66387d", "value": "T16794232422D4C017E031DB70A57B41D67AF67F25092DB72F47E2EF247906722CE1AB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691735677, "uuid": "73b85b36-2478-4158-af81-56c797b5c3b0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691735677, "uuid": "2f1ee8bc-a04f-4073-b775-5a27c35a4376", "value": "12288:mYgMb6TR9KFpW7fBR2WMV5bhMHjJzgCXP74:mYgMb89KC2WM5bYJEYPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691735677, "uuid": "fdb35404-c11f-4900-8e3d-2edb89c2abc3", "value": 445256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691735677, "uuid": "2fd875b1-6afa-49dd-a688-64c78bf422ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691735677, "uuid": "e5617481-ae72-4188-bd5a-344e233d4677", "value": "vstmididrv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0bd7b9d-384c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691761226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761226, "uuid": "6ff20677-042a-4f03-b86b-6b2ff1bea8c7", "comment": "Malware payload (RedLineStealer)", "value": "d301a75ff2b18a4712da235bfc642a01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761226, "uuid": "0c03be16-9bd7-4d2e-a392-3d94cbe9fcda", "comment": "Malware payload (RedLineStealer)", "value": "ea8929f0ad36abb8af8d27ad2dd381cc36c1c07a3a4ab35a306146c91203f682", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761226, "uuid": "27140dc1-9eab-4509-931f-55995e1a5813", "comment": "Malware payload (RedLineStealer)", "value": "a99af4a7e25718129ab4524ac44b1e8e7875efd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761226, "uuid": "2dc10e4b-8344-49f9-93db-e3a302bcd12e", "comment": "Malware payload (RedLineStealer)", "value": "15f2b9ad78d6e8092ace513618e9078b416cb41baefbc227de8915d10e1c1ff7f92a96c2cca29c246d50b2ce8c7ebfa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761226, "uuid": "39e10f49-4baf-4746-97e7-a72c1b713c2b", "value": "T1FCD41223A7E49033DAFA27B158F616831B367DA18CB4936B7311AC9E4D726C4E535323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761226, "uuid": "2a284799-7564-42c3-8e51-cf21f3f1386a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761226, "uuid": "ef0b25aa-7162-41e6-b926-c50adec74497", "value": "12288:vMrgy90t0rC0Ds0HcX4j3o4ALSErkR7AwEt730NW:Hy20Ds08XOo4ALS+A7AwEB+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691761226, "uuid": "b1629cf2-1da5-4101-bf46-1059b0aca54a", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691761226, "uuid": "cdb8779d-9e6e-4bb8-812c-4a56eb135aaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761226, "uuid": "62606ac4-b3cb-4bdd-84ab-70f0388c9468", "value": "ea8929f0ad36abb8af8d27ad2dd381cc36c1c07a3a4ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87450b6b-388b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691788241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691788241, "uuid": "484e064e-2f7c-4cb5-87ec-2bb7dca5e0df", "comment": "Malware payload (Amadey)", "value": "9e83018175b3284e589a774c2dfcbce3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691788241, "uuid": "bd4ec5d1-f357-460f-9437-0757dca14129", "comment": "Malware payload (Amadey)", "value": "ea99c6b723ea068e19b90918439d2a1659c3e61df031c0fdf37301377ae7d6ec", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691788241, "uuid": "97be704d-3fcc-4286-b1ac-792484d1d153", "comment": "Malware payload (Amadey)", "value": "8f9ce655790eb3ea702301b3eb5033fa1545ec7d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691788241, "uuid": "30e0b252-e111-4ad6-af3b-758bfc41332c", "comment": "Malware payload (Amadey)", "value": "b3c2a48dd237470ede4517b1d66e858f0c1f602f15d369988bd8400f38ab5f4281b557d715e4d906c98a798ffdc3a6f9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691788241, "uuid": "7e166e4c-a8b6-4529-9a01-5e978aa56f51", "value": "T1BD6439417952C072D960A1721AB5BFF2C59D68249BB049DB7BC00F76DB212E77A30F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691788241, "uuid": "9039a9fc-1e9d-4a16-9396-8c6f0025b066", "value": "44e769941d2c6ad88bf42ac4adb36135", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691788241, "uuid": "6efabb11-d2a6-4b62-aea9-b962a44c7411", "value": "6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691788241, "uuid": "3f193260-b0f4-4e11-a781-3e5276487e46", "value": 321162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691788241, "uuid": "d9115e22-1b98-4115-9354-fba051873da8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691788241, "uuid": "9c4c945d-206c-410e-a0ad-52bf97dfdf46", "value": "9e83018175b3284e589a774c2dfcbce3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf242a68-384e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691762136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762136, "uuid": "78e5e0a9-5643-4949-8b28-f637b75135cc", "comment": "Malware payload (RedLineStealer)", "value": "92eea20b794bb5b552e33e406b54d81c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762136, "uuid": "8d1c7d1d-7f84-4892-b994-021f11bc1461", "comment": "Malware payload (RedLineStealer)", "value": "eabe37f98d7df43c579020482a2c6ade8f8c65b0fa6bdb90e2a863a70498d656", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762136, "uuid": "eb73e033-5394-4f0f-bf4d-ddee6a83e46d", "comment": "Malware payload (RedLineStealer)", "value": "aaeb4634c7a883aff44ec22498ca2198d536ba7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762136, "uuid": "6034588e-838b-491b-b92b-a41370752e3e", "comment": "Malware payload (RedLineStealer)", "value": "3b36b7beaed7ed5b53b5ba0cd8fdb947e6be848372b512fd19021710d18cc3164a2d4a4d9f105532467e20dcf56ed2d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762136, "uuid": "81d619ed-2dbc-48b5-b7b9-fc55fbb74a32", "value": "T11AD41242ABE88062C5B437704CFB03D31B35BDE18DB8D32B2B42AE5A5D71694A935737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762136, "uuid": "23fa0762-4a68-4f89-bbb9-5867ff2db470", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762136, "uuid": "fc24cc0a-0a0e-4a5b-829c-6dbbc1f62b43", "value": "12288:SMroy90I5LvaEqJmJ15wWOxK68I1cc8d47nqLLk:uyDYEqL1K68IWe6Lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691762136, "uuid": "fff9efb2-4d3d-4f27-bce2-d5322f5dcfbf", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691762136, "uuid": "9c259c94-2c2b-478e-931c-0b41bc5d1d52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762136, "uuid": "c34b0546-22b6-4706-a8bb-2817d174b871", "value": "92eea20b794bb5b552e33e406b54d81c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2fe200-380b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691733109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733109, "uuid": "8757262e-cd34-4de7-b46e-f8d5f4f5e060", "comment": "Malware payload (AgentTesla)", "value": "4661ab2355123a6f449700b13ffc8e29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733109, "uuid": "ca0906ec-bdf5-4b3f-b0c3-ab10434cf1fb", "comment": "Malware payload (AgentTesla)", "value": "ec138aa171cc6aa7f403e0dbc2d9a79cbfe698a0f52010abb9d28c2b079e650a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733109, "uuid": "da72615e-5867-4b78-8d09-5295bf10549a", "comment": "Malware payload (AgentTesla)", "value": "928d155bdb6dda89cb7aa4fc0a4c23ce156f42be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691733109, "uuid": "58be337e-c647-42ce-b6cd-ed19113ad283", "comment": "Malware payload (AgentTesla)", "value": "ced27bf078d676eed7e3a340c7c524c09ee512cb32bf7e51046b05bff561b79b8419e02cf2f227d238d877df7c650b8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733109, "uuid": "48e28022-ad7a-416c-aff5-9c6a906ffb42", "value": "T1FA15CF20ED7DB982F19E0A78004ED75E837388962176C73A566F51C2D7D32C116CFBAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733109, "uuid": "4aa3830d-746a-41c7-8995-e718813a49fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733109, "uuid": "bd9eafa4-cf47-4fb2-91f4-db187590537c", "value": "24576:g1lrsH1TISgJEWuB/NwpFP2zs5vI6PKSTjq+:gbqQaB/6FL5vIhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691733109, "uuid": "5a93e7f4-a7d0-40ed-b817-356a937111d7", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691733109, "uuid": "26614bd5-4aa6-4871-8a7f-219def5ba04b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691733109, "uuid": "60fdc483-e849-42b0-bf4c-6b42b7cd51d3", "value": "orden de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb6bed7-3840-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691755961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755961, "uuid": "581c5b94-34f9-433d-bae6-83f42f70956e", "comment": "Malware payload (GuLoader)", "value": "8c18a8d795aa77b5c48b1c033940b3b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755961, "uuid": "a6b5c9ea-f01b-4138-ba76-9b79e5af2b44", "comment": "Malware payload (GuLoader)", "value": "ee69e6a07b96b5e3f1b5064cd1867dc5a955c16e04712584ef86c8a43bcfd7de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755961, "uuid": "9681ac3a-a689-4266-9b1f-b01312d0c9f9", "comment": "Malware payload (GuLoader)", "value": "47692376a1bc661e27f25c7f1030a463d5a17067", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755961, "uuid": "4ece9c0d-91aa-454e-a48a-6d87bc46157c", "comment": "Malware payload (GuLoader)", "value": "1d2f0cd5c156ad2ab8b3763a2eaac42511a25777e803e0714ee691268feee52a29ef1ab140d92ecb30a8a26316e26ad3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755961, "uuid": "cc7b3ea5-151c-40c3-a2e0-5722a3f581e7", "value": "T1A6A41232ABF3C43BE5464B70D952E5F6D3B1EE14E4224A8F2B943FE3BD346429906119", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755961, "uuid": "2464966f-f5fb-4f09-b14e-776277d786ff", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755961, "uuid": "cc882ab7-1da4-49bd-ba8e-052bc848b980", "value": "12288:6TuK9McXG+Kz1middoImb49/oNbSdS65GG3Q4SNtL:6Tu6XABvmImbuYbSdSFGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691755961, "uuid": "7e17c413-fc78-4a8d-9099-7360ac5c5641", "value": 451976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691755961, "uuid": "8586a952-0864-48a8-994b-53cfb04c0097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755961, "uuid": "f77f1f8f-57e0-4d04-984a-27ca97362727", "value": "pr\u00f3barendel\u00e9s - pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0876caf0-3826-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691744649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744649, "uuid": "2c5f443b-2c7f-44aa-8911-5fa4d886fd38", "comment": "Malware payload", "value": "b441b71b1ce23257d6f40bd7555703ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744649, "uuid": "5e8983e6-dd68-4273-9974-a7cdebc98b64", "comment": "Malware payload", "value": "eeaacd0b7e68cc5e5a183dc5f6e8b489cf267a73ebd772b338873f9e04e2b7a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744649, "uuid": "96944818-566a-47f1-b001-299c59ff44f6", "comment": "Malware payload", "value": "961d3ae7e69b7a39edda340e93986c5a7f89c097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691744649, "uuid": "aca7dab9-25c2-4400-bdee-b8cf180a4653", "comment": "Malware payload", "value": "7c245f084887e093ac1abcd4dcdc4698e161a7fc336180a9159af49149a9ee91bb2498a84656675ac325ae69dfffb94f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744649, "uuid": "56eceb49-8b3b-44cd-97d1-e5eff41e22a8", "value": "T137824B2D63E6D7F6CEED5BBA48A361411772D30AA983FF1E8DE8807718773410B62614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744649, "uuid": "6a3ce260-fdce-41cb-8b3f-b0ef2e9ee00e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744649, "uuid": "93a8cbb8-2f4f-428d-a4ab-0a8e994406e0", "value": "384:N4DIh6WG5tV+xSjdto26g2S0olp6NaUkBq2CilnSaz+kz:CDIhK3gG/6rsYynJSkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691744649, "uuid": "060ecb1d-92d5-4dea-b689-451011504bb1", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691744649, "uuid": "75041f44-0066-49ac-980c-e269055276ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691744649, "uuid": "c0e14218-71cb-42af-adbd-fd1f0f2dba3a", "value": "crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be633a9-3814-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691737112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691737112, "uuid": "76dd4f95-a593-4831-af88-b9d3aad5762b", "comment": "Malware payload", "value": "d4aa82b9581c8d5c2412f96aeba624c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691737112, "uuid": "e198434b-0b79-4929-ba1c-b275eec2976a", "comment": "Malware payload", "value": "ef0aa637fb334fd0387230146c8e9bad10e1a1ba3742a15e7bcdeefdc7c0220a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691737112, "uuid": "4d82b678-3d47-42fc-b12c-97197b1e34f0", "comment": "Malware payload", "value": "43ab0e26487967d6584992baea97b2215742a240", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691737112, "uuid": "94a4ab83-8106-4a97-8514-75641f361686", "comment": "Malware payload", "value": "6e9f3b31766bd2376b9cc377dbc25386a09fccd2e44e3ae1fa78257b453b7c48bc4009dee38c9b706971c7a732a80378", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691737112, "uuid": "5c3688f9-56e8-49de-8e1b-448bac9fd5c9", "value": "T15A3329C0E58BD8F6FC2616B51067F33357B3AD2A5079EAC7C39AE633A903641964721C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691737112, "uuid": "a7da8bba-3ff9-4dd6-9c5d-9cfd8c85974a", "value": "1536:6x5W8Kds6OTdUtB8HoTZFeBqEPoOfDieEnZrK:c08KdsxTdJHoLZY+PrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691737112, "uuid": "93833282-5cc0-4fd7-9a02-4fd0ac38b001", "value": 54600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691737112, "uuid": "6ac49001-7a6b-4e01-b372-d47e09249ea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691737112, "uuid": "74e57554-fcc8-4a67-871a-258d9bdadbd6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68fe1a12-3843-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691757267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757267, "uuid": "89c2d35d-7b68-40c8-8ea6-e7c3116d06ab", "comment": "Malware payload", "value": "50d9d20afd67cccf427029ded2469d52", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757267, "uuid": "f5344c26-8eba-46a3-878a-0fb4745f3733", "comment": "Malware payload", "value": "ef2b78a33eea84413d07a47c01ae93b32bf69475839ebfe280c267569ab4f6a4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757267, "uuid": "485b1295-2ff6-4805-aae7-93f3ae0ff66f", "comment": "Malware payload", "value": "0964213919f32e300e01dda4d6e6a692236ba326", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691757267, "uuid": "6c20b04d-d827-4095-ba54-5a05fa2e3797", "comment": "Malware payload", "value": "5bba5bc92b80670b67e2530ff2d8af3272a27bf8734af6808b8b3ce6b2534fb0356561763b9e30fd969ecabb501eb2af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757267, "uuid": "99cc0042-2f96-4091-8453-a0363908a302", "value": "T1FB238881139D9FADF60924BC45856D350DE479B8736F91EADBD68C9FC408EC122E0E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757267, "uuid": "ab291d19-8776-48fa-86a8-5f453b19b158", "value": "3c99606240c35ab29d3f57141a743150", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757267, "uuid": "7935b396-8ef9-47a5-9950-6db5e9625260", "value": "768:sn8nFPoUAyzOg3mRRxdWQn8vfKpx5vruL2uUZBOBWzCbq:s8neU5zWFWU6f47r+tUPOszC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691757267, "uuid": "5e29afc4-bae1-42e0-9942-040126cbd98d", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691757267, "uuid": "7d8986c3-bc05-45ed-ac77-ca964c5ce18c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691757267, "uuid": "9274bf09-ea0d-48c6-84af-887b89bf8320", "value": "SecuriteInfo.com.Win32.TrojanX-gen.15063.13337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea49b364-3893-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691791843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791843, "uuid": "c8f62c0a-e534-4055-8459-0245ed88d678", "comment": "Malware payload (Amadey)", "value": "f9975ace1c4d053714139e850957167f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791843, "uuid": "b18348fb-c70f-4da9-b9a1-fb5dd385107e", "comment": "Malware payload (Amadey)", "value": "ef3a4dc041071d0f0ddd2a000a993d43afa44162445dda4a3462eddd33b44da3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791843, "uuid": "7b8a7faa-1aa8-4329-9057-ddf56e7ed066", "comment": "Malware payload (Amadey)", "value": "2bea037fa7b72db2271637ada62159f07502240a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691791843, "uuid": "851ca804-eb4d-4b6a-ba17-2db80e6ed142", "comment": "Malware payload (Amadey)", "value": "b1c80f803303706230111dea8cf36409e6b7c1cad915e9114b4685e06891af18b84480780c2c6f44aef909ced4a281dd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791843, "uuid": "7d827acb-a29e-4f80-a640-316d66b2c537", "value": "T195F41206E7D44076C9F12BB058F607830B37BCF65968876B3786645A49F36C4A93237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791843, "uuid": "60a15eb8-3d93-4fa4-aad8-0f3825b65625", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791843, "uuid": "00eff93a-2d8a-4de7-923f-9bb094e1291a", "value": "12288:VMrAy90DEnLXOzHAisFSOgKsje7kg2KR3vXMp7qqUnnTPe3iDFxswrhF8:ty4ELAArVgrK7kZKBvcDUnSAr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691791843, "uuid": "38206d72-498d-416a-b647-72b90d56751c", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691791843, "uuid": "cd99df36-b461-4b50-8650-ffd4c0a00033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691791843, "uuid": "91a8ffc4-a55f-40dd-9054-63645715b575", "value": "ef3a4dc041071d0f0ddd2a000a993d43afa44162445dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c4902a-3803-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691729693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729693, "uuid": "60edb99e-ba43-4dea-8906-b5b5d63d16b1", "comment": "Malware payload (Mirai)", "value": "7e29f151ea808229b4be28a3dcdd4b4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729693, "uuid": "cb7a9d1d-0e0a-4429-86d3-b0f71e276fb2", "comment": "Malware payload (Mirai)", "value": "f044c82c0955645d555c0d6f6e4b23e5e8e64568e51153bb6659b8fd9c300ee1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729693, "uuid": "c7aaa72d-f6b0-481a-bf7a-d036b6c0ff44", "comment": "Malware payload (Mirai)", "value": "f5ba77237fa6a094aeca6f5116e467f226a001f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691729693, "uuid": "96d5d14c-4d85-4fed-b29b-b6fb0f1649b8", "comment": "Malware payload (Mirai)", "value": "45f5928183674050f6bf1d42958315cf37bc2fa4664df0984bf840d4551acc4edd2870658851272d243aa40ecad1aed6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729693, "uuid": "462a2150-6bc2-4350-a7a2-296695d41719", "value": "T1B3730856B8814B12C5D512BAFA2E118E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729693, "uuid": "2aa85e35-9d8b-4ee9-8d7c-214fa3d62c86", "value": "1536:mlnHaxP6XkC/zTkS7IDHtrMwocve9a5p02IPQiizfKvcIs+5UYIWQ:3xiX1Lgbtrbo9avzfKvcIs+uRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691729693, "uuid": "ec6d2710-5f44-4bcf-8069-acd359acc93c", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691729693, "uuid": "f071c7b6-6095-40b4-8776-8392132530d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691729693, "uuid": "83ad6c7d-3602-4165-984e-7ec37895c3ca", "value": "7e29f151ea808229b4be28a3dcdd4b4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee06a404-3810-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691735585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691735585, "uuid": "782c86dc-58eb-4ff2-8dec-5046ed479fb6", "comment": "Malware payload (AgentTesla)", "value": "e3a4cdf24c69aa61456ef5d40d266eed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691735585, "uuid": "8d282ee8-1938-4007-bab3-1a8594ab615c", "comment": "Malware payload (AgentTesla)", "value": "f07ffce8ceb5a40b7f5e61695752dc86a04f0e8d942c9ea637552f2b230ee1e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691735585, "uuid": "d03e3e60-477f-445e-bbfd-6d83020c5695", "comment": "Malware payload (AgentTesla)", "value": "43a2e597b53ed7c1ce5b45bea314db55f49182e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691735585, "uuid": "22414782-0cdd-404f-a9a0-b4f8e11ad2b1", "comment": "Malware payload (AgentTesla)", "value": "fb42a687dffd5a90ec7d4d6b9826ee03b8edc70ebb1ad13eeb8ddf065648c2b1a13f4abcdebf89376f60249238e827ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691735585, "uuid": "0970352d-9230-43b7-8f1f-93727f92a02b", "value": "T126150725E77B255AEF29A1F85E2F403239DADCC0F1B1C588A7E7280385D23514E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691735585, "uuid": "b0d1d9b8-200d-423a-a0cb-6fa7fc8d4596", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691735585, "uuid": "c313a4f1-80cd-4f26-b6b2-84a55cb942c7", "value": "24576:AJs2Rs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOZUFX5wJGRQrHrroGCKv:AlRs6CE3jLbO9Rs6CE3jLbOZqwmQDoGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691735585, "uuid": "731c5b04-5494-4721-bf17-c7875bc98f3b", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691735585, "uuid": "0ffbcb9b-1614-4c5f-81d7-c6c5f3b1db0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691735585, "uuid": "a74ae2e9-0a10-4f7d-ad63-3d4b44ce6a54", "value": "FV9aqL5L4GzqyRZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece74760-383e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691755340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755340, "uuid": "b25f854f-ac96-41f6-bd2c-498c6e56087a", "comment": "Malware payload (RedLineStealer)", "value": "3bfed114daa6de23e092144a11f52205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755340, "uuid": "e7ed3281-5011-41f9-859f-68717f270832", "comment": "Malware payload (RedLineStealer)", "value": "f0870b8834cd0a9819ed4d88b0dbb6f387e7a9db65c1a9c01a6994b738190787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755340, "uuid": "c76ebbc9-46db-444a-8319-a7814542eeef", "comment": "Malware payload (RedLineStealer)", "value": "1da985dfd22cb6a3e7438d75e4e19215920e6f90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755340, "uuid": "1bf11cf0-8b87-434e-b9ad-ea021bd81bba", "comment": "Malware payload (RedLineStealer)", "value": "28ba74f1954d556524bc5b6758e81fc7238dcb1c35a0b0de1d9a108f64d87a04e561c1f04d6e59b65dc9c8431dc4dfa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755340, "uuid": "d1289f96-a430-4f9d-838e-e8593343f4db", "value": "T15B64F1217792C072C69B14304966DBB0AA7FF8711578494737E81B7E9F322D19B3934E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755340, "uuid": "a9f1556e-45f6-4154-8b0a-0f381546577d", "value": "bdd66bf8468b2629838c567887e30c7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755340, "uuid": "f1e6a1f9-4633-47bd-9302-8d514aef9983", "value": "6144:5NEt5LITfRNJ+xZlJD2g5EgnyBHfoDHw:5ukTfRN4r2g5MiDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691755340, "uuid": "5bf42058-545f-4cbd-9bad-d65a98ad2330", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691755340, "uuid": "26a7151c-4adb-4eb6-b6db-327da27f9fe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755340, "uuid": "7d2e8dda-90fb-417d-b727-ba4d8e7ae243", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de9a566-384f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691762482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762482, "uuid": "79b6b497-3c04-4fbc-b5cd-3c97e043f334", "comment": "Malware payload (AgentTesla)", "value": "92120a772203470ad256952d4859fce1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762482, "uuid": "a4dae522-5c91-4c6d-b4fa-6b3d260030ff", "comment": "Malware payload (AgentTesla)", "value": "f24cb77150dd883f2f8cd0d25edbecfe7c09d8f8c2548d720a3f844f2417c0ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762482, "uuid": "06f92c16-6e63-45ca-a96b-fddf43ed671e", "comment": "Malware payload (AgentTesla)", "value": "36f113633f7f0ba7a631cc476e1eff9a3dcf46e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762482, "uuid": "55fb9422-4108-4fc4-a1c2-690784626ed9", "comment": "Malware payload (AgentTesla)", "value": "0c7e99a4e8b265aae173c0104e06b567fe494d902012ab11de88318c04e415d42efb53dbec63610ddae0277eb6ccfed1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762482, "uuid": "87049af3-92df-413a-9989-9d81a0d2eaf9", "value": "T1C2E4CF91BD39EAC2E55F8A78104FF30D82BE49563723C63A1A6A50C1C4977C106EB7DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762482, "uuid": "da58d8e1-f26f-46dc-af7e-fbcfb7fc0359", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762482, "uuid": "74c346c6-8ad2-4197-80ba-a95919481cb9", "value": "12288:Tmiv1p5bWX7Sd29ab7K9t6dL9D7rMeZN45jQDii4B7lqTj:CW13w9jt6DvMKN6QOFBYTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691762482, "uuid": "42cf0af4-5b58-4c40-8344-6dcb236f6681", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691762482, "uuid": "b26356fe-6d36-44a6-8e21-1560485cf0cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762482, "uuid": "e9ae9cce-2a70-4cf1-b30e-63a5874de5b8", "value": "vlvj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42db88d-38a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691797309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691797309, "uuid": "55648a45-00b0-4b07-898c-0c9d9d786df0", "comment": "Malware payload", "value": "b2e91cdd0e1c97efec540f2f60472d94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691797309, "uuid": "32041200-c563-4c2d-852d-5713e4cdf048", "comment": "Malware payload", "value": "f2d0f2dac71c7ee35134c60db2f50514005e58832b2dedc388080c71dad6f411", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691797309, "uuid": "a5df652b-5dc9-453b-8ae0-bf83a1e20f58", "comment": "Malware payload", "value": "719d6ebb5c0098733ed7acfb99909afe3d9468e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691797309, "uuid": "2bfc0b72-c80f-4adc-838f-ad67c619de40", "comment": "Malware payload", "value": "9547ef770f8029b10086e3c02c97d6ea3b1284a28af7ef53c059fc292aeab1508a3e6a5954b42001f53ee4a8d63c1eeb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691797309, "uuid": "7197aab2-53e2-41bd-b410-5c7c5650da19", "value": "T1CE1633308884E4B7D464913C4868E66C2A2BB5393F44365BB7646BFADC35791B33B31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691797309, "uuid": "bdeacf6a-95e8-4039-8759-4bfc1a097202", "value": "b843f9632af58019508eefd6a2b3c3d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691797309, "uuid": "61a79dfc-110e-419c-bf17-93c5feffd66e", "value": "98304:u45DfwP2TrQkxpRRoPCAgqAHWBGDs+gU4+p3zFbSA+41rq:X5DfCO1mPBAHI4gU4qhbSC1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691797309, "uuid": "889713ff-bedf-4902-b28a-3511b9252d68", "value": 4346752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691797309, "uuid": "2e51f8dc-a414-4ea4-986e-c753486c70e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691797309, "uuid": "16fef934-04d0-4416-ba93-7837d6dc03ad", "value": "b2e91cdd0e1c97efec540f2f60472d94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35279acb-383f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691755462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755462, "uuid": "48b7b09f-b550-4c57-9223-2b90fe72e5be", "comment": "Malware payload (AgentTesla)", "value": "af618d115a2a1aaac7f9bb4d821982f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755462, "uuid": "e54efdb6-7783-4f80-aaa4-fa7f249a33a1", "comment": "Malware payload (AgentTesla)", "value": "f3e796f2d754d6e3c229b1f387695e27a7e6fe458f2a75b94e10e2d8c99f23d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755462, "uuid": "9b5e21ae-2b61-4e0d-9bec-ec4c824d236a", "comment": "Malware payload (AgentTesla)", "value": "5052f48173036f91f1fe336ad1afd4e7d9725017", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691755462, "uuid": "677f9d29-fb0a-460d-bdfd-0751e18545d5", "comment": "Malware payload (AgentTesla)", "value": "34d2cec07994e5cdd514911b42eb0b962d443c655ae265f9def662c7f060df7bc1e02f90491ef2f60edf32e05e63d36b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755462, "uuid": "dbd9b6d7-09f3-4c40-9e1d-ea8c0827cbcd", "value": "T1BA657C21E77B6456EF69A1F88E2F853278D9DC80F0B1C588B7E7290385C23614D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755462, "uuid": "d4602aa0-8a4f-4a46-a88d-93a996c3d2de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755462, "uuid": "a6d9e5be-d94c-4f9e-8060-899a36f2924b", "value": "24576:sxhrRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUONUFpmZZ5HpwbxC/0Idf:sDrRs6CE3jLbO9Rs6CE3jLbONbPCxs7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691755462, "uuid": "b691386b-f983-43d9-9148-ec089f0b17cf", "value": 1436672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691755462, "uuid": "2ba79c57-095c-494c-9b7c-8d92b33c591d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691755462, "uuid": "b517866d-91bb-4d83-addb-b9fdc97d025e", "value": "Delivery Note Ningbo.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4f1906-3874-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691778341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691778341, "uuid": "8b91abe3-cc79-41c9-98f3-d99aa8fed706", "comment": "Malware payload (NetSupport)", "value": "2b27facd1a1a40da996500ec5e70ef23", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691778341, "uuid": "5a628dd4-62bf-429a-a1f9-b0801bed5d8b", "comment": "Malware payload (NetSupport)", "value": "f66e7a06caabe47c99707d0ccebc5626687bdd2b6fdb874f81ab363922702cdb", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691778341, "uuid": "bdec40b5-daba-4bac-b760-2e783c72f265", "comment": "Malware payload (NetSupport)", "value": "896f04b923fd0a9ae39c935e1c353d8296b975ef", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691778341, "uuid": "efa613de-7fbf-4074-a727-b2f5cb8dda65", "comment": "Malware payload (NetSupport)", "value": "d4d37644f999b67ea5f2b3864826c690ce5fc6539028171003bca0d7a8b65f6f40056d863b04dbc3cc072c7f475f552a", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691778341, "uuid": "972d455a-853e-4a49-a27c-50c9c0d2e321", "value": "T1A245CB38397A7C2443DBDA1334F14B961CE9564FD1703A3B199AD8239A352C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691778341, "uuid": "9c5be849-adac-46c5-927e-1b0156aecef2", "value": "3072:qiKA4ZPddFvUakROQ5Nv9VBswFO7qlnwD5L06N5Gj:qiKA4ZPlsROmFViwFOehewO5Gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691778341, "uuid": "ad59c78e-c82c-407a-abdf-92f177a69385", "value": 1251632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691778341, "uuid": "02b2d5c5-71ec-4300-920d-4171686a4c5c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691778341, "uuid": "a122c6be-bb72-4556-b275-b7ba61cc0c22", "value": "miracle.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfd7604-384e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691762134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762134, "uuid": "a1be0020-3b7c-446b-a159-c62ee59fce3b", "comment": "Malware payload (Amadey)", "value": "d4bcdc3145c25d78ea8415d8efda61af", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762134, "uuid": "9128731b-c2ce-4105-b470-8e2d4da1e556", "comment": "Malware payload (Amadey)", "value": "f6b5984b1960124a91cbb2bc5c6d7fa28c92d63e66edbcf0d605800ebe9df6a5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762134, "uuid": "73bc35a0-0573-4bd0-8a79-cded68965ba3", "comment": "Malware payload (Amadey)", "value": "137aebe723275b65d56a1e1bb18dd568369be41c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691762134, "uuid": "5f557461-f5ac-4d54-800b-4708f643ecd2", "comment": "Malware payload (Amadey)", "value": "543a5b04190940f953361d4a565d2f0697a1cd67ce2b252471e00e3abea31a6491be776b27efdbc2df2d23ce72b7474d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762134, "uuid": "e091b04d-135a-489f-b2b8-7fa3e16c99c1", "value": "T181D41217AAEA4433DEF527702CF307930B7ABDA61938876F2345784A0871A94B47177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762134, "uuid": "faac6a97-ff63-4eb9-a048-474ccfaebaf0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762134, "uuid": "cd0aa579-c071-420d-a398-ad3cdf90113a", "value": "12288:1Mroy90HA339Suw7SAcZKW/e7Q/KKR6EXPp7UN2FCZKXBNz7e:Ny1FXPZ1G7QSKYERW2FwAzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691762134, "uuid": "cfdc627f-3704-4bf2-aba2-81af8759118d", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691762134, "uuid": "a4c83634-d794-4b61-8e52-fcebb08ee59d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691762134, "uuid": "af2cc24a-2857-4e37-8535-44a9c4defe6f", "value": "f6b5984b1960124a91cbb2bc5c6d7fa28c92d63e66edb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08755437-384e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691761829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761829, "uuid": "f39fb1a0-be7b-488b-92a8-2710fe87f627", "comment": "Malware payload (Amadey)", "value": "4a168682036ad378dd0131cc5ebec229", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761829, "uuid": "1cb213f8-5c46-4da8-b59e-354999822473", "comment": "Malware payload (Amadey)", "value": "f8f09d62db5eab040cdb7fcc403da065a7fec263cbb272bf6a70cf54ed7a12fe", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761829, "uuid": "be43ed37-22bd-42be-a0b1-3f5648c55065", "comment": "Malware payload (Amadey)", "value": "b0ffff09345e35b9ba8ddfc771d313be53419f4a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691761829, "uuid": "cefa116c-19fb-4db6-8b69-934acf835a04", "comment": "Malware payload (Amadey)", "value": "39ce3e96d9dd8fc0c279c553711e3eabc671a093ceb215a25da5642101b719e3c3c67d946050e2b279db5425cd889029", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761829, "uuid": "574bedbb-8a75-46a3-aab0-71ebbec31f69", "value": "T11E6439417952C072D960A1721AB5BFF2C59D68249BB049DB7BC00F76DB212E77A30F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761829, "uuid": "30bd17ef-a4e0-47c6-b722-1cf3d9f38da0", "value": "44e769941d2c6ad88bf42ac4adb36135", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761829, "uuid": "4d16497b-2816-4ea0-b6c8-797c4c039747", "value": "6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691761829, "uuid": "3489db00-e719-4215-89d4-192f97412666", "value": 321073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691761829, "uuid": "c4f72111-60e1-4e38-bb0e-83ce6ba7fee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691761829, "uuid": "6ac9444b-231e-418b-b4c3-2f7a939aeff7", "value": "4a168682036ad378dd0131cc5ebec229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e7c5b3-3824-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691743779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743779, "uuid": "17f54607-c2ca-4827-bbcc-75d0c63c6930", "comment": "Malware payload (Mirai)", "value": "fe61943b1cb1147c67250883bd1ac16e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743779, "uuid": "13dacb03-41ad-49b6-accc-84fb1b0a7147", "comment": "Malware payload (Mirai)", "value": "fc76a4046efbaaab93261806f52afcd6cdf88c2784ec2ed7e862089f3d6bbbb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743779, "uuid": "3ce296fc-3b7f-45f1-937b-99111bc34aff", "comment": "Malware payload (Mirai)", "value": "88fd3bc5cdc127693a33527dcd689a492cffbac5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691743779, "uuid": "d2c30ad6-2143-4da6-b44d-32b29c7cd703", "comment": "Malware payload (Mirai)", "value": "ed0700412209a18404f8c47a0a630e029a395fd9242384c641b50f84bb1bd7439b8e2c0ee816ce5ad5e84855944bbac8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743779, "uuid": "7ef35212-ba4e-4b74-8d88-98cd0bb1369b", "value": "T16CA32A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743779, "uuid": "072847d7-ef28-4e51-94d8-9336134ebad6", "value": "3072:1Sd+e6mKaGP0N6D3PpShtKmZuqQ4DPwXXtse:C6mxGP06D3PiKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691743779, "uuid": "841388ea-27be-4db2-957e-43482ddc68aa", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691743779, "uuid": "8cf028f6-6a79-4915-a360-8be7095b0413", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691743779, "uuid": "505277cb-18c5-419d-987c-0dd97f9baf31", "value": "fe61943b1cb1147c67250883bd1ac16e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f040ea3b-37e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691717121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691717121, "uuid": "11097f50-0b83-4070-a764-7e8b77f30042", "comment": "Malware payload (RedLineStealer)", "value": "cac17cff074bd0b2e86bcd49fc7ba085", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691717121, "uuid": "5bf73c91-6163-4371-b718-63a93675d9d0", "comment": "Malware payload (RedLineStealer)", "value": "fd13b8f4f8b36530344d41072c28db6783d947994805fec7dd831476d494b93f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691717121, "uuid": "0969850f-9859-4eb3-8cd2-a11d835cbb40", "comment": "Malware payload (RedLineStealer)", "value": "befd062a165714993ee6cc93817f01a117723a63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691717121, "uuid": "febf7719-b05e-4a2f-99dd-ff36112d2f1d", "comment": "Malware payload (RedLineStealer)", "value": "b4ef7299e7f01715ece2331a2cc942eac9bde4404cdb4467b2f4370e54e1ba9c5d34b819a23164b848143c0a6f95a0cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691717121, "uuid": "34a860f7-d8b4-4e54-8c4c-493cded4f384", "value": "T1CE050221B9C484B1E8A719351EE1B371BB7C79310B354FDBAB444A2D8F705C19A32B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691717121, "uuid": "6ae35871-af6a-4d8c-b886-9bdb91d9cec0", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691717121, "uuid": "45374c9b-7208-4402-9a79-2afd03ddbb06", "value": "12288:f3DkEGDINi1EwkG8RdI2zGL61Uta7BOMUKgegKIWJ2FVsHWihcw:/DkUNi1EvG8mVL8Uw/UoeJKWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691717121, "uuid": "91af52f2-4cb9-4d05-9a56-c4c18350660c", "value": 813491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691717121, "uuid": "64248cab-be73-42bd-b585-e91114475572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691717121, "uuid": "f05749db-d4d2-4107-a8b8-38d4a2f4a96d", "value": "CATALOG SAMPLE.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fffd00-37fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1691726688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691726688, "uuid": "fffd45a8-e968-4929-86cb-b6d4bd3ff079", "comment": "Malware payload (Fabookie)", "value": "319b7bf4b6c393bcc2e28918cad7a9bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691726688, "uuid": "2065a4ef-435d-480d-b606-400b07b5fc94", "comment": "Malware payload (Fabookie)", "value": "fec5e8cb13f8418df2d3c2188c40eb2844084b02bdd9f2a899690b3a7b25986c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691726688, "uuid": "c43c45fe-17ad-4f27-b222-81caa133b843", "comment": "Malware payload (Fabookie)", "value": "e9cc9d2d2392af42952787f75f55ba7485d28f09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691726688, "uuid": "ab4c338f-3dfb-4941-a4b4-841f1886b49a", "comment": "Malware payload (Fabookie)", "value": "6d904ecb71e3d57606637dcd891a606e550d69b4fd72f2a354433a4342f199ae2542bb3eedb3464af8cd16193cd05375", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691726688, "uuid": "070bee48-2035-4cfd-98db-b8c8e83ecb7b", "value": "T1C436DE4FAEB27525B2A2D5714662B3C24DF283C13DD232E6068BC3564D60B40BDF972B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691726688, "uuid": "4c9c4fd5-b6d0-4289-8291-d9752981e25d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691726688, "uuid": "51411e22-83aa-4898-b90a-c648637df55b", "value": "98304:NsfnxQtpBCGZuEzjtRjqTYtBElSt+p+x0ILtMAQOFXH9zVD:NFlxjn5BElSe+xXJMWFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691726688, "uuid": "1454f0df-4a12-4365-a070-09b2fad0a5dd", "value": 5044736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691726688, "uuid": "66c1e6d0-4da2-419b-9a81-c68ca2bed147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691726688, "uuid": "28c60cf2-126f-4bed-bdad-9066d659a518", "value": "319b7bf4b6c393bcc2e28918cad7a9bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }