{ "Event": { "published": true, "date": "2023-08-31", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-31", "timestamp": 1693526582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "58fc8382-3fb4-4b81-bc8e-a924ff3c9f14", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05e2d72-4853-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BumbleBee)", "timestamp": 1693523450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693523450, "uuid": "68f53109-e87e-48e7-91d0-aad7a6826e51", "comment": "Malware payload (BumbleBee)", "value": "23ee64fbcf7e71e80949ce10d30fcf64", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693523450, "uuid": "4a3a960d-ffcc-486a-a53d-af21bba433b2", "comment": "Malware payload (BumbleBee)", "value": "0170c6a860c530c4bb9ee260c66bcf29d0fdf32c4297255f60c1785cdd1f2309", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693523450, "uuid": "63439c67-eecd-47ec-aef8-2e84a7d4dc77", "comment": "Malware payload (BumbleBee)", "value": "c55e8523f03e99a426df20bff67f5c6b2d0ea782", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693523450, "uuid": "e0caa289-2f42-4500-af7e-3eec8ee729a6", "comment": "Malware payload (BumbleBee)", "value": "c4e6d1bed2cb0a0b4e14b4a33679c1ed2defafe5099f97be1acf0aaf7fc473e808c1007c9a25e5ec8765783ee060ca97", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693523450, "uuid": "03ce48f0-96dc-4623-a161-c359ceb71009", "value": "T16D45098AAD429FB7D66C82BAC4EF154AC3625216FF033727692DA15036D3362339734D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693523450, "uuid": "1056c767-8d14-4171-853d-753ee64d2342", "value": "5410d66120ce82413573f4688a99b51d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693523450, "uuid": "e7fb730f-ca9a-4b53-a305-3ca1a71c6545", "value": "24576:CLxihC9BlhDSyjDuvBNSahcvpmeY427Ganl+:Cxi83DuqC6G/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693523450, "uuid": "61b7e7bd-60ce-4051-b7e2-42db3bf1e2fe", "value": 1262592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693523450, "uuid": "8a732fcd-b34b-4601-8f16-b9464913d41d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693523450, "uuid": "406454d8-1ef8-4a5d-8987-6953ef65510a", "value": "0170c6a860c530c4bb9ee260c66bcf29d0fdf32c4297255f60c1785cdd1f2309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdc234d-4839-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1693512438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693512438, "uuid": "42ea3c77-feb2-4efd-91f3-dde33383b833", "comment": "Malware payload (CoinMiner)", "value": "0f9c373964288e253936c6fca66e7c3d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693512438, "uuid": "55a00a76-b50b-4cb3-b420-fb4d2b29b9bd", "comment": "Malware payload (CoinMiner)", "value": "043f6d52d44dc42b0da11af5b87c27bbaada4c88bacda864f644fbf1731f5404", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693512438, "uuid": "401581f0-2e9e-4a54-9c39-eb53c959f129", "comment": "Malware payload (CoinMiner)", "value": "89cd1ecf9d256f4ad608ae27ae59d86960078850", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693512438, "uuid": "d601c4e5-f1f9-438a-aa2e-6720baf228d1", "comment": "Malware payload (CoinMiner)", "value": "ca3110d527caf50d4b52057953885b172b4f5e76d56d4a499508294a8f10b3beb617b27b20d749448f1c1e115003b041", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693512438, "uuid": "e64a778c-82b1-4626-b180-782e1149e675", "value": "T1EF24D022F6A0C073D063057048B0CBE55EBB7C622A79D4976BA41F3E9EF0BC05968797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693512438, "uuid": "935f7739-b44f-4991-a2eb-be578c5eb540", "value": "ec0247b44470961b20f0db210d28af81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693512438, "uuid": "ea547b5e-2be5-4bfe-a91e-41e4f91545da", "value": "3072:9KLxYvgRbgBeCiMGsIvTN7BW//30MYGOR0Ali8V9Z/8u:9i5RbaeCiVxFB2QN8Ot8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693512438, "uuid": "e8e0804d-9bce-40ab-bbc0-c96b2a02b1be", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693512438, "uuid": "c24bf4e5-ac16-46b0-895f-b0a41547ccba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693512438, "uuid": "f2e9b5ad-eacc-41a7-89d0-16723b719273", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35fa514-47f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693481391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693481391, "uuid": "9f99a6cb-1396-432c-8f29-44491a73c060", "comment": "Malware payload (AgentTesla)", "value": "b41460da4d8989c9b368e9cf765d9d4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693481391, "uuid": "4005356d-52b0-4d63-a08c-b096185b8ee7", "comment": "Malware payload (AgentTesla)", "value": "0451607f04d2433cd32c13aa6609fb75120442f9b0c1a4da959cab33e6c04556", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693481391, "uuid": "0ed1faae-23a4-491d-9cdd-00dd8acbc545", "comment": "Malware payload (AgentTesla)", "value": "c4adc350bfab81727ef5426277526110053f359e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693481391, "uuid": "f329d5fb-9407-43bf-8511-94cf4b7ad93a", "comment": "Malware payload (AgentTesla)", "value": "b68c71c05e70a38296faa169cdadeedb57f95a275f8b40728a593cce96b25344c88c3370c81e652433e80c16c912d7cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693481391, "uuid": "ff6999ab-f8b9-4a6e-a6f8-5721b517f8f9", "value": "T131C4231B3227CE97F20B8FC0B0DD122D2B7B9D26B305FA7252469F8C65A1515EE3068D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693481391, "uuid": "19f46ce4-1fae-40f7-80fd-6fb76fdd2513", "value": "12288:qp+hsGfXSeNBaRCZIEJE3nvFXNEmeNW8uQoM57vk746p:Y4DCRoIUEfFXNdgFsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693481391, "uuid": "382e4c47-e2fb-467e-bd94-95dbe84f0773", "value": 587543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693481391, "uuid": "866334ce-debf-43e7-bed1-8d165996b524", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693481391, "uuid": "392df2de-b91e-4e65-bb14-015a2878f00a", "value": "$963,255.00.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30f76eb-47c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693461312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693461312, "uuid": "f22ec09e-8907-4a82-a509-e800be37dd21", "comment": "Malware payload (njrat)", "value": "acf00d8c13f4e5176aa845fc9bb07df8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693461312, "uuid": "41f8772c-98c0-4bc8-a723-bfa960538d5d", "comment": "Malware payload (njrat)", "value": "0589376ae4d26eaec94408164964872b2cfda145b9e987c52b228531daa92da3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693461312, "uuid": "03b7f7c9-0d13-4f50-ac94-843ba6435ef4", "comment": "Malware payload (njrat)", "value": "48b5f8dbd1e9453c069b09cf6f7be3449bff8c54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693461312, "uuid": "1f41d873-5555-4c8e-b066-fd2646708aaf", "comment": "Malware payload (njrat)", "value": "cd35e748c4c584aa15864a5b89bba0325ed5dc9a7723ffcdf79640de76b4401f7e199ffe22cdd8a01451d77f8ed13903", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693461312, "uuid": "62925df9-60f0-4a80-a24b-c4878e6e0a72", "value": "T1A293E94977E96564E0BF56F79471F2004E34B44B1602E39D58F219EB0A33AC44F8AFEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693461312, "uuid": "7227d69f-76be-46bb-8fec-a82dd50300d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693461312, "uuid": "64b89851-ed1f-4772-a6fb-d14687ad3362", "value": "1536:H+tFQWqkqqoLc2mUiIjEwzGi1dDeDigS:H+tmkqqoA2zi5i1d4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693461312, "uuid": "4e4db783-0e58-4dc5-a196-9b0022e3d7f0", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693461312, "uuid": "320353a6-bfef-4339-aa50-da217d394eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693461312, "uuid": "0a9673e5-d95e-440a-91c4-344fe199361a", "value": "acf00d8c13f4e5176aa845fc9bb07df8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bc7a0e-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693466422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466422, "uuid": "fa61538b-9e68-42a4-a52f-4ea1d43dc614", "comment": "Malware payload (Mirai)", "value": "627803fbcb19df9a92ef0cbb60d883d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466422, "uuid": "f94c2a9d-f541-46da-930d-2f3416cf25f9", "comment": "Malware payload (Mirai)", "value": "05c92c94272a4e310954e055c7751af5f9f54525e3e9a28a1d8c1944002568fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466422, "uuid": "3d8c77d4-c047-4a1e-bd19-bdd7918f7751", "comment": "Malware payload (Mirai)", "value": "2bda8ce4444c2097bc9c7659aa914a9092679156", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466422, "uuid": "282165e8-6823-4b63-a7c4-ff3fda042e9c", "comment": "Malware payload (Mirai)", "value": "231ccb9ee90249a0f0733ae76be9f4a139bd1823b1ed4114656fdd3186bdcb5b6d59693c2ee805a0e536bd946795fa50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466422, "uuid": "bfe9b8b1-b005-41d1-a4d8-dccc66d2d7ca", "value": "T17121E400F71D5413E5E13EB073372F6187A9CF03262955089B9FE69EE9B9C305A9D09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466422, "uuid": "7301fe0c-418d-4b83-b409-453625c0cb42", "value": "24:3WUpWS9nSWZ6S4/KSwISBd6oTKP5tAFl6xfUqzktlKcvy5LaaTo0YGZK2a36JJ:GVgZVbXGAexflz2lKcvy5Llw93WJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466422, "uuid": "5cfc2bd0-854f-46ae-af8f-d66bcb830e38", "value": 1412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466422, "uuid": "1bcd77da-8bff-41a1-b9e2-7740791550ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466422, "uuid": "4e8c27b7-54bd-4882-ae2c-0f65e21daab9", "value": "627803fbcb19df9a92ef0cbb60d883d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a99a818-479f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693446104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446104, "uuid": "c1cbcab6-e84c-4d0c-8a5b-0ea98221ea49", "comment": "Malware payload (Mirai)", "value": "9b2fa9f748790d850d60c19b499e2110", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446104, "uuid": "3bae7476-b8a7-4018-9317-e5ae35ee7711", "comment": "Malware payload (Mirai)", "value": "06b41c7826316f73cf2d51726e17cb2fd2cb30b05d1b259846d73b7a0ba7897c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446104, "uuid": "cd1d239a-89df-4282-9931-886e0cc1f90a", "comment": "Malware payload (Mirai)", "value": "d3d2763f10af2c690b0eb67e419404e39ad7bad0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446104, "uuid": "2e03456d-0b6f-40ba-a0d0-a63cae701ecf", "comment": "Malware payload (Mirai)", "value": "8c3e2b13140dcee5fa38641f9487cd252825f42b43377c0d9e0470d223feada8a2c12c7ba71fd95555abd8fe10dd7067", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446104, "uuid": "f5f351f4-1e9b-4fd0-aeaf-99627a8513f9", "value": "T1AAA2D061E2D59FB0F6FD6D30ADD1D2C1BBF20AD57AE58AA200441F62C32A8536748DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446104, "uuid": "d150f1f2-091f-4e54-8a36-bdf224b66da8", "value": "384:7/gNyF/M84Tp2YshxqlDZv4nO23Y1n3nkxRvnKx3ZM4uVcqgw05VxJd:7oNytlSVsMDZgF3Q3kGJ24uVcqgw09n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693446104, "uuid": "20112cdd-b12d-4f7a-9143-1efd2bc4218e", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693446104, "uuid": "ddc7a15a-bf1c-45b4-9984-20f69906a499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446104, "uuid": "2a5b74ef-2256-4344-84ad-21bafedba44b", "value": "9b2fa9f748790d850d60c19b499e2110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3367c473-47e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693475164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475164, "uuid": "251c2b49-bdd7-47f1-8a20-36c4739e6fed", "comment": "Malware payload", "value": "d861771f656e780034eac4c28ed3b202", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475164, "uuid": "c33b83a1-10a8-402f-a686-9dd292459150", "comment": "Malware payload", "value": "0768e90181f70c62fa8c8b50746198a3912a8c8a99c579fa2c1f7e619c4211b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475164, "uuid": "e71e61f9-5ad5-40b1-a680-7ff078ae8186", "comment": "Malware payload", "value": "41bd21c2d1c5ac4f2036569a071440d1d1c6ac65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475164, "uuid": "5ff7786c-30ae-4cb8-9aae-dd6b4f9446cb", "comment": "Malware payload", "value": "0a83af1c9665b0ccf2f96e8bc4ac3ea700d65db6e9ef0f519c803658e8a49103989df91a376ed2e869bd44dea5772b2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475164, "uuid": "0a5c7921-5376-481f-9235-b30b77c62f4a", "value": "T16C2112FBFBBB8B16C494603A0E6B23107760DC8C4025D335BB216A0DAC536517E862F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475164, "uuid": "335174c4-3538-4894-a701-6e4205bd128b", "value": "24:3bNlDq3N0yTKs49k+TM3s8MA/OlhCrjSkvy6J9lEK+3NTawqNs:XWVT8L78MmDvZ9D+3Nuns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693475164, "uuid": "0d439a6f-526b-4de9-a151-38f7c18d946c", "value": 1280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693475164, "uuid": "54cd1749-d5f6-4a96-8f0f-9eba6f0d69f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475164, "uuid": "be3f76ed-8044-401f-a729-7df35d20d462", "value": "SecuriteInfo.com.Linux.DownLoader.535.25442.4302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4f0a3b-47b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693456957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693456957, "uuid": "942fb1c3-fc0b-43d0-aa1a-f7f3901d216e", "comment": "Malware payload (Mirai)", "value": "e1f21582eef5cec5095aa688785a3ca2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693456957, "uuid": "ae225ad7-7576-43c1-aea6-af2822b964e3", "comment": "Malware payload (Mirai)", "value": "08ebb599818c6da26687f94813e77a73a807a5bd39956782ce2923fcdbb0d2e4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693456957, "uuid": "8c875e9c-2678-4104-ab3e-83c9b2dddb80", "comment": "Malware payload (Mirai)", "value": "3e34890251aba34e291de353eec66cb2b4cad8df", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693456957, "uuid": "22a9463f-fd2c-4287-98a4-539f59bc9cf4", "comment": "Malware payload (Mirai)", "value": "88f4178309dfc394cdb4182b23e3e3d522b2d342c7d0aef7c22d27c15ac329f02645966ce3300c22a75c2de4a27d33e9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693456957, "uuid": "dd91d49e-7130-4038-8c46-896d70add64a", "value": "T18C436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693456957, "uuid": "b81cf5ce-82f9-4809-b1a3-0be5e48f9a7a", "value": "1536:JeESt/basV2rcZhG6+KN7TqK9qpFzWOIaEjrqM5s:JeESt/basVTgW7TqKwp9tXESy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693456957, "uuid": "a52b6b8c-d0ed-4d22-b9bd-816294a5703b", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693456957, "uuid": "7cf2ffe6-b348-4c4d-9ebc-bee9b7161a5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693456957, "uuid": "faa85b2b-7862-4b43-b010-ce728a212266", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb9507b-47c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693461004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693461004, "uuid": "d5c30848-69be-4b67-95af-4906d806041f", "comment": "Malware payload (Mirai)", "value": "83e0ef370edb950bca8ec8551ea80a3a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693461004, "uuid": "e61765f1-adfc-4e45-aedf-3e89685d0c9e", "comment": "Malware payload (Mirai)", "value": "0a83f8a511300fb697412da3b5661f782b59f0b1e169bf3be241ee1598aaa828", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693461004, "uuid": "152f94cf-7541-4efd-8096-59c8451f8a9f", "comment": "Malware payload (Mirai)", "value": "bde983ae6464e34eda405b5c79d3e64205f3d7a3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693461004, "uuid": "d4daf4b9-7535-4c42-a0d1-f4135cfd2aa3", "comment": "Malware payload (Mirai)", "value": "e5097562395ad4a4f855dd07f2d85e5e1992d2c890e6906a9c6ff14ccbb58f2c826f1046b8116e0ac4def5245b9b79eb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693461004, "uuid": "8e4a8089-2142-4673-bbef-5e410c6d24ae", "value": "T1BB530747B44180FDC149D03447ABAA76C8237EBD1B3AF39637D4EE3A2C6AD221E59C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693461004, "uuid": "70832065-11be-4621-ae43-23296aafda28", "value": "1536:anF9U0FferGtOW4/RWo45z8kkRqwvhJOlQ5M7WR:0FK0UrUO3JWvwRqwvOlr7WR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693461004, "uuid": "1c93f7c2-bd8c-4fa7-b213-10f292dd8ded", "value": 62720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693461004, "uuid": "26637b14-85d3-451b-b55a-529d4b059ef5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693461004, "uuid": "56c7ef1d-685e-4565-9ae7-d5b441734818", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5bb3f6-47fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693485322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485322, "uuid": "5a7b74ac-99a4-4a27-b418-877a9b2ba6e4", "comment": "Malware payload", "value": "e339fa8bb9b417d7f7b34c722e808661", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485322, "uuid": "fea6464e-23c1-49c8-a5b6-61d28af5651f", "comment": "Malware payload", "value": "0aa0f35253e4095de4811fdba1b104e800467fe5569ee9f1b3c7096fe9b3702a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485322, "uuid": "4857997e-fd6c-496e-9fbd-8ebdc82b292b", "comment": "Malware payload", "value": "78ece1b66fef352953cf3f5b12671b8134ce7cb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485322, "uuid": "6c73c920-7344-4f7a-95e4-2d1eda80a1fe", "comment": "Malware payload", "value": "fba7ed8aaef37cd7ef41d6df5089bea588733b78184f1ff1eef94bcefb32758c3e88f58e38988311a2b8caba2297a083", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485322, "uuid": "f55ae439-9a0d-4d92-b30a-13dbda879bdf", "value": "T1D063B60BF1D884FAC554C97550D74662732BADF1AB4F07632C4DA3902B8FA6A1D1FB48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485322, "uuid": "fd961ea6-27ac-4f05-ac15-2d5537db5ce3", "value": "192:XID/9RbWl6fUA/lndlJq9fd/hkoacEiMu8aB1ENV1WbnU74ebw5R4ObU7VDlu:K7bmfIoacJB2NajK3Y40U7zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693485322, "uuid": "164721a2-8ad3-43a2-b650-2fb263acf6a6", "value": 69988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693485322, "uuid": "42df3405-bb91-450e-b9c3-40ecd6d05fa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485322, "uuid": "a6bc2b55-a046-4bf2-a637-bffb84af9737", "value": "SecuriteInfo.com.Other.Malware-gen.15644.13294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdce3d77-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693466376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466376, "uuid": "1c969a2e-e524-436c-8596-e0d47119dd71", "comment": "Malware payload (Mirai)", "value": "3479e9690917b4a558ea5d4b7fbf8b12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466376, "uuid": "369c3aff-cee5-4758-8751-fca85db9c989", "comment": "Malware payload (Mirai)", "value": "0c9950e18be9431097d1f654c600f31068ad7742d79a6f1f5711c9b0a1526fb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466376, "uuid": "cd9debc8-c78b-4ed8-8926-ffce73d02be5", "comment": "Malware payload (Mirai)", "value": "1d844c572ee0abe0a5bb30372dcac85ad4a9f7c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466376, "uuid": "aac5e6d4-d3b0-4740-80f6-c2167d3a2230", "comment": "Malware payload (Mirai)", "value": "14faccf64d41fe53c454f94aa8e9cbd9b473711792ddc7de27f6db6aeb36d5074e6be36f75db5a6709397fbd95a74923", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466376, "uuid": "4648544b-1482-4411-acdf-3646e3204b4d", "value": "T13A41EF1A1FD01F23DDA6CD36455A27112ACC842FA06A23516334D960BE3E605A6D38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466376, "uuid": "95aca2d3-f9c2-4bed-b925-2119cdfcbafc", "value": "24:eT3+n8CcdmpHuTzixZuDa9mC05BJL4mmlZ9EKpeogu/qs+UTK81kKUlu/NkT/KIN:Ut29nuDW2B6df9+uS8TLGPkuTiLFGX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466376, "uuid": "75a0a51d-bb8d-48cb-b075-2c58968af2af", "value": 2048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466376, "uuid": "1c6086c8-18b8-4213-a303-4c3e3b793747", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466376, "uuid": "3037788d-8949-4f8c-a7b6-3405ab10d344", "value": "3479e9690917b4a558ea5d4b7fbf8b12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae041b8-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693466345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466345, "uuid": "67b1811e-2d53-4d0b-a462-92fca9fc93ff", "comment": "Malware payload (Mirai)", "value": "b9bb6b63930bfa81ce28bfe1132c8e24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466345, "uuid": "bb81f46d-5da6-4c26-a6da-a01b8bcfee5c", "comment": "Malware payload (Mirai)", "value": "0ca1c156e2b7c7cedc76e4d97016556ff2d5669d8d1b715f2ec8e0f72def0b5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466345, "uuid": "8ce68283-3409-49a2-9d6e-8e2c2ed3f22a", "comment": "Malware payload (Mirai)", "value": "b1b94d9b5ee3834c1f92136f1ab58c1d1e732df8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466345, "uuid": "c0f2b423-4bf6-4859-9dcc-dbfb5b35794e", "comment": "Malware payload (Mirai)", "value": "e5b152befa9b72d65cbfb715f1eb4ebb68dc0f9bdadd4874f68e6cd7161f6f14d9cb1c18aa4eed085a65e8e2a2aa9ae5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466345, "uuid": "b43a4106-2872-4ae4-905d-6b9a8837aef5", "value": "T19721EF0EE3592D4FE9AB2178142F06277420765AF4139123F3668E3F7E7B5D4521B28E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466345, "uuid": "719a806b-d72f-47ef-ad30-454ad6ed629f", "value": "24:3gAa8DzSWPpbP78Pwy74+CiFTHkdhHJJkD8ECAfGDiocjnlDaxNT1G0:TpP3hb/mrTahpJc8DAfXnDaxNhG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466345, "uuid": "fe68ccf4-56e2-4adb-97f0-751a73be2aab", "value": 1256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466345, "uuid": "606276e9-7abe-416c-aa7c-533ac9495609", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466345, "uuid": "2e36272a-8b93-4885-8eee-e6a45194fcac", "value": "b9bb6b63930bfa81ce28bfe1132c8e24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782bee7a-4830-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Heodo)", "timestamp": 1693508350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693508350, "uuid": "0a915e6e-c20f-417d-b4a9-74921606b719", "comment": "Malware payload (Heodo)", "value": "0de798cbf3bc2353f8641e5f5b138845", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693508350, "uuid": "f8d7a499-ca35-4eea-a54f-243160dd3baf", "comment": "Malware payload (Heodo)", "value": "0e01bad874c61d09d09ce06f76f5e46f6648a1fc943644874c8e1a53a93af9a7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693508350, "uuid": "378ba1d3-c417-4f0b-be59-e705a8e1bda5", "comment": "Malware payload (Heodo)", "value": "e6b5d09de211a0e6e4f2246c14233a28851aa796", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693508350, "uuid": "d648020c-1bd9-48e5-9fd0-d91b57714bd1", "comment": "Malware payload (Heodo)", "value": "fbac62d127e68a2aeaf4b6b9e31e85a2b2d63b5d37f437920135749601860d80ce8956b457e067d81996bccdc30f7cd3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693508350, "uuid": "393e7ccd-aac1-46be-959f-99cfb2473275", "value": "T19395AF0267E08176FE976133C76AA2E5C6797D2E0323946F1FD83D18E9701A1967E332", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693508350, "uuid": "c95c5bc4-50a7-44fc-bd3d-a17a59d1392c", "value": "24576:9tncpVGPBI9FsEsyt8l+E+s1tB7parWM0yVKzAN4vmpDwqiQLErwK:ApUPi9FBJZEH1X1arF0yVY9NqEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693508350, "uuid": "1343c0c0-cca0-4ed1-b1fc-4e11dcc18a90", "value": 1937408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693508350, "uuid": "e9e30120-7321-4014-85b1-3c25f2e93f40", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693508350, "uuid": "d10c951c-0eed-496f-aba6-8a3349459bd7", "value": "adobe-updater.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daee0f2b-47fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693485323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485323, "uuid": "2def104b-fe77-471a-b740-efdf70266c80", "comment": "Malware payload", "value": "7f78842f172a82e5b8f31e5e0814b94a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485323, "uuid": "526576f6-39f8-43d9-bf78-0e908c9106bc", "comment": "Malware payload", "value": "0f02b25ac319a9872e252496f637fcacdb56552df1634dc393aaaf4eb37d0d91", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485323, "uuid": "c1a761be-af37-4d5e-a7b4-23bf40c3eefd", "comment": "Malware payload", "value": "61984d4f7cacdddb8a419b5a5611e06dae2a6cf0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485323, "uuid": "44816a17-1b6d-496a-81b0-253973ab845a", "comment": "Malware payload", "value": "3c5599baa716c3f92ee2eced61c5205201e4f0f536e2d50ef9c54f189d11cd31aa5f82b2507d69e35da1689450112fd0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485323, "uuid": "ce9dbf72-309f-4ad9-821d-42279de0299c", "value": "T10D252351BEE52F1BC718E17C3013A946218ABE9C9B6DD1FB5BE275FA213CF360502189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485323, "uuid": "f6c6cbfa-245a-471f-a11d-e4f6ccbc6ed4", "value": "24576:9/gkSemm795kZ/BTV2Ybzo+3vA9K+qtJQcOySQ:L1+nhPYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693485323, "uuid": "c9a1a705-c17d-4f8b-98de-d59f34002769", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693485323, "uuid": "70b2d360-9f81-49bb-a72e-48e763c6e017", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485323, "uuid": "0bb5cddf-fb85-478f-bb1d-ea80acc6cc9b", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.28569.19879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b3f3b3-47c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693462517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693462517, "uuid": "9ec6b0ad-bd84-4157-9e7a-15b7677df9c7", "comment": "Malware payload (DCRat)", "value": "ae9e466d396b827e8412c1322914f802", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693462517, "uuid": "f0336385-98f4-4bcd-91f8-c33513820341", "comment": "Malware payload (DCRat)", "value": "0f32dddbf6a06bb59cd5eaecda082c9806cf437a026b6f4bcfe5f31ae21bb1e3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693462517, "uuid": "2a54bfb5-62c4-4e23-a35f-6555b87bd1e0", "comment": "Malware payload (DCRat)", "value": "68dbd7212a75b88ae085196c991f855f3b04ac54", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693462517, "uuid": "09876b66-acd8-42ca-bd3e-96cc71d012e5", "comment": "Malware payload (DCRat)", "value": "2f0f35fe611377666e49bbd7ecf2c06cb1597d7c104d09ad25489d94172a9cb30434fdf851a7ba08d0503fba4f0063b7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693462517, "uuid": "c8584e21-3c57-4774-b9fe-b381e142a450", "value": "T16F05F801BE44CE11F0091633C2EF454847B4B95166AAEB2B7DBA37BD59123AB7C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693462517, "uuid": "e5207ec0-938a-4956-a290-e5907f5926f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693462517, "uuid": "42cadca9-5c1d-451b-adbf-4c5217858ea3", "value": "12288:dJlo5GeSxO27+DUk0FPCG5jJeA4eHdufhK+gI1a6DN0:dJIgxO27+YFPCG5jJXHdookjN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693462517, "uuid": "e891d295-ef46-486d-9fda-f8e94a2a384b", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693462517, "uuid": "f86e2796-7138-4ead-a633-f83891da3c54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693462517, "uuid": "75906a39-e4b9-4980-bfbd-ccfb693a6b5f", "value": "ae9e466d396b827e8412c1322914f802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab2662d-47c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693460519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460519, "uuid": "eba1351a-d3e2-4699-a2f1-8c73549704f5", "comment": "Malware payload (Formbook)", "value": "f4330d3bedd90f566e05a7d407f15df3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460519, "uuid": "d3a83e77-b7f3-4d9c-a462-3445e320fe2f", "comment": "Malware payload (Formbook)", "value": "0f35727c05b3d8834eb5782a61b729149ed4c94ea752fd1c2f184b44ac48de69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460519, "uuid": "74e0e1f5-5250-4122-a2b5-e0bef18542c5", "comment": "Malware payload (Formbook)", "value": "53e7c54d4ee62a70d707f7d069b6a9ab0903619a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460519, "uuid": "0ec077e4-f0cc-444f-8b94-f1135879da5a", "comment": "Malware payload (Formbook)", "value": "b015f0f71035405e4ab6997806c17ec659cb129de1c6b6855c20a3107e966702c21334379063c040fe79ae6924b71ce1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460519, "uuid": "09b419d9-0e6e-4f61-89bc-f3f35851983e", "value": "T1B8D4121076741F25D0BF23FD10E6421217F0946A85BEEB6C9CDAB0CEBAB6708591CE97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460519, "uuid": "29221a85-5442-4ca6-9c9b-73486a27c186", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460519, "uuid": "19360fde-c774-4a3a-a6bc-4e4c8283cc54", "value": "12288:BtULBCvp2+wiw+JqzG4n/fhLCl/cSxoTlBbHb04vb+yW78:wLBiLxqyafhqrqnYE+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460519, "uuid": "7433d8db-5c97-4f9e-a23a-d2595cc66d2a", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460519, "uuid": "3887c680-dd7a-4201-aa7d-f8c3b4559f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460519, "uuid": "763ec1a2-f3e0-4820-bbaf-e533f98c8a84", "value": "TNT AWB TRACKING DEATILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214ac9f6-47c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693460530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460530, "uuid": "7ed87b96-cd86-4246-b1bc-0a716b4d3af6", "comment": "Malware payload (AgentTesla)", "value": "afb4f52b51506913d1404377510fdc9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460530, "uuid": "c48d7a9f-caf3-42db-a51e-59bbbef0ea3e", "comment": "Malware payload (AgentTesla)", "value": "0ffaba529a28ddcb84b22f283adf5614c793a40a899f9746ecef704ad2b6ad22", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460530, "uuid": "3d262329-f7c2-408c-9e22-e53016bb79b9", "comment": "Malware payload (AgentTesla)", "value": "914cfeed4b7542d99a46662e13c818bcf6a59c65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460530, "uuid": "f5021693-0c7f-4d0c-aae6-4a2737da1d43", "comment": "Malware payload (AgentTesla)", "value": "2fdecba843644d62efe5526cd027b10b474df70ddc88d5e1bdcd2aac9afcfb759f42bd7622ebf8131eb0a26714661e7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460530, "uuid": "c8537798-b303-4cd7-8c36-5e57b98bc71a", "value": "T12035506440FB160491EBE6ACF3567675463E9C8842FE0AC3B3D5BABC74C2267CA1C51B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460530, "uuid": "b2c414ed-3113-422f-8373-f31002e7105d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460530, "uuid": "dbf00278-5378-4d2d-af07-58080dc6b97c", "value": "12288:o6jPTrJVEP2isfX8KBBtnm3n0He9DlpzIpk1qaxbxQxkT4/rJw8flwykcnM9lPui:NjPTrJVEP2isfmP2G/qfP88Yz6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460530, "uuid": "d0db7fa2-3ae8-4f6e-8bc8-98f963976b90", "value": 1079808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460530, "uuid": "c0025ba1-05c0-4323-8ed8-22bba47f204f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460530, "uuid": "bf87a3bc-5930-4599-9b6e-fd4af9f82970", "value": "DHL_DELIVERY RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d085326e-47b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693456959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693456959, "uuid": "3674d87a-4112-485d-9ead-96b69cad299a", "comment": "Malware payload (Mirai)", "value": "1886762a920006ef052b246beda65032", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693456959, "uuid": "d4c387da-9a52-40c1-b207-bb9fbb198495", "comment": "Malware payload (Mirai)", "value": "11fe3a53d4f0c9a95c37e7c27bc1bedfcea2d6902e8d15d6c5022a739cf0a14b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693456959, "uuid": "2be9f61c-e38d-46ee-bf91-da9655cc90ff", "comment": "Malware payload (Mirai)", "value": "b20aa87678140e21069e3748664a6e0e2851fb12", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693456959, "uuid": "74ebc9c9-e0e5-45e3-bc50-1bd83109259d", "comment": "Malware payload (Mirai)", "value": "43cc54cde7a0181f3daee46efef2b118bf13de9c691a187fece0f5e1dfa135bd3fb375b3a7570d0effa0978c89c00ceb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693456959, "uuid": "1aa49fc7-c1cb-4723-af24-2449abd8b5b8", "value": "T12A83A51E7E218FADF76D823147B74E25A69833C627E1D642E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693456959, "uuid": "0762fcd0-213c-4ed7-bf1e-ddfc991b8d8a", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/deyLYwHuRHI0I4EH6gTPf7ZDYovZ73x/nL8y8V:Rakdn2Eo3eQaV6TPfRYo99Be037WjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693456959, "uuid": "e1186ede-c37d-4ca4-99ee-58db3ab3586a", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693456959, "uuid": "5db1723e-9c2b-40d1-9978-59bdc5a52370", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693456959, "uuid": "3b8f28a9-b032-4e66-9c3c-477559a08fe9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7adc207f-479f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693446078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446078, "uuid": "ff10edba-1cb5-43ac-9bf7-74a4bd705ccb", "comment": "Malware payload (Mirai)", "value": "ed03daccb9b6154c7282f70e4b2b7759", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446078, "uuid": "4ff1ea81-de94-4f14-af12-c819b4f2c99a", "comment": "Malware payload (Mirai)", "value": "127f4f0278094696e57726d2687a26721a92c22fa74fd90d2e53f41cdd79d246", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446078, "uuid": "a0b98959-81fe-4387-9424-1692a7387e24", "comment": "Malware payload (Mirai)", "value": "9832e95c4848e7d94b9e28e7d9b09a06ad59c7e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446078, "uuid": "942a105e-19bf-43fc-b5d0-3fb704ff7651", "comment": "Malware payload (Mirai)", "value": "decf36b01d35688c570ed505d2c28c88d4f8b6490668cbd74a2e278b872e43fd23a09a7e2ca18aa74d864af2e6ca83e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446078, "uuid": "193715d7-a8a9-4646-8f80-83131257b40f", "value": "T16E23F1616980AA10F3B50E31EC2CD647F7C997ACF2B974E137D9496C4A835920EA7CC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446078, "uuid": "2d7a4127-d40a-447b-975a-0056ff760532", "value": "768:gW2myW5zrY3m+KDOtELVpuyUEQNIM4ZktwkVlXFbkdzxh9q3UELMIk9r/e/lQMqI:f7d5zrY3mVqtSEyUE0IM4Fk7FbkdziLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693446078, "uuid": "1b78dadf-e0e5-46a9-9b26-2adbd9fbf6cf", "value": 46648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693446078, "uuid": "c1e6c061-4dbe-4cd8-8305-3512ef21fb44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446078, "uuid": "10474f11-0135-42db-b8bf-5df3c2a50b57", "value": "ed03daccb9b6154c7282f70e4b2b7759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9cc36a8-47c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693463014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463014, "uuid": "8e657eb6-f667-47ee-8201-852d52a9b2fc", "comment": "Malware payload (Amadey)", "value": "72748da82961c2c90a145070622eebca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463014, "uuid": "67670335-3a86-450d-99c0-643d61fcb507", "comment": "Malware payload (Amadey)", "value": "1440c936bbb678d156bc3307eff0949866c622d3b03c5ed3ab25427bcbb86584", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463014, "uuid": "d0d2f5f0-f035-4469-bce6-db1525b585c2", "comment": "Malware payload (Amadey)", "value": "61b41b2f879e0bcf37f7154b5e5927cf896c7995", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463014, "uuid": "a20c0f56-f893-4b78-9c91-be8aec3353f9", "comment": "Malware payload (Amadey)", "value": "72eb1e84283ef4989ab089c5f5c6497e1fafae44f506bce95b869bfaa40aa948cccb921118af43389f61e3aee5d01e96", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463014, "uuid": "7eec8e2a-621c-4495-bcca-8f3bfe242c63", "value": "T15DE41202B7E94472E4751BB02DF703830B35BC635A7893AA2295AE5B0DF3640B57673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463014, "uuid": "38400f8c-1906-4e8d-9613-5aa13a17c967", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463014, "uuid": "456ce01b-8d42-4100-9bb4-77cf143ce183", "value": "12288:DMrFy90X5ajoqqrCmIHAPmPnjTr0L5y4GPuLpCWj4NFpTwr3Ztqrn:KyUaUR1WAPxL5uu0M4TRwVtc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693463014, "uuid": "222b1206-d9aa-476d-8c67-3d19e0158472", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693463014, "uuid": "ff752ec9-4792-47cf-a952-f2f9fcc38d7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463014, "uuid": "2bc5be60-0f8c-47f8-81a3-f67f5846c5c1", "value": "72748da82961c2c90a145070622eebca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534936a2-47f0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693480801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693480801, "uuid": "c922aab7-5c22-4e49-9581-40b7655f08e0", "comment": "Malware payload (RedLineStealer)", "value": "a8558d6b6d80af8d991a468bb1b4b2b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693480801, "uuid": "9a952278-e847-4cb8-80a0-c9cfe34fff78", "comment": "Malware payload (RedLineStealer)", "value": "16fbabbe3842fee9262fd42da0151f81e4375652d59b01f75a1f0dff46cda69f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693480801, "uuid": "8700830f-16aa-49e1-b14e-94b4b31b3f68", "comment": "Malware payload (RedLineStealer)", "value": "f9416cb8e7535643f86c5a3540642fe0fb0b09d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693480801, "uuid": "7c575c09-c9f6-44f5-ba65-0fab6627f39e", "comment": "Malware payload (RedLineStealer)", "value": "ee28b620b7b1e6077b4b9e2403d90fb8bb1c6360e5113f8b00b0d9c628ebaa41f7b2ee78e6a5854de75414e5cff42b47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693480801, "uuid": "32121be2-b2c3-4f7b-a83e-635ed37720a4", "value": "T17855BE4070D28472D973153209F0DBB59D3EB9304BA25EEF6BE40B6E4F352C1DA35AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693480801, "uuid": "33295127-9cfc-4f16-bad7-8f0263a2300f", "value": "104b87c3fef9c18dcad72b41783c28ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693480801, "uuid": "7d799772-0eda-469e-99a2-61f57bb92930", "value": "6144:4AFObyV0RWeTKO40HAOWZ4s+H1CCZnvYO6yq2u8erIUfc:VsbyGHTq0kZ3aNZnvYWJuv1fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693480801, "uuid": "a59f581b-8d6c-4581-b6f8-20850c240966", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693480801, "uuid": "2153dd0f-708f-4f46-8539-39b89ff2450f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693480801, "uuid": "e3393a1d-3ee9-4551-93c2-e96879dc9ecc", "value": "met.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80467960-479f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693446087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446087, "uuid": "bfea24d0-0c40-4e92-9bf5-b4efe50a2151", "comment": "Malware payload (Mirai)", "value": "d3c06156a70c7ca53972e53bc65c619b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446087, "uuid": "40f70315-fce2-4c66-8d43-b12107d013a9", "comment": "Malware payload (Mirai)", "value": "17076e0124aa3ec60547d2416b33d129a739a86feedca9a99474a16a067d1e0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446087, "uuid": "f46b79ca-ae12-4982-9e87-70fa874790ae", "comment": "Malware payload (Mirai)", "value": "ed1cc03f366a46362d9b55decd4e0ae5f8ba6592", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446087, "uuid": "29f3d354-768d-4f36-80d3-7b8a2f88a1aa", "comment": "Malware payload (Mirai)", "value": "d2fff8a88bd91aa03aec27df7ac6674af7ee25cd14208a773a465d24c327e8c5b3ec298747be9652e83ef1a45e5529d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446087, "uuid": "db860395-79a0-4d3e-bcc6-0f4e8a72addf", "value": "T148B2C0CC61943084C98D7C7C178D4A665F6CA190BAEDDB26E354CD98B3BEA8F345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446087, "uuid": "d348367c-1830-4c7b-a92b-e95365e2c053", "value": "768:otrQlS07dEv0UXqUhvQE+CXQKMQKCXBpK08ZqqWva:iQlS07FUXqIYSXQKquK0EqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693446087, "uuid": "e4dfa5bf-70a9-4bbc-ac12-a0d67e85c5bf", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693446087, "uuid": "3c452fd2-2b96-4504-84d0-f22d87c651f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446087, "uuid": "c51bccf1-8c3c-4f48-8e02-c7b2eeabb4e7", "value": "d3c06156a70c7ca53972e53bc65c619b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f9c441-47fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693485318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485318, "uuid": "50a6a435-2bae-41cd-9387-8c79b3aeda8f", "comment": "Malware payload", "value": "ee29186167c91dcb3ad11d9ea725c1b2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485318, "uuid": "1178fd0f-3878-473d-aecc-d1c5a27fb608", "comment": "Malware payload", "value": "17b58a89672e6286c6178614fd244de7beda82f72ec0f997ab6844592e813d87", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485318, "uuid": "ff5899ed-58e5-4f03-8ad3-ff6da0c266bc", "comment": "Malware payload", "value": "e0d0f4ba7226044024f92ea2132b4af595dac82d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485318, "uuid": "f6926039-5cf1-45b9-962a-7fa54a523747", "comment": "Malware payload", "value": "adfc1a184ef4ceb8c32e0e6e0bec62e29057a9838186464e5d2619d04f84c12fe4df27c66626ab43081589d1452a7b5d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485318, "uuid": "1148f3ab-5050-4873-9b7c-10973cf6a243", "value": "T122052340FBCA0D4ECB0992BD969F5A1B7299EF8E0348E0FB939575CE067FB514883854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485318, "uuid": "8b780fb0-42ee-4e28-9a5f-3dc5dea83701", "value": "12288:Wn4WPXs0SA34zXpctOvXx/Dii88Cd1FY+QjZH+NDfFaeZyvk+qQOs:eL14zXIQx/OOIQ9H+NDFa2+qQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693485318, "uuid": "ea87989d-9728-4eb8-9baf-c8ae69149e62", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693485318, "uuid": "4a467be2-cd21-4541-bdca-431e20f6dd15", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485318, "uuid": "e97c81fa-7dc7-4c1e-92f9-8817ca77652b", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.25686.20769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade75fa3-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tsunami)", "timestamp": 1693466350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466350, "uuid": "a8206fe9-157c-4c95-92c2-7a69b7a67d5f", "comment": "Malware payload (Tsunami)", "value": "27c9c9ee4af1c64d8cf2d564fd6f368c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466350, "uuid": "ea7956ee-4245-44dd-af4e-41c11e2f133d", "comment": "Malware payload (Tsunami)", "value": "1abe51046fdf338e3ed8d3166adefa3db0be42e43484ea381f58e228297a0220", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466350, "uuid": "e69f7c0a-4f42-495d-87c8-ea3c582e28d8", "comment": "Malware payload (Tsunami)", "value": "c7e6b44d22a139d8f242e9cdcd9123b8cc82b42c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466350, "uuid": "d59d1869-8112-4937-8a20-cbcf8772e2c4", "comment": "Malware payload (Tsunami)", "value": "bf9ac48115c4e93d155853eb87c861d78a187098270d6f91d1ca4bfafde0748dc0fa2d36802e84a1bd932c0f18696902", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466350, "uuid": "56c52229-de49-4e1a-8e05-b8b75f9abbc9", "value": "T17AF2B6C9E9A9927FC3F0B7FAE74A07EE73354698934B6377B23C085427417096A74260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466350, "uuid": "a1d9aa59-806c-4bb2-9fe5-de41630a7b12", "value": "768:immPwtacE5lvyMq5xC7zW1fFXUUx4bNMnXi/U9:iXlfyMq5xgzifFXUa4bNMnao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466350, "uuid": "d97ea547-e8af-46f7-ab1d-dd8c0f288199", "value": 35132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466350, "uuid": "4881cf7d-c816-41e2-bd8d-88d1341f306b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466350, "uuid": "13504520-8c35-4cc9-9407-ab9f4a1e6cb1", "value": "27c9c9ee4af1c64d8cf2d564fd6f368c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cef3730-47a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693450322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693450322, "uuid": "3040fe02-f4e9-4e98-91dd-07ea252df8db", "comment": "Malware payload (AgentTesla)", "value": "73a2f351257ad034586984e1df243987", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693450322, "uuid": "be797275-8c32-452d-a926-5cddd19101e9", "comment": "Malware payload (AgentTesla)", "value": "1af26bd10f73019447bde718b3b24463cb1f07e15f3ba50da56ba3773dbc308a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693450322, "uuid": "bc410974-492a-49e1-aa54-26ac47235e31", "comment": "Malware payload (AgentTesla)", "value": "03b53d68a3ce1e39b2903e82ee5cc2ad35c01875", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693450322, "uuid": "da05aaca-c8b7-4fc3-9fa0-c674450180d1", "comment": "Malware payload (AgentTesla)", "value": "16515ba010bfe3e77e685fde410965fed032868e77fbe8f5411ceee7fb2807604b15e233f085d65fa31b6b35ef36d76c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693450322, "uuid": "112774d5-1dc7-44e7-bd58-bd326c07c56c", "value": "T16DC4232826F8B862C50675E011E820078796940B3624EBB4EF439B95F3B55CB75D7E3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693450322, "uuid": "7e433377-eacc-4b8b-b3f2-aaa233101ad6", "value": "12288:sNnHmvUr++BwBXwukDA1FyREvywfMj0rfVTBxAyX2HlZMdhsm8v8:KnY+BwBXlVnyi7MjqVTXN2HChsm8v8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693450322, "uuid": "953b8707-54a8-484f-9850-6fd1219ab2a6", "value": 547240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693450322, "uuid": "e7f2590b-1416-46c1-a70d-6c51b4d8edef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693450322, "uuid": "7a2c12cd-0b02-47f5-81ba-d19b83c8e0f0", "value": "RFQ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28761a3d-481f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693500915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693500915, "uuid": "1027cf50-9727-4b87-9bb8-f56a0be78f91", "comment": "Malware payload (DCRat)", "value": "1308739121acb9f2f8f80687a438e13e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693500915, "uuid": "32389d80-7100-43ac-b617-5d10a2992e36", "comment": "Malware payload (DCRat)", "value": "1b5d9120901b2fa972a959a82c97c8d3df7f53792ab623f63998a6a61d257959", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693500915, "uuid": "4fd6ca92-4666-4b43-a111-e03fb0a402a5", "comment": "Malware payload (DCRat)", "value": "095d65be6685f6551a11c76bd32cc5819d5aeceb", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693500915, "uuid": "53a7cc98-bb5f-4dae-a0cd-4c6e9e9ea8bd", "comment": "Malware payload (DCRat)", "value": "194932ec5bebe7a6c7de1323df7c1db5796e436bea982f02f13f98dc7faa8d38a8ebfe89dc291e803ff9ae73dc5d24db", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693500915, "uuid": "1185f4d4-2f34-4131-9b06-74c06acd62ea", "value": "T1810508027E44CE41F42A1233C2EF456887B4999166E6F71B7DBA376E15123A73C0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693500915, "uuid": "63df09fa-da8d-4c26-94a7-129937b1df17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693500915, "uuid": "f186e32e-7bd9-404b-9252-0727b0af8e8c", "value": "12288:Dg59YDJ/FtciLWSsZ/YKL3xnDDukBiEOyDiev:MA9/FJLWSsZ/YKmmigi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693500915, "uuid": "e9662b83-cff4-4f9f-b467-bc2fd0546993", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693500915, "uuid": "03f649ca-2ce4-45b8-91cc-06023eef0a97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693500915, "uuid": "3d1822dc-3fb4-4b0f-bd96-6c284358678a", "value": "1308739121acb9f2f8f80687a438e13e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bfc065-47e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693475166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475166, "uuid": "e64861e3-0e74-4bd7-885c-351bb4e2a4ae", "comment": "Malware payload (AgentTesla)", "value": "6459dc2096f79bc16d8abadb7e6c7694", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475166, "uuid": "203213c2-d206-451c-9267-64025e7436dd", "comment": "Malware payload (AgentTesla)", "value": "1d03362107576c4ebcd1c282425e4a7f46a9749d7df874e7005a7cf23b1cc40e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475166, "uuid": "172003da-fe4f-4817-be52-7f38536d2882", "comment": "Malware payload (AgentTesla)", "value": "834a9d8ea8fb0e81acfe30f97cfaafd94dc36e96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475166, "uuid": "e8765f42-4223-4068-bb6c-a7b2f4d729cd", "comment": "Malware payload (AgentTesla)", "value": "930ae74d408c93469d1662ffa627083d872b714a73096680bfffa1cd5046ec76eed65d72e8986089ceccb3689489cb6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475166, "uuid": "24058932-eb98-4807-96fe-278573ff1f92", "value": "T1D6E4E01875B85F26E6B883FA8534564407FC6A9E243FE39C4DD174EF2B61F820A51B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475166, "uuid": "3c358d06-16ae-4caa-8cfd-ff261c8ac490", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475166, "uuid": "1eadd8e3-6603-4743-8d6f-7ed764b1f059", "value": "12288:2UcELghXN2VmIIJ1Ld0h2yGklq7N0FReS3eB2UhRcOJ5c19:2UcjYhInqh2Kc7N0CSuB25y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693475166, "uuid": "d9eed26e-4cf1-4fff-b409-068597b3c3bc", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693475166, "uuid": "299c1768-03f3-4421-84ca-1718f6c233e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475166, "uuid": "9b43fb55-84a8-450a-810b-2c259b490e57", "value": "SecuriteInfo.com.Trojan.PackedNET.738.1321.7424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df5ef85-484f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693521621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693521621, "uuid": "48c2488e-c4bd-439f-b7f7-7938ae138f74", "comment": "Malware payload (Amadey)", "value": "8174f1aae20b99e6dde83a74d4754be7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693521621, "uuid": "16f11dd1-5a6f-40ae-bebc-9410f8f3d750", "comment": "Malware payload (Amadey)", "value": "1f385c8358cf31cc731a493a2edfdf1726054468c8bc7645e7dbacc63c5974be", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693521621, "uuid": "f7a23ef0-ddeb-4cae-a4d2-3ec47c414517", "comment": "Malware payload (Amadey)", "value": "b7411ee97e6e8cf48a08846011c253a61c95bafc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693521621, "uuid": "082b25f6-1efa-4516-ade1-62fe48d1f55a", "comment": "Malware payload (Amadey)", "value": "fa28d5d36fbce6dd904f23850516c156afe5bbcc6706dcb6c98b744a65734d7505328bb72a5c31e95a612684d698f06a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693521621, "uuid": "67f7d4bf-3345-4360-9fbc-2a81e63e158f", "value": "T1C1352343FAE5843BFC75173158F602830B367C916D78837A3796A51A4D33A94A872B3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693521621, "uuid": "bd0c88dc-e94c-4aad-b932-6eafe38bd0d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693521621, "uuid": "ef0e2fe7-f05e-4c74-be60-9eaf8edcc48e", "value": "24576:ryO0PRzLxpZbHgAXhYgmImPoAAvW9qsIcMf:e/Zz1v0CYxiSpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693521621, "uuid": "c1253535-a8bc-4a40-945c-61a68e21c8b7", "value": 1149952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693521621, "uuid": "7a1cc6ea-d7e1-4517-9cc9-5fcee42c5837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693521621, "uuid": "484ca542-1e9d-41cb-820a-854286d6f38a", "value": "8174f1aae20b99e6dde83a74d4754be7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8e69f8-47d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693471209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693471209, "uuid": "ade693f5-759a-4c07-a2d2-cf09d9ee9eba", "comment": "Malware payload (Formbook)", "value": "bf33416d60b0273593669b80d35c2c04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693471209, "uuid": "8befb77b-3a99-4163-b440-f3a239bb33fa", "comment": "Malware payload (Formbook)", "value": "20e93d317f46bc7db6349a15c50362749b0b6cfde92b196b3eab03ccf1dc363b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693471209, "uuid": "748c3362-d9a5-491a-b086-e26313d2a343", "comment": "Malware payload (Formbook)", "value": "fa039ee1af163d1d950800b57a3b5b45f90be022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693471209, "uuid": "808ed640-5ea8-494b-8177-a3237ecaa2ab", "comment": "Malware payload (Formbook)", "value": "668e2d4324afb9a1d709138a3e073b781566a2fa403c15663224140f1df6c513abe3a70e6dc498230ccef1e3149c549c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693471209, "uuid": "ecfaa145-8f7e-475e-834c-f824a7f45cbf", "value": "T13FD4120862E52323C6B983F96860B30413F1B7596732E75C3EE165D7EE92F129935B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693471209, "uuid": "b7e671f8-a4c4-4954-813d-a208becc4795", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693471209, "uuid": "dbf933b1-c6b1-447c-b692-0663fbe90ebf", "value": "12288:TkfOZ1anmQgGLkB+k0GoRQ2cbOH8lm5ZjJWEfbyOqL:QWZYKBB0GoRQY8lwZ4Ez0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693471209, "uuid": "0dae54b4-2f34-4261-9133-8ad53c3f2018", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693471209, "uuid": "8a6971a8-2732-48c9-b94b-94bab86d673b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693471209, "uuid": "491ce2e0-01e5-4abd-a76c-cfd2e0e114d9", "value": "SecuriteInfo.com.W32.MSIL_Agent.FPI.gen.Eldorado.19372.31842", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29bffc11-47ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693452384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693452384, "uuid": "6e79380c-091c-4339-aca7-a3543d8d0a95", "comment": "Malware payload (AgentTesla)", "value": "dc2bd45f1403a0dbe62b39295c53afa1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693452384, "uuid": "95ff2f09-2c1b-46bf-a06b-23c10f42cd43", "comment": "Malware payload (AgentTesla)", "value": "215141509213c2e15682c3c1e0087f97e64784fe286eb0dabd3a8bd189f7e741", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693452384, "uuid": "4c87e237-c6a6-4690-84fc-c319d23f2c4a", "comment": "Malware payload (AgentTesla)", "value": "799d80881176593df03e9ef105e7302f8ce9ce59", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693452384, "uuid": "7c8260e5-5709-432b-94a5-0fa46fe38cd8", "comment": "Malware payload (AgentTesla)", "value": "9f49819c21830aab80ba89d2f1e8445d1b0ff6b848036c93b253529dcb88cfffb5325c3553d76406e94ea1055b72714d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693452384, "uuid": "423fa363-e23e-4ea4-8e52-cbfbe5ce8c88", "value": "T1BCE433639B43E120BF5AFAB2400D937E2A7655D3695200AD70D4E3F19AEB15EBC3F841", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693452384, "uuid": "996c9761-96b2-45d0-986c-e7728918c610", "value": "12288:x8MlnCLf3gK+f5B1cf00veLc9BC8tQmbiGXk6yNa4vMOF/3vAHfzFu2GSNefoXFo:SQCTbdfIEC8aWXkh8OtvcfzFDf/XU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693452384, "uuid": "1492e999-d233-4496-9f0b-789d4df18fbf", "value": 719418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693452384, "uuid": "8fde8301-f343-4127-a7b3-6a7c9d8833d6", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693452384, "uuid": "cc4a1af5-1539-4780-8219-3fdec8549761", "value": "CI 23JS0502-POWERSHADES(ShippingCost).pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ffd107-4806-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693490529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693490529, "uuid": "5e6d3030-bf37-44a1-943f-d7ea96e2cd1c", "comment": "Malware payload (RedLineStealer)", "value": "c4906dfd836582e88ec81737ad2419f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693490529, "uuid": "fc9bafd3-f9dd-40ab-bbb0-16bc73bb05e8", "comment": "Malware payload (RedLineStealer)", "value": "22242fbb055277a7b7e7d8bd5c0ac4ecf84ebeee3d1c45cc4b564534d260d099", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693490529, "uuid": "e53a088e-574c-42cb-a57d-d9d9a6579e52", "comment": "Malware payload (RedLineStealer)", "value": "1429f62626614ccae8b43a9c14c394c982b7b691", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693490529, "uuid": "bf4b0b99-5168-485d-9c74-996d1ff6b32b", "comment": "Malware payload (RedLineStealer)", "value": "04c92afbd401c52cc23d7440d29269f5cf96fa5dcb4dfb7cdfd4dae9d00263ef477a79f7e4bf9a3fe24a7decc3e57097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693490529, "uuid": "c3669b41-5d36-44cb-bbc7-545bbc83b0eb", "value": "T1E4846C6EFEA68BBDC892457135E0BAB63C357C19471637DB378C4A1A0EBC3C28961D50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693490529, "uuid": "6b954b00-ea16-4762-9ece-10de074e3f5f", "value": "8ced73b76e5e15be9619497a7a65568f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693490529, "uuid": "547bcec4-6f20-4da0-b734-8bb0a3b04d87", "value": "6144:SGX0fU5qhAzVCIrs8DXsPhvrLRAON5uAkxl6ZAriHesDsiFC2rW94:ShU54AzVCwMrLR37ml6ZhHeniFCsW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693490529, "uuid": "57658323-bdf6-4dfd-9b9e-f864226790ae", "value": 375296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693490529, "uuid": "9688f8dd-4656-4f27-8a58-8e19b7af88a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693490529, "uuid": "72c8bf1a-e275-4867-bd06-a3442c67b42f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea252d6-482d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693507287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693507287, "uuid": "4c3642d2-2f66-48e6-8157-0de1358c0f55", "comment": "Malware payload", "value": "e70cfcade0563f6861853677ecbbcf14", "object_relation": "md5", "Tag": [ { "name": "4240553492", "colour": "#63DFF5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693507287, "uuid": "7742aef2-0aa9-4c11-b94a-8ea8458327b1", "comment": "Malware payload", "value": "22c0b8bde0f8ef6f2d7c5a7a32c87c3ff083422d2dc0480c5ebcac64a7ecf675", "object_relation": "sha256", "Tag": [ { "name": "4240553492", "colour": "#63DFF5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693507287, "uuid": "a1a022f7-6e0e-428a-9272-3c4b643211eb", "comment": "Malware payload", "value": "905ef4b6b64076c78fe11afddfa965082da341e8", "object_relation": "sha1", "Tag": [ { "name": "4240553492", "colour": "#63DFF5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693507287, "uuid": "1f135045-e01b-4a82-8ed5-09481fd3f3f5", "comment": "Malware payload", "value": "891164e3c00cfddcd9d56cb1d1403369b7d40b684544c9178f168454524e8d45b70f592715e36fbceca93793e8324962", "object_relation": "sha3-384", "Tag": [ { "name": "4240553492", "colour": "#63DFF5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693507287, "uuid": "93136f2f-d2ed-4427-92cc-afa7c9220245", "value": "T1B9D4E407AC9F00C8C965A03CDA79619EE365371523E05DDF95815606AACFAE0DC3BE3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693507287, "uuid": "4c14f558-d1aa-4cf6-b754-2ca24924611c", "value": "e5e63fcb065def1635ff4d5f87c69b37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693507287, "uuid": "45603176-28b5-414d-9b1e-e498d13bc9bb", "value": "12288:BqlI8nyOrk/09drnix9Lo/k9crJmEcUKx12UAXXWRfz:BmyOrkM9lk9Lo/k9crJmEcUKx1252Jz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693507287, "uuid": "ab3080eb-2821-4f67-9138-8ef39a672b49", "value": 653833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693507287, "uuid": "f3e6baef-8320-4ea2-b552-7c705e9ea0ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693507287, "uuid": "bcfe6378-4fca-4e71-97b1-71c2a6e67f13", "value": "IsC4veD4728tfFp6Msh8P-CDQi0twEgMXrysZKfs9nU.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9bbafdf-47ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693478503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478503, "uuid": "8da0a092-bcb4-4e0c-abfa-9f33de873f72", "comment": "Malware payload", "value": "19f8f7281f416a540a6bed40557e8c5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478503, "uuid": "7e9e8451-e099-4e38-bc06-54a7c5bc4431", "comment": "Malware payload", "value": "2443664017894106ed92052b0fd28eddb7a1cce54e2aae6445379258d3f5f68f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478503, "uuid": "b7e9d3fd-0c4e-478b-8a1b-050a25dc31c2", "comment": "Malware payload", "value": "3f04c740ddba3384ad5917ddb87077f3aca7dff5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478503, "uuid": "a8b18de8-4fb8-48c6-b9b1-37453398b43c", "comment": "Malware payload", "value": "d57aa3fad352d667b210a193f6f64199252089504dacf5f15bd6d279a01b02cf13030ec5eece7a0e2ebaa1666f120724", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478503, "uuid": "5a726dd6-cb35-4777-8021-93627f5e0085", "value": "T196672A02F72126EBCB549634C69943656330FC806F5EABD32BA2B93D6D732C45E78394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478503, "uuid": "7541332f-3ecc-41db-891a-889ed374cd48", "value": "4e53160a12270531910b87162a608761", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478503, "uuid": "f260bf81-9a65-49dd-97e4-88388b0458cc", "value": "393216:/uaBhCWG/o4M8uyiS78dbddd8dKbgENV0:37Czd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693478503, "uuid": "7e8a36b1-f6f0-4743-ad26-b65006449e37", "value": 32362006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693478503, "uuid": "15f42804-d49c-4710-82ff-da38821a1cac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478503, "uuid": "0d876279-cb3f-4b85-905e-df8c41b12bd4", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c21d1e-4800-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693487573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693487573, "uuid": "75314c03-2fb1-479f-94c0-b20bedbe8407", "comment": "Malware payload (AgentTesla)", "value": "eff515cd80fca123c65f7ed20d7f071f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693487573, "uuid": "f8f4c06d-4d7f-42b0-85e1-5eda76f3d1f6", "comment": "Malware payload (AgentTesla)", "value": "26176205211fdce7ad34cf10d72f178f1646e913e368f0f5bcc325e5428a69cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693487573, "uuid": "44397935-dd53-4ecb-af17-b0240d9eea5b", "comment": "Malware payload (AgentTesla)", "value": "6f7bf5b871e413f40f1c23e7953251d0fabbbf95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693487573, "uuid": "fc36620b-abfa-45ff-b0ca-2deeeee40d3d", "comment": "Malware payload (AgentTesla)", "value": "b7ab1b3027ec0f83e536555d54d61517101b74617b1242b7ee191e88288c2c8faf574f037742ba5b101220c3f3cc7196", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693487573, "uuid": "1759f2fc-803b-4d7e-9e4f-10fc30ab30b8", "value": "T11144C11121DAA04CB273BF835BCD75E99F5BF7B22B2A187E242803179722D54CE69731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693487573, "uuid": "ba6dea29-6cba-46d1-bfa6-8c9172fd38ce", "value": "6144:t7jmLQQJm7ILm5BmZMLpRKsEAlOb4b5bdZ7ZmZ8Z7V:t7jmLQQJm7ILm5BmZMLp4sEAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693487573, "uuid": "44704639-776d-4016-838d-7e4bd9c06824", "value": 275722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693487573, "uuid": "30b7e3b9-b0bf-4d6d-8349-bcf42ba1537e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693487573, "uuid": "7923574a-7f36-4034-b0db-e096a1e10d13", "value": "HWX.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22fa85c-47e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693476638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693476638, "uuid": "3121cf53-b8a4-495c-9d6a-42127458ccec", "comment": "Malware payload (AgentTesla)", "value": "ae1983243379ca3c73dbe522e059e59f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693476638, "uuid": "cd472cff-0bcc-4c5a-9ed1-ac78778d97f6", "comment": "Malware payload (AgentTesla)", "value": "26e70f9fa38eab3f67224bc8d973c876707c4710a88cb1f95be9e453ff0746e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693476638, "uuid": "789a5e6f-3ccf-42f6-886b-d10a894274ed", "comment": "Malware payload (AgentTesla)", "value": "d67bb8cb4140bfce44f1649ad651f5b4ac02a1e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693476638, "uuid": "21a3785b-dc85-4c80-bd96-e5b2ff0b8334", "comment": "Malware payload (AgentTesla)", "value": "d89c7c34848a5f0ca0760b976051cac3956ae7be70a0d30706c46852360ce4bd7998be3f3697d3a0c361fd1194a11780", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693476638, "uuid": "f2e8247e-5b96-4e78-96ed-5f89d0fce9e8", "value": "T1EB02AFCDC421D0DDD5C141F4ECB596B2C619FFE23A721D947BCC29824A98203B6E7064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693476638, "uuid": "41f72ea9-74aa-4be3-bbd8-3d08671fd109", "value": "192:3/pR1AfHBqxcqEEsNRU44w11d5FQcIa5QotJK64HBB9b:3rufHExcqEpNB4w1f8cL+wJKFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693476638, "uuid": "0c66e5d9-c881-41d2-90cc-ff9c386b4872", "value": 8843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693476638, "uuid": "5fcc8d6c-a8b0-4441-87c2-79aac0203eeb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693476638, "uuid": "de67e27e-cb25-4b1b-b973-c31f66160295", "value": "PI.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c40aea-47a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693450331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693450331, "uuid": "2d0748b7-2b1b-434b-8dd5-8ed3bf053e5a", "comment": "Malware payload (AgentTesla)", "value": "b9b1bb2109d5aea3b8acdf172b898ad0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693450331, "uuid": "8efb3d16-0753-4c97-9576-f379919cc504", "comment": "Malware payload (AgentTesla)", "value": "27ba55dd68c01e4ea5c7edf2a33bd5a15e65758002938bf090d801e6ffeb4aa8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693450331, "uuid": "de9bcc52-7f52-4b7b-8420-56c2210610d3", "comment": "Malware payload (AgentTesla)", "value": "44f7693f292ef7eedca50adc8bed682e323b032c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693450331, "uuid": "22784d6c-1508-45d4-b9f7-977429b027eb", "comment": "Malware payload (AgentTesla)", "value": "169ec417f8ca6d0d1947e55249e115b71296a6c5fe17fd5356281d714dbeb524de8d47b07d5876ff66672eadb689eccd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693450331, "uuid": "2b741a41-e4de-4592-a02c-bbf7ce2e7390", "value": "T115E4F165A78DBCDCE647387288B985110352AEDAF86F861BFC05385495F338225EBC1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693450331, "uuid": "7b2cf5c7-d4f9-4aa8-bcef-4bfbd74c5d79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693450331, "uuid": "b0001407-ee10-4493-a4b1-5d8b11b50f66", "value": "12288:cpd2Qs2wZXwueE8PUPktmPKV8f/FXn7mj0rfYrnyX2H1e0L9heQvgLt3Zz9qVg:cps0wZXlTMSkAPKY/FXajqYc2Hg0SzYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693450331, "uuid": "7bddf84a-c75b-4b4b-be6f-574522f99d3c", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693450331, "uuid": "fa06d7ac-6c19-4181-adf9-2011435565e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693450331, "uuid": "4991042f-9819-4084-89dc-d6201bef1f56", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4356f11-4809-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1693491781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693491781, "uuid": "a7fb3bf3-afc0-4a9c-a288-8c20823f5941", "comment": "Malware payload (CoinMiner)", "value": "cb7d981a41514e05e06f245e41def1b1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693491781, "uuid": "b9ffa5c6-52ab-49d0-86c6-ab7c64480d53", "comment": "Malware payload (CoinMiner)", "value": "27fca545923d2b0afc8f1075cb68eea4ebfb38e1e4184883ada0a5f24e9e014d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693491781, "uuid": "cb4743d0-d618-4374-bb1e-e1cc6c219d77", "comment": "Malware payload (CoinMiner)", "value": "e72486411d3f0d30143cca799ff5b22c719db778", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693491781, "uuid": "6f444324-344f-4b53-a8f1-77e9204d24de", "comment": "Malware payload (CoinMiner)", "value": "1fb5b5b959ee054be17407445687de12906673ead33a44f8bd930e9cfb3c34ebeca7181b2f711f7f7a65f848b5fd350c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693491781, "uuid": "f0c704a2-7849-439f-9c2b-b716e6b81f98", "value": "T15B34CF21B2C2C073E52345744EB6C6B5AB2BB8B14B316DDB2BD45A7E1E712D1CA3434E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693491781, "uuid": "32b0c980-feb3-4aa6-8dd3-8e97c0c0adb4", "value": "c614d8d8bcef689d6675c8b116f7714c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693491781, "uuid": "9ca4ca2c-27cc-4141-a590-39bc00db0163", "value": "3072:ErEg4+jlrQ/peokrb2aapOQ49yDe206gqzANPtyu/uf4nm3CQ4++5lmj:RkQpeoSb2aVZU0+ARtyuW6fT5lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693491781, "uuid": "8ddb646e-89c3-49d1-86d2-4bbef1d7c336", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693491781, "uuid": "f5c7b219-88a2-4578-ab84-5fb30e05fc0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693491781, "uuid": "6a38d346-4a81-4c9c-a1d6-7d7bc2ed7383", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4b1744-4844-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693517078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517078, "uuid": "0984726a-9495-4c4a-bcf2-cff4afda3e61", "comment": "Malware payload", "value": "e49aaa9a5933c48feca39f3080a7b94d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SuperBear", "colour": "#A6CC3A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517078, "uuid": "4ba454c1-ef20-4c3a-9bef-3e00e1614edc", "comment": "Malware payload", "value": "282e926eb90960a8a807dd0b9e8668e39b38e6961b0023b09f8b56d287ae11cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SuperBear", "colour": "#A6CC3A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517078, "uuid": "4be7b76c-957b-4908-a0ec-02644021dfdd", "comment": "Malware payload", "value": "557820050eaed5f32241346caeefdfff0ce44745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SuperBear", "colour": "#A6CC3A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517078, "uuid": "db9f8477-102d-4860-bc37-78dcd7fe1651", "comment": "Malware payload", "value": "cd0576cefc5e85535026c8fbce17331c53371069e8381585acb9b71019839c602d5d763b820e1d0aeba3188a933906a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SuperBear", "colour": "#A6CC3A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517078, "uuid": "42383dac-5fba-462e-a21f-19bdfbf97a12", "value": "T1AF347E10B591C037D57315330EB8CABA953DBC210B11A9EB63D81E7EDF74AD1BA30A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517078, "uuid": "8ffd64f1-1329-44b7-8a83-ec11aa66d5e4", "value": "24bb4f25c4e20bb2f86f32a5b77aea70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517078, "uuid": "3d0559b9-b58b-47f3-9841-fe99d292208f", "value": "3072:6nraIxNDMfFF8xzCh88D9XRr13BLYiwMOP6xaNlXq6aHJOZEe4deBHu195BSzjjW:sr3MfYE5Lsib46xaNoJO+KBHu37AOik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693517078, "uuid": "a5a7ea02-04f9-44e1-84fd-563726c67efb", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693517078, "uuid": "457e75e1-0910-40a1-87e6-a4b9f3922ddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517078, "uuid": "88768b2f-e4f4-4299-913b-027ef3d62a04", "value": "400000.explorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b78a69-4826-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693503972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693503972, "uuid": "eba07432-47af-4b5f-9b08-0f436858f3f6", "comment": "Malware payload (RedLineStealer)", "value": "d400aaff1110933392dcabccf03ceada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693503972, "uuid": "7d3a5edc-0821-472f-9f1d-9084b7b4988f", "comment": "Malware payload (RedLineStealer)", "value": "28b24f7f7461ed126da81424bab353809818b2f6c97ac0ed3ccdc5cdc1a9839d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693503972, "uuid": "0309d864-31c3-4b61-9287-d5099713d15d", "comment": "Malware payload (RedLineStealer)", "value": "87d00012559c9f308ff63f1f7ffac80236920b6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693503972, "uuid": "53918039-edd6-4ff9-a256-4a57ebea5a0a", "comment": "Malware payload (RedLineStealer)", "value": "09a6878ff5334c036922a537d9d554a463dc44c7021a2fe94bf94653b30c4c38a777b2bdbe0be7c350a4002c152facaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693503972, "uuid": "929ac399-0941-4ef5-b4c9-6930a0dd2608", "value": "T136052241F7DA10A3F97827B128F71BC30D35BD229D78875F2785AA0A6C72684963137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693503972, "uuid": "f1e0adf3-d806-44a0-9e13-5384f0c1dfe6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693503972, "uuid": "96b17726-d638-42b6-81f2-bcacda0c8716", "value": "12288:EMrvy90Jlb2X8vGYHrx2e0Ki/p4pS6FPiJ5+JS9y/nSXcwGR1ddpy9aPh2vTfPgv:jyUlbcLYQAPiDLkvSXcwY09a5qbKiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693503972, "uuid": "24e4f3bd-6882-410e-ad75-d4077bbaa2a2", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693503972, "uuid": "302b2a7e-4a24-4c26-bcac-110dcc664bb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693503972, "uuid": "bdf27cd6-9292-4b7a-98c7-4514c3399ba1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b8d5d6-47c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693460450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460450, "uuid": "45ac7e42-d935-4fcf-b9b8-24b7fdab3851", "comment": "Malware payload (Mirai)", "value": "2a567cf33007cced0f525384179468ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460450, "uuid": "511c01d6-c59a-467e-be22-274561bb31ee", "comment": "Malware payload (Mirai)", "value": "2ad0f1db2cd14605c2a9e2d2ae9a0e4bbf4f909c9e05fa852308b91de118464a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460450, "uuid": "20faaa2b-a359-4429-b356-98831c104d81", "comment": "Malware payload (Mirai)", "value": "75b95f075413b6abd999d28e4c952c212472bfa6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460450, "uuid": "8398048b-3f48-4aaf-b001-66ff65093c9a", "comment": "Malware payload (Mirai)", "value": "6cc2ea5270936b0ca6a3e5db0056047d797b92ec969548122740b73a85c10856b4aafb37aeb33953e0a2af31ac515d4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460450, "uuid": "16a1187f-93aa-4742-a413-552ed39e53be", "value": "T1F9431852BC818A16C6E01276FA2E85CE3B2523E8E2DF73078D211F6176CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460450, "uuid": "28adb00d-8e57-4747-bcf7-f4e5a4cd106e", "value": "1536:xuXJpW+QpwAqEn8A0uqJEMGDuJ2nkAmXhR:xuaP6uhXe2nnOhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460450, "uuid": "ebcc70b2-63c7-45d6-abe1-2a9039ae525d", "value": 60460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460450, "uuid": "38833e4a-3c2c-4d66-8ce1-9ad4456ae101", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460450, "uuid": "6fbc8c09-5c03-4377-860f-6010535863bf", "value": "2a567cf33007cced0f525384179468ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70194dc-47c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693460432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460432, "uuid": "21178a00-8604-4c4f-bac9-9bebd1cfc4df", "comment": "Malware payload (SnakeKeylogger)", "value": "059774cfe30038a2616d3a52d05916c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460432, "uuid": "81108149-83bd-4c37-a158-68bc7cc9cb9e", "comment": "Malware payload (SnakeKeylogger)", "value": "2cd3dbc329836d7d8a46a47135b8529c293906482f39d401e52f0ec1cce84dba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460432, "uuid": "a109495a-da1c-41b7-a383-97548d063e08", "comment": "Malware payload (SnakeKeylogger)", "value": "dfb35efb4874942d73770d8c3946c6e41fa437d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460432, "uuid": "5b1a3814-fcc2-43f1-b9c7-9b7cc7d0b6b9", "comment": "Malware payload (SnakeKeylogger)", "value": "0e59e0ce9092308072fd3f92784f85dd1464b5d5ecb195f446c5faa14f42cb4a338b6fea1841018b961ce0626dcbe4be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460432, "uuid": "a1e580c9-4082-4dfe-a54e-65c348701c97", "value": "T1C924711497419831D7FE43BB40159324B667EBB23A1F613A6A76BFD42E3009CF93B885", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460432, "uuid": "fd5aeda9-70d7-4a2e-a4aa-538d828e3c52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460432, "uuid": "161b7006-8f7a-4ef6-af23-7d7b9e8d0418", "value": "3072:U7OEw+vFg3W8WKQVx8K5dO0iSuv75c4JG13ULYOf9o22rPfgbYn:UdF6s9tC7lJG13I9o2MP4bs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460432, "uuid": "9cf2eb10-7575-47d3-a9e6-33639f34a82b", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460432, "uuid": "baa28ca5-580f-4c42-be0e-a9fc4b3622ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460432, "uuid": "4877464e-21db-4645-b93a-d846ddf9bc3d", "value": "059774cfe30038a2616d3a52d05916c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be98b495-480b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693492577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492577, "uuid": "643c96d2-c8bf-486f-8d00-7e8364d9baba", "comment": "Malware payload (Formbook)", "value": "af0b7c8d5a69857c46ee2436b461df1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492577, "uuid": "ebacf928-2029-429b-9d9e-e2dc191f2e84", "comment": "Malware payload (Formbook)", "value": "2d6e7743faefeb63c95139c45667ccc535c87fcb5956df2d5381887e15bc59f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492577, "uuid": "6beeb481-ca57-4ded-b757-fa1b3d93a30d", "comment": "Malware payload (Formbook)", "value": "b8c34a367d1ff246d5ebcd518c122c9ce5998c33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492577, "uuid": "33afe7a3-976f-4c6d-afc2-5cc15723a5f2", "comment": "Malware payload (Formbook)", "value": "c1901dbc3db71699fa8e941d2fffcbe437ecd749e9ce079486c7c9610b61c695fdca6be9a74df1b89cb94085bd567c82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492577, "uuid": "a8e83c4b-4e77-4760-a150-179bf7308ed2", "value": "T1EC255B983200B5DEC917DD37C9682EB4AA20AC66979BD10360173DDDBA3DA97CF105E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492577, "uuid": "8523110c-40ba-44e3-9512-19540d9f516a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492577, "uuid": "ec78f45f-5842-45a5-9570-f6024226d0c6", "value": "12288:wI+wh+6fGn5ZfOUmJZeCSHyGPwG6L8e8c2ifrCymj94QJJbgX8+zjWWqTR3lwW15:Sw+WmZWUgZxSjwxX8lsVxQH08+zjWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693492577, "uuid": "278a2a09-86ec-4e4a-b8d0-6a5898e6ddcf", "value": 978432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693492577, "uuid": "b3d01433-57d7-4681-b41a-dfe3a6981d36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492577, "uuid": "f5a67c88-a8d8-430e-ab43-c462e9b96a55", "value": "SecuriteInfo.com.W32.MSIL_Agent.FUB.gen.Eldorado.31359.2242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f9c1af-479f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693446091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446091, "uuid": "ccc33155-f594-4905-9b31-d7ba5e409180", "comment": "Malware payload (Mirai)", "value": "54d395857d8323b79aeffe4b7885dcac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446091, "uuid": "329272aa-2032-4341-a253-fe4d448aa5a5", "comment": "Malware payload (Mirai)", "value": "2d7b3300041aeabefd2e216c4d3f9ed27243537a9229ab6028ba5c3738fd70e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446091, "uuid": "29e8ef97-f7e8-45f5-929b-0969a97bb41d", "comment": "Malware payload (Mirai)", "value": "7881d7a968a18a3b112c0dffdacf0c60e6aa5e1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446091, "uuid": "f92d1abe-362d-41c1-baae-dff88fbacab1", "comment": "Malware payload (Mirai)", "value": "9db7ca8bcaf7ca67b755b705214adef0a22dc2bbd401506f5341faf31a0a03258341df4a2882f3743f1a98adc74f3c42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446091, "uuid": "83758717-a51c-4f0b-b01e-ac7424920579", "value": "T171A2CFBCB6B97C30D2B19671DDBC1805B217597816F671311820C7B1AED320A33B89DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446091, "uuid": "828a3252-7088-4c21-b5af-8473c1064a00", "value": "384:ofmu7YtXl3lZ4G6pIsCx5QQ3dqDYBMyLWNtV7dlkwhymdGUop5hT:of17YJl1ZrcSdqsewWNzJyws3UozF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693446091, "uuid": "b7a4c727-83be-4046-ac4a-b91b2ab5b131", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693446091, "uuid": "75579c3b-37d3-41dd-b5de-2b2ca18cd8f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446091, "uuid": "4433d26d-b665-4cbd-a029-a18163d96038", "value": "54d395857d8323b79aeffe4b7885dcac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc31a98-479a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693444041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693444041, "uuid": "584804f7-8daa-4cf9-ad90-f7354f423d05", "comment": "Malware payload (njrat)", "value": "d9a3ccd2feddcd5ffa10dcfd62632ba5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693444041, "uuid": "633706f6-46dd-430c-b9ac-ce3982aad4ff", "comment": "Malware payload (njrat)", "value": "2df2ef6accd4e1ff9a0a443431853fc8f6453d7580ddb91fc6e6ed3990f8ae43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693444041, "uuid": "06d2f880-9c04-4288-a76e-883e660c9956", "comment": "Malware payload (njrat)", "value": "eef50a29f4e32181e82ad3bd05613b4207a086e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693444041, "uuid": "2c6bd470-5dcc-469e-9f73-4d02f03e13d8", "comment": "Malware payload (njrat)", "value": "63f34070e59eb7ec6c39fb2a1a4ca1707f9a7b31f18a4ba326e72173141ab8f5880486c36761fdc562744158e1ee2c35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693444041, "uuid": "26d724eb-511c-4878-80ce-7f1669db4b63", "value": "T147C229593B908176C2EF5BB406B2D62542F2E10B4A27DB5F4CD844FA6B773C04D81AE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693444041, "uuid": "7fbe1cf2-15af-47ec-9532-743d5de1a47c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693444041, "uuid": "314919f0-38be-4ee5-bba6-c2d25795f60b", "value": "384:oLd6SomIf+kg/3AGefHzCYe/iBY2OzRLTm3yilqr63+bEtVvGj:WO7f+kg/KT5e/gsEXVvGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693444041, "uuid": "efc4acc8-2310-40fe-a6c6-c1bafa3d9d5e", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693444041, "uuid": "1e877182-49c1-417a-b080-12e15bfa2e24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693444041, "uuid": "942d6136-eed3-47c4-9588-a06967be543e", "value": "bPrw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320fa6dd-47e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693475161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475161, "uuid": "d18f34e7-fd8c-41df-960a-d5dd58f3318e", "comment": "Malware payload (AgentTesla)", "value": "793a0472916592bdacecbe01bec9da1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475161, "uuid": "8c8f7812-962b-43b4-bbbe-4ca759675e07", "comment": "Malware payload (AgentTesla)", "value": "2e1a1a5bfa96ff3a0a15dffc49da1f4e8b5c61fedf901a9562dfe2cff0b8870e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475161, "uuid": "45726514-a20f-4433-a67d-e65e510d0712", "comment": "Malware payload (AgentTesla)", "value": "bf922d2dcf3672b00bcbac8d66d5df906ac12b73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475161, "uuid": "6919db06-36a2-49ee-8184-23a94693d37e", "comment": "Malware payload (AgentTesla)", "value": "61baa9fe25b9c02d003f718116c672b101bff2f9db2c7d689d69c1e3e87bf2f9ac14cf2296a6db9291b6768f656439d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475161, "uuid": "c1ee89eb-3a5d-473e-a229-3b1fa055f0c5", "value": "T198156124D070B3F6FB4217AC7567F75002444BFCFA9C60B86EA7AD09A0933925ABD5D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475161, "uuid": "263fe7d3-c60e-4d19-937e-95d9957da212", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475161, "uuid": "64286928-6649-479b-9e18-a26442e132fc", "value": "12288:rbFIkfrIkfZSWrPwOnWdxOc7i9QfDoCoNprejK+VYW/VFKW:rZIkfrIkfU6PwOnaMc7iq7oCkGKqN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693475161, "uuid": "d05f224e-cd3a-41a4-9ab6-1468ebac0142", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693475161, "uuid": "71d1cb4d-7b70-4ed7-9c72-c5ca5823fe18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475161, "uuid": "ce77f05d-965c-4153-b492-9da0d3a4b9ec", "value": "SecuriteInfo.com.Win32.PWSX-gen.5801.14628", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3936b0a2-481c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693499655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499655, "uuid": "0948c8ac-dc2a-4128-8a63-253612d1b184", "comment": "Malware payload", "value": "56e007be2970d8f627fed17d260d09d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499655, "uuid": "4e932588-cbd0-4924-b3d1-99d1700b848f", "comment": "Malware payload", "value": "38f3b6aa0e4a0ae5c8045d211d03be409ced081d96c8ec03cea566dbb868afa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499655, "uuid": "22bbbbe2-8d3f-4611-ad90-9ae5b9c4b02e", "comment": "Malware payload", "value": "69264c1a477670e6cbd7ed777c1fcd66bae11e7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499655, "uuid": "f4e9fd36-836a-4340-9590-7d28d127ae24", "comment": "Malware payload", "value": "de3c48f7e3d1136dbd2eba5bb3cc86f934f512807b56514699a7ad563395ea6754f1a264276e0de9395942504bf2c5a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499655, "uuid": "616a3f70-ecf7-4d60-9a6d-4f3f9953bda4", "value": "T14233A6492E228FEDF66C83344BB70A21A76873C527E1D785E29CD5052F7038E645F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499655, "uuid": "5306d534-d18a-43d3-aeb2-31faa14adb97", "value": "768:bcSWWEsVjh/oFJQ0zDDPzGyskiuE2y5WBeXuKsjZIt/:bcSPEsVjhwh3zyLtMe+KslK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693499655, "uuid": "6879b22c-dde6-408f-a89c-c1f3e8adbf9a", "value": 51704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693499655, "uuid": "d94848c3-1822-4087-aebe-1366e0d6db29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499655, "uuid": "66eda9ec-4def-46e5-8e2d-b7b443baebae", "value": "SecuriteInfo.com.ELF.Mirai-AJJ.1224.18322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01b2c71-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1693466380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466380, "uuid": "b6fef8a0-e9a5-4598-bf8b-ff9e95ca613b", "comment": "Malware payload (CobaltStrike)", "value": "c95d214005076e29185b0f9cb05adcd9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466380, "uuid": "d1bc958d-3f47-4a64-98cc-06550f23273f", "comment": "Malware payload (CobaltStrike)", "value": "3953ea56a2d94506f51e21be5f4342f21293c7fc3e2e46549098819b1ee8d4b6", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466380, "uuid": "bb07a22d-31a0-4490-836e-d9457b7fbbcd", "comment": "Malware payload (CobaltStrike)", "value": "58171315685939ed12dea441360cd00ba6dd9b16", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466380, "uuid": "702b95df-2e44-4924-93bc-079d99783338", "comment": "Malware payload (CobaltStrike)", "value": "da297e827460c508510c2df9db1d402bfa768bad03305838ba74a510f08492a854f96e398790653706ef3ef5dc3f6edf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466380, "uuid": "c6917713-fab5-4867-b532-99d232202a37", "value": "T11924B7ABBD6C0DA5FFD9113E484A190E6AF43BB6711DB14FB09FB9100E23A755A05F80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466380, "uuid": "ebdefd62-2b6d-44d2-b61d-1eb43e070bec", "value": "46fac3f6a8e62adbf8207ee77ce0b9f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466380, "uuid": "5fd3cb59-6919-471e-82e2-12337e0d2377", "value": "3072:CY1s5eM5gDRiLpL27b+5S8TF4w/VHli9kcjzAx:3s5eLNidiuk8Jpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466380, "uuid": "80add5aa-7779-4667-a25c-9a02f16c7bf3", "value": 218592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466380, "uuid": "ffa5bb7f-d1fc-407a-af02-2fab4eadfec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466380, "uuid": "666fdd10-980f-4430-8983-2dea54c07f42", "value": "c95d214005076e29185b0f9cb05adcd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff67d80-4836-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693510887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693510887, "uuid": "387852b8-81b4-4931-bb19-16323d39b2ad", "comment": "Malware payload", "value": "0004f210832f5ac092c66fb5d3951f46", "object_relation": "md5", "Tag": [ { "name": "4240553492", "colour": "#63DFF5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693510887, "uuid": "bef52d2e-3ab4-41fb-bd2a-513974e9ec4f", "comment": "Malware payload", "value": "39ba2094c833757f23ca989e3830c78042ac00bbde226017f39c3d48f31d197d", "object_relation": "sha256", "Tag": [ { "name": "4240553492", "colour": "#63DFF5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693510887, "uuid": "9cc665aa-cca8-49c5-bd54-e79cc9f3015c", "comment": "Malware payload", "value": "3d2dab4a4981849a7d9234d0bb9a5d3f24be7f07", "object_relation": "sha1", "Tag": [ { "name": "4240553492", "colour": "#63DFF5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693510887, "uuid": "a834e538-df25-4024-9175-801d147736b6", "comment": "Malware payload", "value": "b89fac8d338702c2f83212d254acaf90ecd962f87130e54fb85983c8e943557405f476a46ad835c24d14a9a03465f793", "object_relation": "sha3-384", "Tag": [ { "name": "4240553492", "colour": "#63DFF5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693510887, "uuid": "b0a0b046-6529-41b3-8a0a-78992a0ed01d", "value": "T164C27B07984C19D6E57C83D8BE572BED2F083B4CE9963DFB10520FAB3A649632C4D066", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693510887, "uuid": "da04afe1-56d2-402d-a54d-086c7bf259ce", "value": "768:Ukgm5Iqk13uR0yzmvjB5er2/k4H8VBiLLrozrJiV9rI:Udm5n9RLmvNyB4H8VBiLHo3WrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693510887, "uuid": "c9d65dcd-7b8a-4044-9c64-a941d66227f4", "value": 27204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693510887, "uuid": "71e4250f-180b-4edd-b714-0f98fd5a37c9", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693510887, "uuid": "5f696a10-18f6-4bfe-8279-8a1d2a69b7a0", "value": "Inv_UG_08-31_60625.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcf399e-47c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693460555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460555, "uuid": "286ae205-0c7f-456e-9ded-7848f6204b77", "comment": "Malware payload", "value": "492bccdc4047ede086281163baf5266c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460555, "uuid": "73f772cd-32a8-4923-a900-657e4a520aa0", "comment": "Malware payload", "value": "3a7eb7702f96158d240f83d8e7eae604fb90b56de019adb1c3433bd9089dd31d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460555, "uuid": "e0540bd9-c3c4-4ddf-b503-1bc729fedba8", "comment": "Malware payload", "value": "ce89d23a3bb40258f5960b2198834459e441aacd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460555, "uuid": "6c869f14-285e-4211-83b9-91a7b8174ac5", "comment": "Malware payload", "value": "6e2afba2f678dc610a84c77775faf7202c8bb94a2ec190c09e0dfad52312a937e05cdb29617cfc4904f327efd85a7f0b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460555, "uuid": "a1de78c3-e126-47e6-b06f-84e6b71c33a6", "value": "T16FE43307E85364EAF68A48712741148C37773662BE174703CAA83567EAEC0BD4CCEB9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460555, "uuid": "5b8e1ef1-8485-4fab-abf6-de3082a4e576", "value": "12288:h/j+ZwkaeubKEckZnXDt7Qsv8TypNXvm8GM:xCwQuuE7XhYTA/1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460555, "uuid": "e3c2c3c9-bbe7-41fa-a8fe-e5bb4d05aff7", "value": 662719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460555, "uuid": "1206f6aa-b158-4e55-a40e-b1f4aa8aa51c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460555, "uuid": "ff188023-4ba6-493e-8663-3e14d3b76b3b", "value": "new order.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd3bb8f-47c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693460550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460550, "uuid": "4eb77ffc-ccf9-49f0-89e9-1ce3160f4329", "comment": "Malware payload (AgentTesla)", "value": "e7763931d43404bfd8bcd3edb1e414a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460550, "uuid": "465fdc1a-6d83-4c98-8fdc-eb61b826a73c", "comment": "Malware payload (AgentTesla)", "value": "3a804b927894664ac333de55ecfdf605403cdcc505d158957b14e51eb779f13f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460550, "uuid": "779e3ddc-9f89-463c-aa8d-df93797c6122", "comment": "Malware payload (AgentTesla)", "value": "e63daa9ab1cf44c4256698961ef3d31d7f7171c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460550, "uuid": "79bd0b21-8458-4236-b5d7-bbbca37cde59", "comment": "Malware payload (AgentTesla)", "value": "3242ab0ef90c813fd379132937e2d6a091c6e7915b6ad5041c7abae073d13176fbaee5ac32d6aca474f026d69165a1fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460550, "uuid": "b1997add-520b-4ea2-a0d0-f73d35b347df", "value": "T102E423AB23461F7B57925EA3254130C843F47D2A934FB259E6A1439CF1C36B9ACE131E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460550, "uuid": "9d3f5544-c177-4ae6-934c-cd7143845512", "value": "12288:ZnnW6534vXxIn/3HMprfqd8KDzbyDv81QCCdfsN4mtaQ1GPqcNQxiC6EYXU:x7oPxw/3HMMtDzbp1QCAsNQQ1iJQxHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460550, "uuid": "002acc28-7618-477d-a535-d2dd6e28abe0", "value": 671624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460550, "uuid": "c3027ace-44be-4046-8e54-1fab7d929f15", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460550, "uuid": "6f0e0bc0-c501-4eaa-8f66-76f3dee3fb31", "value": "Incoming Payment(Client Account details).xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147e4f50-47f0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Zyklon)", "timestamp": 1693480695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693480695, "uuid": "7a16c189-f9f4-44f6-89a5-2f3733dbc038", "comment": "Malware payload (Zyklon)", "value": "67729fea32a7415f7daacc38a4937838", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693480695, "uuid": "82685bc8-e9b8-4351-9c8e-8f6d8b57a038", "comment": "Malware payload (Zyklon)", "value": "4084675f249b86d29802f7ee4a329e746ef33aee58074ba7f857db67461b4ec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693480695, "uuid": "60fc2aee-6414-4b98-966f-4dbf27179ad6", "comment": "Malware payload (Zyklon)", "value": "2213fbd550054897b2ded74fd98958f57527bfe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693480695, "uuid": "08b5343b-3244-4d4b-8292-bd08417412b0", "comment": "Malware payload (Zyklon)", "value": "f14a525643e406ef5792bf0ec4652ad582f41b01efc01ebc8fd9ea10627ae8698db5a14ac0c1a8f4d4de191e92d5d99e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693480695, "uuid": "57801072-39e2-4909-8300-87eecd403a3e", "value": "T1AC553334FAD6C4AAD034D9B149B786BFFF254C1121D98B9F0311E56E6E230C6DE4AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693480695, "uuid": "ea8a8ec2-45c2-469f-977a-ba4dddb0da3b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693480695, "uuid": "cb3d09d5-cf4c-4868-89c6-9f96f3d89d37", "value": "24576:DYrsNaA/5ADazBDa+HNM3CKTRYVjeWgniMU6O6h4q6a0/qFiXF47rSVHNCJiJ5FG:sQR/5dzTNSdg8OaDFiXau/605yksDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693480695, "uuid": "54a2e483-ca30-4ce4-a94c-d06fcb13d2a1", "value": 1331842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693480695, "uuid": "99a88149-63b6-43de-9d21-dcd7c59e4d1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693480695, "uuid": "bde84684-58ed-441f-aa4f-a738d16ab016", "value": "chromedriver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dedf7918-47b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693454406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693454406, "uuid": "5e20dd32-fcd7-4171-b254-8863918f9f0f", "comment": "Malware payload (Mirai)", "value": "e39c4c22af9490bb3778bba8ece228d7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693454406, "uuid": "3ea10b86-97af-4a85-bc39-86f77207a73d", "comment": "Malware payload (Mirai)", "value": "4135ee373611edfbdb598ec16edf74e2fe1410d4598f49d2675d6719dff29d42", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693454406, "uuid": "18d14336-7080-4cab-84a4-9bbff6fd9405", "comment": "Malware payload (Mirai)", "value": "41812bbab4c9eebb345bb39f15681a911af9c0b7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693454406, "uuid": "51703436-ba5d-48b5-ac27-772387b68d4e", "comment": "Malware payload (Mirai)", "value": "3acaedb294758574d5de3bb3bbea7868e08eecf7a8b005a153f93211bbd9f25b8079bc16c8419e4286445842972438d0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693454406, "uuid": "4d241fbe-1e8c-4d19-8f18-8b8c455c1cb5", "value": "T119230271850E9DB125703C76DAD5E393B6E11AB1C6673013D62C0A3C2F69B231E5BE4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693454406, "uuid": "deba9b76-986e-4f31-a267-2afad546f572", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3gs9q3UELbUXfi6nVMQHI4vcGpv0:DECFd+A6YHAx4LRQZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693454406, "uuid": "47d8cc0b-1cd5-4239-89c9-fea9d2232c53", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693454406, "uuid": "98e13b8d-1637-4dc7-baab-a4397af6a4ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693454406, "uuid": "a5b986de-7d0e-4638-ac31-61ac395fe9dd", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d52810b-481c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693499662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499662, "uuid": "b0f6dec7-fc9a-410c-95ca-ed9fbfcd72cc", "comment": "Malware payload (njrat)", "value": "221ed84719bdb506ed8bf9b5ac3c9ff5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499662, "uuid": "d8b4e4d0-a0fe-4473-9cc8-2eb4b33f3b6c", "comment": "Malware payload (njrat)", "value": "41e72796c94e742fb3025e4a25d1ce8f5def33dd8cb061cb126e4074eb125dcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499662, "uuid": "e262573d-280c-4e8d-a51d-372d3c050dbe", "comment": "Malware payload (njrat)", "value": "bb134337a5168957bc38bada72e1f258583f3a6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499662, "uuid": "051512b0-cc81-4313-9182-8464e2cf87bb", "comment": "Malware payload (njrat)", "value": "98f849d179add18a0e6e1341d0a8943e86af15d799ba2b6f4ab1663585f6fc8c106e449a30cbb70be7002032a843c84c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499662, "uuid": "c0b2ede0-47b8-44b4-bfb4-ddc0c2ce6bdf", "value": "T1F6E207463BA54225C6BD6AFC8CB303200772E3478532EB6F5CDC58CA4B676D05251EEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499662, "uuid": "59ec799c-150a-419f-8257-e003bc6ef2cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499662, "uuid": "b284a2b4-d783-436b-8aa9-8063d235aaba", "value": "384:U0bUe5XB4e0XWODcc6WQzDaWTFtTUFQqz9OObbF:xT9BuFwcrQ9wbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693499662, "uuid": "36b522fc-3734-4be2-b57c-c89ee38689b4", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693499662, "uuid": "2de64da2-abb6-4e92-ab2b-9873d9be73e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499662, "uuid": "f449ad58-1b44-4d82-80b1-6f994531ffce", "value": "xPocj5acGM69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b1a8ec-479e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693445831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693445831, "uuid": "d6b23520-a0af-4f4e-8011-9033e8707d18", "comment": "Malware payload", "value": "aa91030187a7fe89cf6f88018996813a", "object_relation": "md5", "Tag": [ { "name": "91.149.236.33", "colour": "#C8127C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693445831, "uuid": "393ec747-4a59-49f8-89ab-61deb832eaab", "comment": "Malware payload", "value": "425d6bd2ef9ce6fc2d42bd931e4555028143ff3ccab6eeaa2f98c2b2a591414d", "object_relation": "sha256", "Tag": [ { "name": "91.149.236.33", "colour": "#C8127C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693445831, "uuid": "691efcf4-7eb9-4489-aaef-6d1e319c07c0", "comment": "Malware payload", "value": "2dcacd84854595ae6c664e46e18001e1125ce24a", "object_relation": "sha1", "Tag": [ { "name": "91.149.236.33", "colour": "#C8127C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693445831, "uuid": "750b32f1-ce80-44ac-9c08-d1f5759abd68", "comment": "Malware payload", "value": "a3641b8d5760b65e606f66b159881ce12150c6bb3dec26d47a00b4a6dd009d7c9807a179d8bf4479ade3650306db7a87", "object_relation": "sha3-384", "Tag": [ { "name": "91.149.236.33", "colour": "#C8127C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693445831, "uuid": "3848069c-88aa-4002-b1c6-e31ccdea7b99", "value": "T1F6959E0B7B9445F7D06B9276C8931B06F7727C544B20D78F12986AAA1F333D29E3A721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693445831, "uuid": "0b39c944-05f1-4eaf-83d0-e9c87712c585", "value": "49152:fpz78jOyA9seyMF0qymrMDoT45UIJCBM:fp8fA9segqymrYoT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693445831, "uuid": "34d803d6-ca2d-44d2-b5ff-378746014659", "value": 1933312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693445831, "uuid": "a3d8e14a-f8ae-46ff-8719-bf561b0a8659", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693445831, "uuid": "5a9466d1-54a2-45b7-a635-d73889390ab4", "value": "1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda796a6-47c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693463047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463047, "uuid": "dcafabb9-d113-4bdb-ab97-c886046a6d6f", "comment": "Malware payload (AgentTesla)", "value": "5593a8e8c5000016aea6d7d3368289c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463047, "uuid": "e1e8b0fc-885d-4b76-966f-156c6681b422", "comment": "Malware payload (AgentTesla)", "value": "427672b2d8fc7d56bddca99d8d65ac5e61af99267de7cc27a1986af558257fcc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463047, "uuid": "dbadb92c-3bb0-4641-949e-6ba996452503", "comment": "Malware payload (AgentTesla)", "value": "18a95dfea5e893bfd01e66e2d8cc908d2da08f22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463047, "uuid": "2e784066-4ab8-4b87-a3e9-7e840eb1b527", "comment": "Malware payload (AgentTesla)", "value": "120c41fa57b4a3f3b1097a739ea174a92ef18bf93142c54070eae24e2bf7dd5ca323eac5dbd5077b389d569ebc3ffb05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463047, "uuid": "d67692fe-1f9b-4aa0-b699-3287d7c37899", "value": "T14C8422163A90D16FC5168A315F7AF63095F36F0B59A4A24F2BB57FA73A22391D40CB30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463047, "uuid": "006a431d-89c4-402c-a9ec-7ec7ee886f3f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463047, "uuid": "a09a2a9f-46db-4bf5-b92e-13d3f60bf8e4", "value": "12288:mYErN1Dr/rSOTsW49w7FLLej0KXGhc8WfXfK:mYmN1Dr/rRSSsj0qGi8WfvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693463047, "uuid": "3b136e44-130c-4fd9-be7b-001b740e256f", "value": 402785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693463047, "uuid": "a3a22387-f0e0-4e34-8659-5bc3995efd06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463047, "uuid": "9e52a2cd-5ab1-4d4a-a9ca-311fb2b6e923", "value": "5593a8e8c5000016aea6d7d3368289c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0bce2d-47f0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Phonk)", "timestamp": 1693480819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693480819, "uuid": "4a514db9-742a-42b9-84e9-939e1e080e09", "comment": "Malware payload (Phonk)", "value": "d0fdcafe227693a18f52fecb4db174a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693480819, "uuid": "4c2cd8ad-3c83-4c26-a788-dd4ca1e54ce0", "comment": "Malware payload (Phonk)", "value": "42a5b1d974f030bc2868a3a2f2cf4dad5443d3e85a18919088429abc1bb9b0ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693480819, "uuid": "efddfaff-2735-4645-ac79-7f53a844c8aa", "comment": "Malware payload (Phonk)", "value": "b2087f372e9cc7466d37406ab35bd5f3f83c68d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693480819, "uuid": "35dc2708-746c-496e-95c7-aff9cd9340ad", "comment": "Malware payload (Phonk)", "value": "1a68d9dec95f736e4bbdc4e296f8a78398fb1b8b601a0c1738a0c6195a31a8f231e3668d5343a49457095b20fda2386e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693480819, "uuid": "c535f930-f932-4e77-9c19-98eff3d7013c", "value": "T114256F9D3A579DB2DD4E05F2C3533A887F20C4DABB2090E62ED145C8B63E11BAD4D19B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693480819, "uuid": "afaf6f35-f8f7-4637-a6bd-2a60ec5e69df", "value": "12288:dGGyqIuubhT0IE+n4Oo5RwIAv7J2J1mxR0Zu4TE39vI9geB:duqIuuJdVumIAv7EJIxRjJVI9geB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693480819, "uuid": "6137ec0e-3e5b-42e7-9302-e56ff2ed9a95", "value": 985088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693480819, "uuid": "1cd7b72b-3250-4ba0-be52-49b6a9e86413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693480819, "uuid": "12de590d-ce38-411d-9d87-e2f4b2273015", "value": "mins.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f930acd-47b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693455051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693455051, "uuid": "60efef0d-bc5e-4e27-b945-db363a940feb", "comment": "Malware payload (Mirai)", "value": "88692a8ec49ee7eef562e3ce44ca17dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693455051, "uuid": "9fee1257-75af-48d5-92b9-40c1d501b0fc", "comment": "Malware payload (Mirai)", "value": "42c441b64ec77ccd8f69ca2737f22e81ba7c13d3faf18b391721d4f7a5fe453d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693455051, "uuid": "f05a010e-c14a-48e3-9edd-c3e19715214d", "comment": "Malware payload (Mirai)", "value": "d79a26ce392ab779db61e5e0acc7a822d0766455", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693455051, "uuid": "6a5a9754-4b38-4382-9194-52dee9298a8d", "comment": "Malware payload (Mirai)", "value": "6eba293957bd1236d13ec9b6ab7bf3a26df4ce95bc0eb75b5977192ab361a7ce1652b02d84d673e2ba12f79c70317012", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693455051, "uuid": "289ad746-e601-455e-a275-e7bf03b48a11", "value": "T1A4B2C0CC61543084C98D7C7C1B8D4A674F6CA1D0B6ED9B26E364CE9873BEA8B3459079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693455051, "uuid": "19ce7102-50e2-40c5-8264-4866c3cba1ef", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpQuZqEWvv:/QlS07FUXqIYSXQKqutqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693455051, "uuid": "e1ec79b5-cdf5-4c4d-bf63-0e46bcc6b30c", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693455051, "uuid": "807d48fa-0110-45cb-9af0-e20dd023bd74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693455051, "uuid": "9fb77c9c-eb23-4158-be2a-0c390d0ce882", "value": "88692a8ec49ee7eef562e3ce44ca17dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf3053a-47c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693463100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463100, "uuid": "abc47cd3-53c1-4128-9e93-f32c349d5d52", "comment": "Malware payload (RedLineStealer)", "value": "890a181d01baac191ea246bf858af534", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463100, "uuid": "e586f974-888c-47cc-88b5-d4bd78a58af2", "comment": "Malware payload (RedLineStealer)", "value": "440a01923b0b54849e0c62042a92649e8ee8dc2fc5200abc756a982447efef10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463100, "uuid": "d30e2b7c-d459-44b2-bdf0-ddd9a4743ec9", "comment": "Malware payload (RedLineStealer)", "value": "b6d1f501da5016d0820ce9a51c2b7ca8dcecc129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463100, "uuid": "1af09b89-91f2-4136-9a90-cd97da4f2375", "comment": "Malware payload (RedLineStealer)", "value": "0516362f8b9a620cb53b456666a0a7946bf1c076cb9a0bab1f9d1bab783639a0d735f4913115af91f342d2cd1bcba60c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463100, "uuid": "a9a161e6-6c58-47ef-9690-f984aab97bb5", "value": "T150052207EADD4072DEB41B3098F607C31A343C926CB463577B89895E1DB3A45A8763AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463100, "uuid": "1c441c8c-7d32-48c9-8d66-8572ec738b9a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463100, "uuid": "47500197-4f29-4c16-b765-c0bad90b2cb1", "value": "12288:VMrFy90Wl0q0Yp+5Dce054OmQV9szkpke2WAs2Sb137HrF0X5pzAUBPxhiOPMe:oyu5DceNOtzYFey8FHrS5pEUBPLiPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693463100, "uuid": "2b4c5e15-892a-4bf8-815c-e5c20824bd6c", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693463100, "uuid": "25eec553-3093-48bb-b504-1ab0d38efe62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463100, "uuid": "ca4e0bed-e95f-483d-99f4-71755e38015c", "value": "890a181d01baac191ea246bf858af534.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c41051d-47d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693470508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693470508, "uuid": "7a742bcd-dcfc-4004-8991-7d0d80948f1b", "comment": "Malware payload (Smoke Loader)", "value": "6d7117753e060a39db99a3f69ba85739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693470508, "uuid": "3cdf47eb-c893-4dec-a7ab-c668daa240d9", "comment": "Malware payload (Smoke Loader)", "value": "4527341e7ba507c6034327633afdbe77481ab609f423ffd68a7ba2e00e35364e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693470508, "uuid": "c4cbbc2a-fc1d-4be1-b97e-ac60d97cd6a5", "comment": "Malware payload (Smoke Loader)", "value": "3959c216d13b5870cac5ee3a3631ec8aed81f28a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693470508, "uuid": "da69fa16-133d-44e1-a6b4-53e187b98e43", "comment": "Malware payload (Smoke Loader)", "value": "0457e9a2a75d8cc9c1aaaf76cd78d97125fda9350acfc5c5b6cca218728eff3df7dee19fb0297d53216416faa5576eda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693470508, "uuid": "733a0f57-12f6-4cbb-aa43-2facb3e4212c", "value": "T17134BE227391C073E1234A744E71C7A15B27B8B14F6269CB2B866F7E1E356D1CB3835A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693470508, "uuid": "c0d00557-852c-43a6-a0ad-d5e1a4afcbad", "value": "408eea74fb8a6eff8fb7e9e72f28047c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693470508, "uuid": "72a6ba3e-e2da-4294-86e0-22e20cddacf4", "value": "3072:LbOvmarTI9PtgR2Rp3Vsd9rjP4uUDruSGAs+neBo0ymQfO:Wv2zgROp3VondUDruSC+nko0ymQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693470508, "uuid": "bd8b18f2-556b-4a90-9dc8-6737f3352c1f", "value": 248320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693470508, "uuid": "723bd98a-e590-4345-a524-eae9d9bac204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693470508, "uuid": "c68e0a1e-9bc9-49a6-8a4a-bdd4e0f540cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d466205-479f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693446082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446082, "uuid": "e40b2e2c-8c53-46b4-8866-e7b293561d64", "comment": "Malware payload (Mirai)", "value": "d08e325d88f9ca44792cb65623ed6130", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446082, "uuid": "9fa1d5ac-a545-4d59-a5a5-29d906fc3633", "comment": "Malware payload (Mirai)", "value": "4d014d98398b5673d647d1a53d460c56530441adf3f6fbfc713456538b19de65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446082, "uuid": "f6ce2b9e-74ea-4b34-ad9d-ac096149ac4c", "comment": "Malware payload (Mirai)", "value": "df92f7720e302e7d021c774332a28ecd38a28687", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446082, "uuid": "a00b9f06-1d9f-4765-8edb-9d4346bb9c36", "comment": "Malware payload (Mirai)", "value": "02d69e379ebb20262ceb00480be9272c655f293998ac243d438d674790427808c8a3991a110bd2ed1d8d2d5ad2f13bab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446082, "uuid": "2f91acc2-a080-44b4-ae5e-2259f8202cfd", "value": "T1A982BF7D72D9A522C570503FCF2CCB4123E786FDA2FE7722611506E5A75288A427EA82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446082, "uuid": "35fa2ff1-fa88-47b0-b932-390ee55b1e77", "value": "384:MEMJcxMwYgsO0WyBXLZAJgn1ax6Z1+VLAqvHEBLlxXiWtJnqhymdGUop5h5e:YcRYjO0WyuJgkx6cVIVHjhqs3Uozne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693446082, "uuid": "3f96446d-9e2e-4095-b064-2a9f901b8166", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693446082, "uuid": "5f9d424e-ce14-4aec-bb5c-6ec40912810f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446082, "uuid": "614c59dc-77a6-4251-b80f-65c290d66712", "value": "d08e325d88f9ca44792cb65623ed6130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d030bc1-479f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693446108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446108, "uuid": "d4cb07b5-5f3f-4331-a38b-fae8a5a584b0", "comment": "Malware payload (Mirai)", "value": "33d89f0c42ec1e5962fa800e43ce81c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446108, "uuid": "5e5f6b15-3130-4079-b820-e8a5902bbbfb", "comment": "Malware payload (Mirai)", "value": "4fa06e4b72aff6411db28f32ca2cfe2eecb7f50c7b1f629a959c70a818a91609", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446108, "uuid": "5666b550-1853-46b8-a527-346c882c6a75", "comment": "Malware payload (Mirai)", "value": "582c8a84763aa93e40933a9fa82637370456a62a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446108, "uuid": "eb5de947-6055-48e9-9034-be113688cbbc", "comment": "Malware payload (Mirai)", "value": "32da0722000f1bae3b46fffadd591e89e2f78456dd1729324e9beab9beb523d4eda893b60fc7d431ceb5c5690733f54e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446108, "uuid": "5dceaafd-3082-4ff7-9bd1-7cb5250eac5e", "value": "T144C2D1A47464BDD2C9306C76DA688CC6378625BC90FFB87751210D24AED58CF5BF8287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446108, "uuid": "2562d74e-31f2-410b-bf04-46920f5b18c7", "value": "768:cMKyhegCCMqfN11zqcEobtfUxYaO1z9q3UEL3h:TKy4qf7ISPaxLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693446108, "uuid": "d2ee05a8-c043-436e-b216-929b11aa6de0", "value": 27292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693446108, "uuid": "917a55ce-7794-4791-af8b-db157a1ee1aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446108, "uuid": "cad9116e-170d-42f3-8343-b7d497e16cba", "value": "33d89f0c42ec1e5962fa800e43ce81c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc14fe1-480f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693494265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693494265, "uuid": "d5fd9b40-cdfa-47bc-b806-f5de2f89125f", "comment": "Malware payload (RemcosRAT)", "value": "c31642b1ec5a94cc0bf53a9cb42626ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693494265, "uuid": "f3616b50-2885-402f-b214-72aae0fb62de", "comment": "Malware payload (RemcosRAT)", "value": "50360abbc508d169cda7d1a79ad2032827b553f0b9ed82c7b1609d074c20a112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693494265, "uuid": "ba74b1e0-10e8-4ff4-bff8-2140e7a85516", "comment": "Malware payload (RemcosRAT)", "value": "7779b68a57e11a60706bae1156b5fd7d4d6344ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693494265, "uuid": "b4870b1e-3b7a-4d6e-8fc9-a5550dc011bd", "comment": "Malware payload (RemcosRAT)", "value": "faa1660d8d26017c2ceb30b7ffeda22b64a84eafa8f023c751d9206c7ab44c45389558da79c5a17ffa9e1e2b4fbda01c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693494265, "uuid": "22712c86-27f1-4b07-8649-567c3f0f93e3", "value": "T1BDB49E01BAD2C072D97514300D36F776EABCBD202825497BB3D61D9BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693494265, "uuid": "62051ec1-fb34-4323-8c3c-07c478ab3be9", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693494265, "uuid": "5c433321-672f-4186-acbb-054da746e198", "value": "6144:wu/TwNrjB5ikgxx+bdPoWYnRmCgEVAWK9goN1dFv/xpM9rsAOZZpAXNc7Jbv:wu7wNB5iedQ1RmPEVAWONjpcs/Zp9bv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693494265, "uuid": "7ed746a5-13ff-476b-bbaa-2d771b7acf40", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693494265, "uuid": "20a71640-313d-443a-94b4-39ac2176f905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693494265, "uuid": "4f9da71e-4db6-4776-9940-14968c5a9a0c", "value": "xcT2F1D2owcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a60750-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693466393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466393, "uuid": "d22c4d5b-ecd2-4551-bf21-29cd1de463ad", "comment": "Malware payload (Mirai)", "value": "167a515ddd77c0de7a393e5494a93925", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466393, "uuid": "49a991a8-8fd3-42ad-aeab-aee9354e5e4b", "comment": "Malware payload (Mirai)", "value": "504ef0f10a277f111cc81e6fa77e6cc8c996db10e64dc117ab83b9a3efd3b6da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466393, "uuid": "1915f1ff-10ae-4bc4-a413-15643dcab528", "comment": "Malware payload (Mirai)", "value": "95744d736eed4f2c33a37118f5a3238dd5bdd08d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466393, "uuid": "95dfa8af-9302-4552-99cc-98ba156eb064", "comment": "Malware payload (Mirai)", "value": "084ce615b07b0a9115af2029b89de145d58f7b1649c879b1b714d3f2488f96ae9f72b6b3f058bf63c33145dd46dfdd97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466393, "uuid": "8702167b-a936-4fe6-b35c-a4c194b56170", "value": "T12A21CE66E2D9ED72DA2600F652C6AF971395CE906827FF0BDE518802ED3E1D0D133278", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466393, "uuid": "3bda8a90-81b1-4a62-9307-03e39c9acb1e", "value": "24:FlmbllMHCFHxgxEmceZGQleZ3eLinvQymBwyGues9OfruQKl7IvNfY:fmb/N+coGQlo3eLinY1FqssjHC7IvNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466393, "uuid": "122a507b-8b81-404f-aaae-c70dd08a50d6", "value": 1192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466393, "uuid": "96de0802-1f73-45ec-97a1-c147d6f9285b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466393, "uuid": "951f2e62-e964-43e5-9a5b-3bf5b9645c58", "value": "167a515ddd77c0de7a393e5494a93925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f11d4c-4841-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693515621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693515621, "uuid": "d189b3e9-ffad-43b5-8987-278d1ce59ca7", "comment": "Malware payload (Amadey)", "value": "21c1f6df8ba022cfdd035e73a8d08c27", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693515621, "uuid": "7cf21e1b-c36f-430d-a604-77f9613b92df", "comment": "Malware payload (Amadey)", "value": "50d310da2edd70b2d2a4f99e0cd8967b5834772a08e9f3cdf8f6600b6b68b611", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693515621, "uuid": "f068f2d2-32a5-4b5f-a5f5-6ef932565bd1", "comment": "Malware payload (Amadey)", "value": "1dfd811cd417d2db2799a44986261a71f2739593", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693515621, "uuid": "8a472b98-d0b9-4358-8d27-33b05ef26f80", "comment": "Malware payload (Amadey)", "value": "4d557480b1f05688bf6581e3073dbce6b8407ba2844e88008f4dc89d7d9dccad518deeed70c46499ed08111251cf2227", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693515621, "uuid": "c3401927-af11-4fe2-a17e-6dbb5b947784", "value": "T18033F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693515621, "uuid": "d1df51d7-31ae-485b-9841-951a08972b59", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693515621, "uuid": "70731d95-352c-4a87-96a3-b7d4e7c5f5cb", "value": 50417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693515621, "uuid": "c5b56197-aad9-416c-b543-beacbcb576f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693515621, "uuid": "46cc36f1-836c-4f69-9913-642012db80d5", "value": "21c1f6df8ba022cfdd035e73a8d08c27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ea4845-484a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1693519492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693519492, "uuid": "64e10489-81ef-4b04-9cb6-a9fa7366800e", "comment": "Malware payload (CoinMiner)", "value": "97648ff2a92feb6f769b111b23e1e0e6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693519492, "uuid": "30208a5b-4e57-4bc7-a318-34b5e41eb4c7", "comment": "Malware payload (CoinMiner)", "value": "50fe514215087ac95cf255b68976245b35ee2a3c65d9d4a8a01bd3eabad21e5d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693519492, "uuid": "ca93557f-1b0a-4e1d-88e4-31ae8c7c1c4e", "comment": "Malware payload (CoinMiner)", "value": "4a9dd18ab12b53f48bd04b0df4b25e218275cd51", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693519492, "uuid": "71a4e745-7744-46f1-87b1-458633c31221", "comment": "Malware payload (CoinMiner)", "value": "66c5fe33daa608f77b8bbdd51ee51586bbb0b3e063b4c51055540b099a48a22e75ac51eac9d3cb983707e41f155cd51c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693519492, "uuid": "5903f8b5-3e29-456b-b36f-6179d650d663", "value": "T12C56D0D5640C42E3F43F88BAE09205DD1B0FADE7079648AB76CDB9E0C66C5A8BD9D053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693519492, "uuid": "110e9faa-d2c2-433e-888f-d4d2fb047224", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693519492, "uuid": "1d09c721-b9b1-4f9b-85e6-b75dc94f7d50", "value": "98304:zwUMzk8dnriGmzZzR/9QOIofvCuaiJq14P9:z0ziNl/IduTq14P9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693519492, "uuid": "baec2f33-9a17-40ce-968d-6b46f11fa4a3", "value": 6029624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693519492, "uuid": "edd63166-5561-4b3c-b9f4-206a7122ece4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693519492, "uuid": "836d6f32-a367-43f1-a420-2256a35efd59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eeca6b4-4845-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693517193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517193, "uuid": "40f563f4-982d-45f9-bc7f-e1cb21f4c8bc", "comment": "Malware payload", "value": "26893a46de61332fd08820d5dc56cd19", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517193, "uuid": "2e9856ad-9af9-4ce8-903f-f724cfe5f509", "comment": "Malware payload", "value": "5305b8969b33549b6bd4b68a3f9a2db1e3b21c5497a5d82cec9beaeca007630e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517193, "uuid": "9c52d6a2-26f4-42b4-82d7-99fbdf4aa4a9", "comment": "Malware payload", "value": "f446cbbfa04ec856431938d4beb408de4528865c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517193, "uuid": "0f15a481-f363-4224-a0ef-ba3c57bb71a8", "comment": "Malware payload", "value": "38f0c86702d23052b45764dcdb788e5c4f7ed6829bc16d3b2e04642cbd2caa7f7bab84a381d565ae46981d27cfcffd97", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517193, "uuid": "8d5293c7-230f-4018-81eb-ed22e9dc80be", "value": "T13244138979AF50EE0EC1085D687FDD590A1D6868DEB34A70026CC27FEA90DDCC7D2A4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517193, "uuid": "2be6c2f3-a000-4475-ac57-9f8ea9e7aa67", "value": "3072:PhxLTtzB8idj7wRBMvmbVLWYuRkLXJaXfJw5JEndyhtfZffqGBevDhb6imfMGsjW:PFXjmsRkL00JRtdyz71KBgASYUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693517193, "uuid": "13454a46-25aa-4f9c-b596-eed4737265e8", "value": 260126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693517193, "uuid": "fc5031aa-63e1-45d7-8a92-977ccb9f8425", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517193, "uuid": "67134fc6-0a21-408c-afd9-8ee82bea1b2f", "value": "MTdYFp.au3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb835ef-47e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693477969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693477969, "uuid": "faf74a2d-7c8b-418f-b1f6-770bd7ae92c3", "comment": "Malware payload", "value": "76351b5e3b9487b0b39759dbfea5f0c9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false }, { "name": "signalplus", "colour": "#A67812", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693477969, "uuid": "818b0439-0178-4f7c-9767-c803b95d7f1d", "comment": "Malware payload", "value": "549d726fe2b775cfdd1304c2d689dfd779731336a3143225dc3c095440f69ed0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false }, { "name": "signalplus", "colour": "#A67812", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693477969, "uuid": "9d47aaea-b547-4586-a710-f4fab703772f", "comment": "Malware payload", "value": "19e5cf2e8eed73ee614b668bc1dbdda01e058c0c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false }, { "name": "signalplus", "colour": "#A67812", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693477969, "uuid": "76839be5-fdc3-4812-aaf3-a921f0d2587f", "comment": "Malware payload", "value": "2efef73290f2c1f8f5f10f07e846b2f5528c8ad106b3fe30ae9ade2e6b3a8e4f5d24a5026e1e6800fbd63d82aa7b2874", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false }, { "name": "signalplus", "colour": "#A67812", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693477969, "uuid": "69d0fa0f-39fd-40b3-bc92-4cd74d51a19b", "value": "T10408F1855368EE21CD7049B6050D3A3657752D30EA83D3C6982CB3AE7CB7AF04E19BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693477969, "uuid": "d75ada3f-4fb5-48cd-8a65-a97fe5382a7f", "value": "1572864:U/u4rrAgdZh87ZlyFLSnI8LcejgNtwQYpxtIwTJSzslunYuTAO:UOIeZBI8LHUUxlT4YlSjTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693477969, "uuid": "a1027ee5-cf0c-4bc3-b952-bffaae45dd2a", "value": 82911279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693477969, "uuid": "f1c10718-2273-4068-98a5-5117a4236b4d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693477969, "uuid": "01b4bc7b-e35b-47b0-90da-7ffe2e54e0b1", "value": "signalplus_released.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f493c8a-47c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693463104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463104, "uuid": "29853d05-10c4-4864-b4be-53e0edfb67d2", "comment": "Malware payload (RedLineStealer)", "value": "9e0eec40d47d21cc303f12bb5daa525f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463104, "uuid": "c119b10f-edd3-475f-9a01-16e2c63fd4c2", "comment": "Malware payload (RedLineStealer)", "value": "56605fd48a223693a2b4862e816a11a0b55b899a5f64db47e09696825efa1b63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463104, "uuid": "69fb8c78-787f-485f-9b83-21ceb4ae5371", "comment": "Malware payload (RedLineStealer)", "value": "7fcb2faaae8d9f695d7d06ecbc9716569a2a3444", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463104, "uuid": "a91cfa1e-fe55-4e1f-b2dc-55e1d9fc3500", "comment": "Malware payload (RedLineStealer)", "value": "28db6f792ea449a7bc8ce5cc3c95fae05b2ad09bb017ee32caa8c96973320d509af91dc16069032ee3d056d5ebf4bbf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463104, "uuid": "23b1de28-d554-466f-ac75-2e82fe524aa3", "value": "T178152213DBD9407AF9F117B04DF247970736BC226CA5C72B13829A9A1C73688E636727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463104, "uuid": "ccd69fe9-a22a-413c-a858-9a8685355e30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463104, "uuid": "b5647d5b-ef9f-4494-af26-833e041db1d4", "value": "24576:eyeVHynbWiUSxiU9+z3AkrwqHuy/AJMd5:tQHynbWiUrzHk9y/AU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693463104, "uuid": "245fabef-8513-4aa0-be68-bd716351b763", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693463104, "uuid": "441b8e5d-282e-4a0b-81a7-6671a8cf5f71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463104, "uuid": "7a4e5ac6-7b8d-4ac1-85d8-2147697e60cc", "value": "9e0eec40d47d21cc303f12bb5daa525f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b0c8ac-47dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693472314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693472314, "uuid": "cc5329a0-2fbe-4f2a-b3da-0383387f7c9b", "comment": "Malware payload", "value": "c1eeadd130a137b84dc3888d460e4958", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false }, { "name": "flygram", "colour": "#E9C7F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693472314, "uuid": "d1744739-ee68-467b-9120-30f35bd36d53", "comment": "Malware payload", "value": "566347dd1bc97934b1d4987c410cdd88c65374054ec9f0eea4951dd7401819de", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false }, { "name": "flygram", "colour": "#E9C7F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693472314, "uuid": "e904f907-5809-4232-9f6f-b4b39fa17c0a", "comment": "Malware payload", "value": "77921faff08dfefe93002f14839c55375e2a8e7e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false }, { "name": "flygram", "colour": "#E9C7F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693472314, "uuid": "5e5f4db1-9408-4559-a2a9-e5378bb892b1", "comment": "Malware payload", "value": "373e61677c65c32d6e721f183e1e2cd53266c4ba125a517641088bf4bf2035248c97778749b6547f318ebf4f1b15a028", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false }, { "name": "flygram", "colour": "#E9C7F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693472314, "uuid": "e990dd67-cc9c-4ec4-b9ce-22c969c30a7e", "value": "T14D8712D773C46960C136817786753062B76E4DACFE06E2E1640CB63DAEF76D08A81BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693472314, "uuid": "0a964585-0706-46d4-8a76-a8cde000f190", "value": "786432:P8cZ3R6RHiwfrmkKYMLj+g9pAmbm+60fgMfranpB:kuB6RCw8XLj+g7bm6fgMf2pB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693472314, "uuid": "dcf7249d-a7ef-4f70-b1bf-32448fcb7258", "value": 38798352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693472314, "uuid": "1ea96f59-fb31-4fa3-ba55-b0b02e86c0e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693472314, "uuid": "d0fc506f-ab73-42a9-8d80-a3d9e8467712", "value": "FlyGram_7.1.1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca756c23-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tsunami)", "timestamp": 1693466398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466398, "uuid": "7430f759-4cf8-4c7c-9fd2-736108d0d618", "comment": "Malware payload (Tsunami)", "value": "b02f3e869c3f6db1a16c707bbefc33ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466398, "uuid": "eec55dbf-592a-4521-bf8f-e1bfa2d1f7d7", "comment": "Malware payload (Tsunami)", "value": "56aa516cb6b3cae5c0ef4da08523024e245405656c4ef234ebceaf99e7c60acc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466398, "uuid": "95b490d7-8171-4c35-9457-252b15517ded", "comment": "Malware payload (Tsunami)", "value": "e5359d488c0936a503e899e1a6cb93b28b82e889", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466398, "uuid": "ac28a978-b98d-4164-b5b4-ac41c1ef5e92", "comment": "Malware payload (Tsunami)", "value": "4b0d39b01da136c4bfaeb1903e014c5efa9311e1e902a06b9786362cc26c4a7e546af4fbad7fadb7398f963fa10661c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466398, "uuid": "ef341382-670d-4305-bbfa-b9694f99789d", "value": "T168F2B985D9A9923FC7F176BAE74647AFA3794A98634B3337B23C0554278170CBA30660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466398, "uuid": "375f01f6-11cb-4ac9-86fe-3f16fe99995f", "value": "768:qpXrm5Rfut6DRxyqHrgt80FD3DO+VXVUx5vpiCBJf1:J5Rf+6HHrg+kDzO+Xa5vpF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466398, "uuid": "301aa037-c4a3-4ea3-8759-634c3490c014", "value": 35671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466398, "uuid": "94ff8289-d6ae-4bb4-abaa-497f0aa852e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466398, "uuid": "b29cec0c-dcb9-4c56-868b-f15badc74b6b", "value": "b02f3e869c3f6db1a16c707bbefc33ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956b003b-4837-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693511406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511406, "uuid": "340a0c70-48b6-437f-b915-aa9fb8b7c476", "comment": "Malware payload", "value": "33e0237c168564a08e1e8a16bee15c38", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511406, "uuid": "ffad1d40-8ad4-4e89-9f47-13da32b4d7f9", "comment": "Malware payload", "value": "5747dd8b1b26717e8b28778fe381ed7231e159e80b1330af3870ad6ca549a281", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511406, "uuid": "20f934ab-3601-4735-9a1b-7979d8844617", "comment": "Malware payload", "value": "9e1540b7d729ff8670502f26daf4e0f9d975c210", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511406, "uuid": "a0a1f284-b2f3-475e-a0a5-1931dfb01974", "comment": "Malware payload", "value": "961493b5cb8aa049f957d1f1f871dba3b50e5335f445e4a6ecd32171c5fd77d161b6378fe5eefddd1b77fb95e71cc8dc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693511406, "uuid": "84062178-0942-4828-9fbf-3e67217b4cf1", "value": "T109E2E1206F4174F2E5E00573C98F834B7A94657E2C9732F82E408E3955D94B19B66FCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693511406, "uuid": "32df0284-20ca-4e6f-a427-e3b256f94d6d", "value": "768:yFuc9XP6mAjcJHPYfkAuLU3x14kEHwC+W8YI63U9:yFucJAcAsAZHEQm8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693511406, "uuid": "94457210-b3f0-46dd-b2bf-34c5c94d8d3e", "value": 31904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693511406, "uuid": "60dddfd1-fbea-4bda-89b6-0fefedc69587", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693511406, "uuid": "94fe45a6-f266-4e26-89f7-7dbb09e33f34", "value": "z0r0.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60467b5-47ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693480215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693480215, "uuid": "548d00eb-764b-4886-9bc9-055922631d14", "comment": "Malware payload", "value": "ae4cdda2c0c9bf7a67083a73e350cc03", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "evilmalware", "colour": "#FB8213", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693480215, "uuid": "519b9ee8-4d5c-4f8b-a4f8-e39c599fdd3a", "comment": "Malware payload", "value": "599197d03355a0a039d2b1c906bfca9baa2e9e18c7e0413a796e1543af44e9a8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "evilmalware", "colour": "#FB8213", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693480215, "uuid": "3f90aa6a-b85c-491a-b1a5-bb2c9901d9ff", "comment": "Malware payload", "value": "e0d2267dd7012e194c91afc32c46fd37be231f72", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "evilmalware", "colour": "#FB8213", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693480215, "uuid": "f23333ed-61f6-4226-8359-361e55620011", "comment": "Malware payload", "value": "cecaca76472e5bbac5115c63c5df521950c5602b1e478b8bf93e24b8a8f9ae8d3cfcdb16b032cef4213e8082e9c298fd", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "evilmalware", "colour": "#FB8213", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693480215, "uuid": "ac76957f-dbbd-4439-bdd1-d26c4a17f11b", "value": "T104B0921064B7A402D2A221845A8A4B408244ADD3A0804322304C0527D80A208A06858A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693480215, "uuid": "ab054bcd-658f-4305-8620-8a998a1a1554", "value": "3:1TEEcoH+fyM1K/RFofD6tRQMc7QLlGswhyov:1TtcoH+H1MUmt28tU7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693480215, "uuid": "a6e20e6a-6fc6-42ab-bb73-470e425e0e86", "value": 96, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693480215, "uuid": "502f362e-5c6d-4129-ae39-eae1ececb5f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693480215, "uuid": "b9a44700-8dab-4024-ab80-4c9ab16fd099", "value": "muhahaha.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2293985d-4794-11ee-a6f9-42010a9c0055", "comment": "Malware payload (TeamBot)", "timestamp": 1693441205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693441205, "uuid": "a4a1c28f-1c5c-493f-88fe-ceb5a5614213", "comment": "Malware payload (TeamBot)", "value": "7d2ee8005860e2ab30712e5c7eb8a67a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693441205, "uuid": "d1c92d46-47cb-4003-ba0d-0aa47922065e", "comment": "Malware payload (TeamBot)", "value": "59fdd1e9781d0d78485f7ad135cbe931d57c78b1bf5ce756dca849934d0254c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693441205, "uuid": "1d33443a-f8d4-4ce8-8ba1-c57c2a98981b", "comment": "Malware payload (TeamBot)", "value": "7ce5919a4edd408557922076c2b4f29b826fb003", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693441205, "uuid": "a46c2090-b54b-49c8-ab21-3dd2f2acf5cf", "comment": "Malware payload (TeamBot)", "value": "2283b62fcc25e78dd36b09bdf9cc30fcde045fba2dbd444ccd2568a42ab6062676970a2468de00c3c6bbd3df69cfe7a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693441205, "uuid": "b220f260-c2c5-4db6-939d-063a64e1e0dc", "value": "T1DC34CF12B7D1C073E15385344AB0C6B25B2B7CB18F7269CF6B845A7E1E322D1CAB535A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693441205, "uuid": "eb20973e-dbda-44e5-9665-6416e1df1b46", "value": "41d923d5264f09b72d8fee2476f53c41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693441205, "uuid": "f198c7b4-1c44-4ac3-95c4-505eb727cf82", "value": "3072:HiDEEz/fztBEgIvsByWeEq0gLVqmmSzZeuwBNFP3Z3ab4uRfOaZY:BElBEsBdq0cVmIkT5ahlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693441205, "uuid": "eebbd4fa-3f84-4b06-adc5-e53582ff46a5", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693441205, "uuid": "72c85cda-c6ec-448d-bea5-06445f6c3330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693441205, "uuid": "6a6d71e9-f8db-43ab-8c8c-328599a79ed7", "value": "7d2ee8005860e2ab30712e5c7eb8a67a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c086e6f4-4824-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693503318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693503318, "uuid": "e9031f06-a86d-445f-a8a0-220a800cc7d5", "comment": "Malware payload (DCRat)", "value": "0cfb3be6c52ddce05ab1192cbedce6bf", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693503318, "uuid": "a5a3eac9-4aad-40d2-847e-476535c79aad", "comment": "Malware payload (DCRat)", "value": "5b5a234c61786cd4fbd79d451faeab7a784a63d0f7ca178d872e07ac26e8707b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693503318, "uuid": "be533531-0345-4ce3-b327-58094c1e6046", "comment": "Malware payload (DCRat)", "value": "49cb372a360bc1b211ce89fcb9abda131858974c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693503318, "uuid": "5a264e50-e73f-47f7-bbf9-8c802a6fe707", "comment": "Malware payload (DCRat)", "value": "8208a648d724bd7926330cdc182556cbf006a85fb475dcf73ce2e0118cbe3f8db9e9c50dad8dec8fd876c5145ba7aad7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693503318, "uuid": "1da1ebff-da92-4dc3-9bce-d0c260b70c6c", "value": "T1D0B5C0027E449E11F81A1533C3DF0A4447B09C92A696D7173EBAB7A929173973C0DAEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693503318, "uuid": "66320c9b-6080-4ebb-aa55-65580d5dde73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693503318, "uuid": "af74e8a7-6284-42b0-be8b-d591448034bb", "value": "49152:TNdtFpG3kioLsY/emNF3RFLyVHVKwv1a:TNx+GsIBF2NMwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693503318, "uuid": "1a675ab1-32b0-432a-99c9-e3b91af5990d", "value": 2403328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693503318, "uuid": "7a2626b6-95e9-467e-9f7b-5436be2ed3e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693503318, "uuid": "9709731e-cd88-447e-9b5e-59f91254dcb5", "value": "0cfb3be6c52ddce05ab1192cbedce6bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58f5603-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693466362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466362, "uuid": "b2b2a811-a0ab-4e6a-b5f6-65524d07b31f", "comment": "Malware payload (Mirai)", "value": "00ff213f992856d8dd3779079afe79f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466362, "uuid": "d002dbef-20e6-4b17-8000-14cbaae92b5a", "comment": "Malware payload (Mirai)", "value": "5d5d8b117e105f61e082280db39bf48809e455d0c5efc9d36f99d5e7f55d251a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466362, "uuid": "cbf3e900-3224-428b-8df4-9563edd8901f", "comment": "Malware payload (Mirai)", "value": "98f07d0c0b7782faf12354527dd3d9c9ff72bfbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466362, "uuid": "4a350757-2195-4bac-8d4a-81009b3f87e5", "comment": "Malware payload (Mirai)", "value": "58a1e65b6efc46bdc955cdee6196aef7a354d4dfdf9f115793c2ad6a5692ac2b8921f94d6f2ae346d9ac515e0451638b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466362, "uuid": "13206fcb-8aa7-4e50-8faa-157f272f7fee", "value": "T12331F19156D05D7CCCD491BFAE56432073649F40E0CB726392187B15BE2AE785C2744A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466362, "uuid": "1c53c9c4-ef4e-412a-98eb-3a1af67b6d05", "value": "24:FouKGpa7Urz/jlf/NOXK1G9Vev3gRGH9iMfBBumKOHlxrR+z3LNs:fKGpa7UrLZVNRzZBuHKlxrs3LN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466362, "uuid": "84deafad-d927-45fe-904d-c0c8314d248f", "value": 1464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466362, "uuid": "5977863b-1b46-44bb-862b-44b024ca4aa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466362, "uuid": "e65f522e-5a6c-489b-96f3-e33f2468add9", "value": "00ff213f992856d8dd3779079afe79f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6625ed-4807-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1693490855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693490855, "uuid": "e35a9ba1-7a06-411c-b149-905e88c05963", "comment": "Malware payload (Fabookie)", "value": "252403625ebdffcfdbf2abdff6c5a5c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693490855, "uuid": "dcddafab-8c66-49e0-9ce2-dee47a65b19a", "comment": "Malware payload (Fabookie)", "value": "5e38065e155cba0d0aa56b219159c33d0dc5a3beeef4b31628f0a6c3ced7b1d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693490855, "uuid": "ce9815f0-c010-464d-85fa-441d926ce924", "comment": "Malware payload (Fabookie)", "value": "4fc73ac5579d4599e20857b5ff50a723b2f914a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693490855, "uuid": "8bb26bed-52b9-455e-8082-5882e83d397b", "comment": "Malware payload (Fabookie)", "value": "cb3f0a60227be9c9bf15c588b8b1ba0bdd07f8f8bb315a188544248837b9ad6c8b4c589358e5231a3e02cacc48e2205c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693490855, "uuid": "8f5ad4b9-8ace-4277-8bb4-a14af9a9da68", "value": "T14D84DD64F0B2ECB3DA126B7039FCF91C91AD71551386869E365AF0B692D330031DDBA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693490855, "uuid": "a7227394-c06b-4dcd-9a2c-17bd2f94eae7", "value": "96cc98468ed325b3857363887597bc67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693490855, "uuid": "b9da7daf-8b1d-49fb-a931-166e74920b96", "value": "1536:9yK9MVjVtuOCWqeyGaOi2K+Sm6uCWqe+aOi2K+Sm6uuCuCWqeyGaOi2K+Sm6uCWt:9X9MxugE+nAYy4AZ6DvcgJFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693490855, "uuid": "5d07ac83-e4b5-4a26-9605-b104eeb0494b", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693490855, "uuid": "161e8713-fcca-4f46-8f42-e1115e24e647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693490855, "uuid": "f3369843-d842-4823-9958-c3ad11e7ada9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a90ffb-479f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693446096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446096, "uuid": "9b875c81-8f40-4aca-8de4-382d59e8aa8e", "comment": "Malware payload (Mirai)", "value": "510bd53223a1af8ab5e496d7757940f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446096, "uuid": "11b01230-c46a-4053-80b3-d79781019f94", "comment": "Malware payload (Mirai)", "value": "5e711642d8bba8f8b7d43ab145016faa62b19d61381929460e8459fc3733bcd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446096, "uuid": "8353c2ff-4f6a-4545-a7e8-eaddebbea00c", "comment": "Malware payload (Mirai)", "value": "acb7449f93bc8e127d3b0ea3d8bf982330ec0419", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446096, "uuid": "e03b5c6c-65e5-42e8-8697-6183f78eccb3", "comment": "Malware payload (Mirai)", "value": "5043f7a8b4c20d6ee899054843dc6c3ae610756cd3389a2924db2a92d43cb8535523783a1c95614125981cc035343647", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446096, "uuid": "2f14c74c-f29c-422a-aadf-e243e31c3ff7", "value": "T135336B36E029DED0C5960234A4E88F751F03F1C893536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446096, "uuid": "8c771104-5c19-4be6-b1eb-bf7bb94e2413", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+ydZCZQoVjfjmCozw:Oa4U7G7SvT6ftBTydZKVHmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693446096, "uuid": "90f3a1e8-eb4b-4b32-9150-bd1426c35117", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693446096, "uuid": "27860dc3-379a-4448-a146-3505df1bcfcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446096, "uuid": "76e17928-c843-441f-a415-28a4efac4341", "value": "510bd53223a1af8ab5e496d7757940f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c56cc0-4837-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693511403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511403, "uuid": "b7a00d7c-2444-44dc-83b0-b540f196c0a3", "comment": "Malware payload (Mirai)", "value": "fb3ffe791bdd4817ed5bd97e3f99988d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511403, "uuid": "03563c6d-552a-4f57-a9a6-8d49b70bff5f", "comment": "Malware payload (Mirai)", "value": "6450515cb8a92ff642be37e41f37dc30cf87883ede562d51ef99819969b47372", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511403, "uuid": "786c3f86-c3e2-46e3-a900-55cd9587a1fc", "comment": "Malware payload (Mirai)", "value": "ab6ea3101a621d96f72dbbc53c0c8bec9e887b49", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511403, "uuid": "7847ceb2-f7f3-498d-9723-73d8e35d5905", "comment": "Malware payload (Mirai)", "value": "8839d460ae1f6fe71c12255473c7ae2930ee5c8f6630ff62ec9d0588638b7892cb57894c19633ed8e26b57f8a2a0bdd9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693511403, "uuid": "2d57ce9f-53f1-448e-8792-0a4969c213f1", "value": "T1C94302525244F5E3E6BB4876E7A98DE332702EEC68FA5731310795B10F1E203A42C38B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693511403, "uuid": "2b4184ad-408c-4a9f-a429-f99831f08e7a", "value": "1536:Ur+Bo2reaPtNZFOu8eQCGeA0NLm6qoqj9XXm:F1qaPtFOu8xApx2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693511403, "uuid": "1be90a76-c69b-46f3-923f-fe5ff8ee652d", "value": 56068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693511403, "uuid": "9e82a449-fa2a-40ce-bb36-6f4fd195c537", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693511403, "uuid": "7ac98f5d-81a2-429b-9373-edf190a6bb29", "value": "z0r0.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5412a7-4839-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693512441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693512441, "uuid": "cfd504ea-0c3d-419c-9fbb-a04677ffed00", "comment": "Malware payload", "value": "e06dfd9d4bae167b3311236ae17aced7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693512441, "uuid": "56ab572e-d789-458b-8f7b-02726c6337c6", "comment": "Malware payload", "value": "6967f1a5da12f10eb491bdbc40f6242c957326c41202883e7d1563a4a0e58ebd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693512441, "uuid": "fb0ccb9e-9863-4a81-b257-3dab7728686a", "comment": "Malware payload", "value": "c69256664a113ab8930d67ff11498b1e6faaf413", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693512441, "uuid": "56fb7710-d91a-41b6-810f-2160f3b5b164", "comment": "Malware payload", "value": "82d83f999d48194d2831dd7ce928086a427b25aa5783117d33f0c691ef48f362bd200fc54552a22dcc979211cc980d26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693512441, "uuid": "19037f1d-343f-4628-90d8-261f9ac24aa4", "value": "T1A7733A4877F54A12D1BF0EB5897292220B35FC076926F76D09D174AA5FB36C08A09FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693512441, "uuid": "edbc662f-6c65-4751-aa3c-4d59f9775fe3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693512441, "uuid": "ea3a2918-b1e9-4511-bea2-a7ec55784f70", "value": "1536:lt4+6Y9yhU19DppS5wpOk3JCK6pFNyXd6fOpd/9nEh9TGWJ0R:IhU19QwpOk5CK6zO/9ESWJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693512441, "uuid": "c8315e66-73e8-4f77-8df5-d1cb618a712e", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693512441, "uuid": "51e1e83a-f91c-4eed-82fa-d5bb0f00cb1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693512441, "uuid": "71431cd2-285c-4a3b-947e-1bfd5fefe92f", "value": "bPti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfa550d-4821-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693501780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693501780, "uuid": "502b40e1-8ccf-4462-8c9d-a7b7c45f96cf", "comment": "Malware payload (RedLineStealer)", "value": "950485920ed55bfbdf42b29ba058c86b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693501780, "uuid": "73a5a55d-7f12-4227-a5d7-0b7290f63fc4", "comment": "Malware payload (RedLineStealer)", "value": "6a36a69986c3d9809c9aa206009a3b90bf470329655bb5a8adf47fba7a47e9d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693501780, "uuid": "d7da0965-60d9-486e-b457-2849daf8c29e", "comment": "Malware payload (RedLineStealer)", "value": "1e2ba353ce9b537c3b49c30734a4ac34ea401063", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693501780, "uuid": "65cdb9b0-e579-4493-9c49-f9cfbb03aa32", "comment": "Malware payload (RedLineStealer)", "value": "0908d689c0cb458917bda1847910f12203c8b2fce913cd669670d2a7485d5b5fb6d764c7ee7b6892449ef7031571f589", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693501780, "uuid": "4f88f3e3-4bac-4959-b325-d04f93675a7a", "value": "T116052342BBDD8473C2B467B129F602833731BD619A71D72B7A85D8560CB1AC4987373B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693501780, "uuid": "f63f7bf3-a2f9-4a59-a066-0718068b693a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693501780, "uuid": "b3e6548f-7345-41bb-995f-dd90471d152e", "value": "12288:7Mr5y900tQeET304UF4ElBTcPFlXy6cS/X+0F2d/9Um5LtwWwj0bkeDf:2yer05FrBmF4U+669Um5Jwj0b7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693501780, "uuid": "099a216b-4890-4441-92c5-9f3c100e8b8f", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693501780, "uuid": "a12e533b-c8ad-4bee-b96f-29d97276ce39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693501780, "uuid": "816f6449-fafd-43a6-af65-b5dcc21e838a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2425a44e-47c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693460535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460535, "uuid": "b020fd9b-bc6b-4dba-b0f2-18049a51f154", "comment": "Malware payload (RemcosRAT)", "value": "5f99eee968415ded76c49d8841f04276", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460535, "uuid": "78b7d042-464e-4c6d-a78f-148c0bb46a11", "comment": "Malware payload (RemcosRAT)", "value": "6a7e9302a2021b26270808b18e5701732e1f063bbe32223b6b1952852c86aa21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460535, "uuid": "d56b6d8e-eac5-474f-aa84-0cd19d3a2971", "comment": "Malware payload (RemcosRAT)", "value": "5871818f94cd8c5305a523c20666f3aec577899c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460535, "uuid": "55c58616-ba37-4d6c-8f24-a32e85ae289d", "comment": "Malware payload (RemcosRAT)", "value": "3d5a94417040ce45bb174ae44df27f3452cbd0140cc8c1af3f6c1c500494efb494c875549d30d199cd7505e86fb67f0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460535, "uuid": "328baa60-1094-4934-9f02-72010c89f825", "value": "T1BE75915440F75184D0ABA2BCB342B57542BA99A871BE0EC373C17A7D74CB2A2DE0CD5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460535, "uuid": "f1b1d720-6f6f-4333-b3c5-489b472e6ce1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460535, "uuid": "f01edb58-aece-4ded-a5f3-256769d03b24", "value": "24576:+DPTrJ9EPegxSA41yyhgD7pnhztkcJbyTxP67AUxlSizlYxKFz6N0:aR1Xg/pnhztxWxP6LSizl4KFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460535, "uuid": "b6fbbf3f-a542-4567-8bd3-e7fb9f9c4a7d", "value": 1592832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460535, "uuid": "7fbf2b96-9575-4b82-bd44-ee52c34b01b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460535, "uuid": "f0f8b9a9-2075-443e-8dcf-2aa03560c47f", "value": "HSBC TT PAYMENT INVOICE 201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c7c306-47e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693475163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475163, "uuid": "f9fabb06-9cc8-47db-8c4c-d95f8fb7355d", "comment": "Malware payload (AgentTesla)", "value": "b5248110fdda31e572cbdb7747c9a14b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475163, "uuid": "bb104547-78dd-46d0-8594-f3e442a534e6", "comment": "Malware payload (AgentTesla)", "value": "6b18a9db822375ab65c316e58b6418332f0517292e6ec7257469e722ecf4da2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475163, "uuid": "7c5f54b6-c77d-416d-9017-538708e1367d", "comment": "Malware payload (AgentTesla)", "value": "c31b6377c2e8cb0a4997f42a49875cd4f0277705", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475163, "uuid": "58217307-d776-4031-a9a0-598e1cb183ac", "comment": "Malware payload (AgentTesla)", "value": "5b19841e38cbd3a5c7192a5480481bf9b06b885ea3a1a5b99e18037192ed2382a4c2f037fc2086873279b72b7301fd9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475163, "uuid": "7be996c4-2176-4ec7-a269-bab3f5aa0ba1", "value": "T1B3E4230D93B41A13D9B2C3B9A491670007F5A715A322D23D2FF875E64F62F168C78A8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475163, "uuid": "62a6ff64-e82e-4fc0-86e5-879aa60275ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475163, "uuid": "ee03fbf4-e32e-41ac-a294-7742afb1025f", "value": "12288:bBfOZ1h5F+xCz+a9puLxXJMgs5yzjy4EvRBJDln:tWZJuZa9pG5c5yzG4EvlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693475163, "uuid": "bcee29d3-b032-4713-a8db-483e718f2244", "value": 675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693475163, "uuid": "08cf0bea-bb89-4dc8-9ac7-4c634718e66e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475163, "uuid": "59a0f503-6818-4254-a3c4-951c2e91eb6f", "value": "SecuriteInfo.com.W32.MSIL_Agent.FPI.gen.Eldorado.723.8119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63bfc30-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Sliver)", "timestamp": 1693466417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466417, "uuid": "34809b36-2878-4c92-98fc-b4b8978922e4", "comment": "Malware payload (Sliver)", "value": "670090338102dfe097f6e9561b069345", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466417, "uuid": "4236b2dc-de2a-4064-bf71-b1aea665afdd", "comment": "Malware payload (Sliver)", "value": "6c599434bb8bb0c1e15d1b40ca3e667630e19b7ad48b330591e220fee7722bb2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466417, "uuid": "935a2b8c-de02-4fc8-a131-de423ca17b73", "comment": "Malware payload (Sliver)", "value": "ee3d27cd9c5ca0372e8e6478e1142fc24df237cc", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466417, "uuid": "372c8c2d-9b1d-438f-b787-66f005f1d4b7", "comment": "Malware payload (Sliver)", "value": "fff94dd1563af566a845a8e23f1aeb49808a32945bd83b731322109c60fd591034abc76c93f2be3cd51f6898ad62aa78", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466417, "uuid": "491e8112-760c-4a23-88eb-2b393f7f189f", "value": "T1DE4633321B12E977E5FA19306B7C081567A43616A178A1E8CFE6D3E833B0DF1C7261B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466417, "uuid": "d1b38a5f-c052-4163-b703-0f5cec3d7abf", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466417, "uuid": "bdd94737-8413-4bc1-adf2-9c7421af0d25", "value": "98304:Os0YozIw+ngwV8GyeU3lyKk+lOwCSQIVLQofolfIBn9/gKIwnKqGii/QIeu9HQqj:xBw+bVM3ly8OUzglfIBp1nRIRyqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466417, "uuid": "ea9d14dc-4daa-4024-a35d-7fe9d269b543", "value": 5576192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466417, "uuid": "bf9e76d2-2371-4d4a-8f31-27de74cd0be5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466417, "uuid": "3573e4f5-2349-4d9d-82af-a6a6ec816c48", "value": "670090338102dfe097f6e9561b069345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60711b82-47bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693459777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693459777, "uuid": "8da260a7-e9b0-4019-b618-827c92553eab", "comment": "Malware payload (SnakeKeylogger)", "value": "8b0549e61ecd8ff995805d6f0b340047", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693459777, "uuid": "e2777c3d-6c13-4e04-ad56-61db93d86aec", "comment": "Malware payload (SnakeKeylogger)", "value": "6c814e2279602e44e7fdab17e681bcf0403177d8ca1d8101531bc00442e67a25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693459777, "uuid": "0111aa3b-68ee-4331-bab3-7f0674e2d34e", "comment": "Malware payload (SnakeKeylogger)", "value": "ee24c3fb8a8660151fd24c5cdcbc1333c3b8eabe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693459777, "uuid": "d5a6febb-b6dd-4f7a-a7fb-a8828a36dff8", "comment": "Malware payload (SnakeKeylogger)", "value": "5fb21c8a178b32823350774217e1acffd06201bc8023b64319716b5ca85464bff4cc3dad9e68c41a27490b5db5d84260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693459777, "uuid": "27a5dd36-7d3f-4e00-925d-e3447688ae0a", "value": "T11F752384D4049938FD5803F9D893EB7B292B2CE7A4A798A9DBF87E5F75B1054084F321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693459777, "uuid": "44ead929-7788-4906-be6e-c4448600c3f0", "value": "e74c8ae3503a17604f2a2d84ae3389c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693459777, "uuid": "bbeec809-b961-4e83-bc0b-8455cdb20494", "value": "24576:wvwf+qsxI0Ocl48Q+c3+xejfUI1TcbiMNQmI3Nj7ayulxCtOqVkFKN2aBXpX:wwmqsxI0OcCx0ejrcbBQPvtrVkFKrXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693459777, "uuid": "901110a3-2546-4304-9277-448131608160", "value": 1696256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693459777, "uuid": "3dab9426-9eee-4289-8d7a-61cffbf4ceea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693459777, "uuid": "b9afc914-4e8e-4a33-95dc-a4beb17859d6", "value": "SecuriteInfo.com.Win64.CrypterX-gen.15582.15147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3800a024-481c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693499653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499653, "uuid": "9a8c12f4-9ca6-4d03-afc4-b01d485ac612", "comment": "Malware payload", "value": "ad9c376764853cae40c80b4bd418beda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499653, "uuid": "6615f444-28d5-4bb8-893d-7301abcac9ed", "comment": "Malware payload", "value": "6c856d68e024aae191db3387100736df954993482be08db691fb7ce7262f34b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499653, "uuid": "76ced825-792c-40a1-b7c1-ae81191c0315", "comment": "Malware payload", "value": "27700bf3a93d1371664a790b12d789a1c422d376", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499653, "uuid": "0f1537be-30c8-44ba-8160-f8faf238d413", "comment": "Malware payload", "value": "1baa78555c155848d90997c675061a1bbdf1e3a03694e2271aa4c0f5a29ab763432b542dcd2e374fc7775d53aa1fdbb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499653, "uuid": "861568d8-42e5-460b-bbeb-b6fab69cae02", "value": "T1AA030889FD419A17CAC10277FB5F438937271798E2EE73039E196F21378B9670E2A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499653, "uuid": "818c2fdf-5c6c-416d-a082-f697413250ac", "value": "768:EfMGfkWuqKF2/zGEWUUpEMd5ZnsOd4JUnVv3waYv0sjI:eMgg2/iENMd7r4J6TYv06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693499653, "uuid": "20a611cc-e624-471e-82b8-8189d55aa8ea", "value": 40200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693499653, "uuid": "20b452e7-3bdb-46a5-9910-acfdef5d7027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499653, "uuid": "a90717f7-eb47-41a0-b311-20523b9f41f3", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.8050.31706", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd04cf28-4813-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693496064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693496064, "uuid": "ceaf80a3-bf03-43e6-b971-7190ad2cf24a", "comment": "Malware payload (RemcosRAT)", "value": "c7ae8055bc1392f458f9e984c454ebc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693496064, "uuid": "1ad15eb5-0410-40dd-8e71-8a7cb1e2a51a", "comment": "Malware payload (RemcosRAT)", "value": "6d69abf704c0ac0c71d7d35cc0eaa5b0ba230b7538ee159ad415b06798143c33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693496064, "uuid": "2647488b-4712-4397-9a4e-a127ded5491f", "comment": "Malware payload (RemcosRAT)", "value": "01ccdc2d6180625e64d7bc923cd453750f077b81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693496064, "uuid": "b44cf5eb-0487-4554-8af7-16ccfd69fbb3", "comment": "Malware payload (RemcosRAT)", "value": "26c1cfa6fa82cfcd8763728c38aeaaed4d9c449ffba47a8744264d99b83f3b3b70d138a12278ff658b8a0f342ef55826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693496064, "uuid": "72638c59-a64b-4519-a8a7-994a9a6c17ce", "value": "T1E6B49E01BAD2C072D97514300D36F776EABCBD212826497BB3D61D5BFE30190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693496064, "uuid": "d862343c-a274-4fde-89d6-ea9a62e292e5", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693496064, "uuid": "025c2dc7-cf5c-46d9-bead-11e9c72093f1", "value": "6144:ku/TwNrjB5ikgxx+bdPoWYnRmCgEVAWK9goN1dFv/xpM9rsAOZZpAXNc7obv:ku7wNB5iedQ1RmPEVAWONjpcs/ZpEbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693496064, "uuid": "c30780f3-75de-44c6-b944-ecefe5a9940a", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693496064, "uuid": "9234d133-acbd-4122-b113-a6b39fbb1ed2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693496064, "uuid": "79586205-2be2-45e0-bd07-d2bf68ed37d3", "value": "xFL55B75FgZC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f354b1-47c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693460545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460545, "uuid": "92adc311-aed7-47be-a081-055d2b9d5a31", "comment": "Malware payload (AgentTesla)", "value": "4aad888d5c1e47940f7f65afc9b14098", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460545, "uuid": "ab03eaed-5b98-4c1f-85c5-70a0965f2fdc", "comment": "Malware payload (AgentTesla)", "value": "6e4aeb2cc08f63d0c293ac257c49917469662302e1c9e882b6f3c04d4bdc2ff3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460545, "uuid": "14e8472e-3e67-4a20-9623-ac596aad6e44", "comment": "Malware payload (AgentTesla)", "value": "7621483e9430d9db7dd870c340504c41bb64c73b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460545, "uuid": "e2bc4a73-d6ac-497a-b138-27553723f803", "comment": "Malware payload (AgentTesla)", "value": "6a65ed93993ae1bed3b17e7ce735c3af4374d2d4eab471e485d1f5e285a2d7408ebeb9a08f1643a83d6b81926876eed9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460545, "uuid": "4d83560d-54ba-4626-b975-b29eb88c3551", "value": "T12FD423B13BAA81F7C5CB477C06549C0B85C1F5794D13932EFB8D389EB439E9A5A0C622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460545, "uuid": "c90af135-7a47-406a-a458-42b236ff5d81", "value": "12288:YVnWu81g90+pJryMElv7MK6NLAe/iOPLf28chXCc/LkNbsGcTB08wnmqr:uS2JryNlvAPNLNcQcDkNNcTgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460545, "uuid": "14247baf-652f-4bba-b095-bba0b896507f", "value": 623736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460545, "uuid": "442567e2-9995-480d-9c7b-6e5c1c4b32d5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460545, "uuid": "c65cdfcd-2df9-47df-9c27-cd6b23bfbbdc", "value": "Deck Request.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ae3442-47e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693477535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693477535, "uuid": "31f4517b-3db3-4a0b-8ee3-f92a357f0dca", "comment": "Malware payload (Smoke Loader)", "value": "1ae4352e93c3dadc3708bc2107afd50e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693477535, "uuid": "0a947b6d-4b6a-4e65-8217-4b4a51813ba4", "comment": "Malware payload (Smoke Loader)", "value": "7415704fd2e5ffbb53f5ef4eede832499e18888fc1b206e5263714e669ade596", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693477535, "uuid": "a6fdffdb-8e18-4452-999c-249ea272f846", "comment": "Malware payload (Smoke Loader)", "value": "609007fba0226eb6915ce50e080fa04f3c706641", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693477535, "uuid": "69ef4b4d-6bfb-43ba-9f4b-dc6ee030a244", "comment": "Malware payload (Smoke Loader)", "value": "16f91a7335dbad8a2fa57c5cf0f4fdbb0d8163b2086a54937073658c05eb6640b585389ef928ffcb490d79c552b16beb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693477535, "uuid": "05fee718-a046-4308-b576-c303d55786ec", "value": "T15C34C021B2C1C073E21745344AB2C2B59B7778B14FB168EB2BD46A7E1E317D1DA3835A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693477535, "uuid": "099f1f36-6a7c-49be-83a2-6a4d3b67d166", "value": "854d77799e6241edfe49203b6ccd44b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693477535, "uuid": "2a556ad6-5335-426a-8760-93288bb5d05a", "value": "3072:ArmRB8q+pIkxFgFj3gEpU6WQXNQhXGVSdeoGY5D1x5e5yar:ASBF8gFjwEpUDKweoD5D10R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693477535, "uuid": "5f90544f-d91b-4bd5-bcc7-fa16e0c908c5", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693477535, "uuid": "a2b1252a-b2c7-4211-bf56-c903324ac92c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693477535, "uuid": "9fcb238e-6e87-4754-9682-fe4d75ded15a", "value": "1ae4352e93c3dadc3708bc2107afd50e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1646265-4801-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693488233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693488233, "uuid": "e1ead7ba-5e04-4fbe-bb33-27cfc9813e78", "comment": "Malware payload (AgentTesla)", "value": "23879561e05492804242d7698e2db917", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693488233, "uuid": "9b5a0e32-261d-4eb5-ade3-172f1222caa2", "comment": "Malware payload (AgentTesla)", "value": "742db9471549b91bca93f28cb8b9ba804a4fa03346223b57384b62b9a386b124", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693488233, "uuid": "715ea415-ed18-49fb-8113-2cf91ecf3907", "comment": "Malware payload (AgentTesla)", "value": "1c7984620a6ed8700ad7628f03369312e0562ff5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693488233, "uuid": "0116b6c1-fba0-40c5-8f18-2b3188b174c3", "comment": "Malware payload (AgentTesla)", "value": "4f4409a0072550fa26d734a507c12aba3b689bc9f6f7dac1ae5e3935f810f7d69cf4a3c329eb9e92e4f5a31434b193f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693488233, "uuid": "32dc1943-a782-4e85-9e17-38e29ebbb7b8", "value": "T1EF05D080B6DCB2D5FAB90FF43C5E173B0777DD971111840C26E4B0D66A30AAE84B65AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693488233, "uuid": "00c5cf51-2430-4938-96c5-e01b5d48c31d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693488233, "uuid": "28a29392-f02c-4682-803e-e3e06efae457", "value": "12288:BtfOZ1Zyqwlet9qeBKLALDxpS7GGzhbXYeM09aP2S8D6GRHtIw9duqxedwGHGc6:TWZVLqeB6ALDxzGBCmWGRHlruqxedic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693488233, "uuid": "aa304afa-7219-4d15-ae25-0c938b91aa1c", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693488233, "uuid": "af1d7a89-88d1-4c06-a530-d4c3e36d015e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693488233, "uuid": "a9c855c8-6c28-4156-859d-ebc8f3afba12", "value": "ZiraatEkstre_202308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a47578-4815-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693496961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693496961, "uuid": "f8e44552-a134-4da0-a06e-1c5a77d2eed3", "comment": "Malware payload (njrat)", "value": "11f51103b0503a907f2fe737effcba23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693496961, "uuid": "d7c7c6b8-f6b3-4360-870c-e7a871ded6c3", "comment": "Malware payload (njrat)", "value": "7598961daa8affac4886d4aface1b5cbae1500e386ac42cafca7fc3d9ae5f6c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693496961, "uuid": "d0905933-92e2-4d1f-a6d3-c987c9fa4db3", "comment": "Malware payload (njrat)", "value": "5519cd0e85228fbc49bc1a14a24785435b184ca4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693496961, "uuid": "4461d0c6-e6b6-4cd1-8eb8-58dfb2e3233a", "comment": "Malware payload (njrat)", "value": "fad4be110a1c144eafa655fa201ff582edda1bd45f15c1cd0f16ca34d16a81494197eeb1a68cd6b8097c19a4fbd2f988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693496961, "uuid": "d3b97dfb-c361-49f6-8480-ee6833eee85e", "value": "T1A2733A4877F54A12D1BF0EB5897292220B35FC076926F76D09D174AA5FB36C08A09FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693496961, "uuid": "fa8f2a17-38f2-4af1-8d29-e646aa2e12a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693496961, "uuid": "b540abec-0427-491b-84b7-af445cd7979e", "value": "1536:gt6+6Y9yhU19DppS5wpOk3JCK6pFNmXd6fOpd/9nEh9TGKJYR:nhU19QwpOk5CK6XO/9ESKJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693496961, "uuid": "c4e13f62-9c88-4196-a93a-a37f01c191f5", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693496961, "uuid": "0c87c2b0-bf28-46fa-b14e-f22ed37394ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693496961, "uuid": "1c8655eb-2458-453a-91c9-147b2e0ba577", "value": "x6MPVreS87fF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b282a6f7-4833-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693509737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693509737, "uuid": "d55d4176-614b-4ac3-859a-8b09d6d1c6c1", "comment": "Malware payload", "value": "11c07e92eae836c61af955d88676e8b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693509737, "uuid": "9c0ae517-3df0-4d0a-a7a9-d5a18bf6e16f", "comment": "Malware payload", "value": "764dceb13fdf2a746c6548e73f097eca4c429e03dc1e766ebe437bc2fcb42dc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693509737, "uuid": "6035c093-3aba-4247-8fba-df44044b1f3c", "comment": "Malware payload", "value": "6b4f327cbc05ddd0b9a88d149f59521e838dc786", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693509737, "uuid": "75f62d9e-32cb-4df0-8ad8-daf26e8b514c", "comment": "Malware payload", "value": "c3266e3487841c1a5d24c8ba34f52997dcae6c19beeb73e1add0255691db063193b9dc1b10c4c0a0fc4ca360b41f91b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693509737, "uuid": "d2c05a88-455d-4775-a52d-789668af5827", "value": "T138C4F135A2A6EF6AC03D877840114D2807F4E50DB732EA972FAB94D13D62BE44677F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693509737, "uuid": "3efee77d-0bee-4efa-ba8d-aa3bf8e0b3c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693509737, "uuid": "0768350b-fc9f-4bb6-be06-7e284df2091e", "value": "12288:kA0XbrkAlhfR/npmH+D/IXZzRc1Ttqh+r+XoqKpyJXzdGo9N9o8ib21R:kA0ka1R/DIX1itqh+STJXIoW8Es", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693509737, "uuid": "c59e8e37-ba70-4682-bc0c-670f970b7fe7", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693509737, "uuid": "97af6a1f-879d-4fae-90af-700fd691447c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693509737, "uuid": "3a36d33c-4aec-4cdf-92a0-a77af06b798b", "value": "0IuqaJTsFmOw8k4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c291ad43-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tsunami)", "timestamp": 1693466384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466384, "uuid": "74cbe1bc-cc44-47a0-99cc-dc451ecc8f9c", "comment": "Malware payload (Tsunami)", "value": "e5fc58fec1019b594a0a06d413bc1a24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466384, "uuid": "66968346-2a85-4c84-9347-b8e913859ac3", "comment": "Malware payload (Tsunami)", "value": "76f867b32c6f2c36677aff8060d257e24d61860408e73da4412e2381bbd22b14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466384, "uuid": "084eb611-c859-4805-8b8b-ba8982af5cdb", "comment": "Malware payload (Tsunami)", "value": "cac73c7adbe5b0d140afdb5ae7ab1cb725835f71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466384, "uuid": "7ac1f5b3-baf7-487d-b16b-eb7a83458ec9", "comment": "Malware payload (Tsunami)", "value": "4f679dd26811dd803e9822ee732c052ec054a80f2362d701e2aa577b3a858191d37678d87f177713bf4cedb8bdbe4861", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466384, "uuid": "21f569c3-8643-4c0e-877a-19a71177fdbb", "value": "T12252C09FE831D67EC7816336019FF4EB02E4EA79550D6536AA208F4E789323837F5091", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466384, "uuid": "6c7c70e3-94b2-430b-a3f4-9532bdad6fd8", "value": "384:MJFHh254GMnTgm2UZ4Mv9oCcxX/7Kktn4qDHKJ12e6x:EDnThY89XcxX/DZKJ129", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466384, "uuid": "e6bf7bef-0d3c-45f0-8701-adfa743037cc", "value": 13500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466384, "uuid": "6c4e0855-df39-452e-b4fe-a2831a99e262", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466384, "uuid": "9d2da3a4-db23-43f3-bdc2-d05c68f0d90f", "value": "e5fc58fec1019b594a0a06d413bc1a24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c171692c-480b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693492582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492582, "uuid": "bb49a604-3da4-45b5-9fe4-b3d693e4eb93", "comment": "Malware payload (Formbook)", "value": "47c10c8d6ba2a34bdbe7db3db0c7812d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492582, "uuid": "7f74474f-adaa-4db0-a7f3-e0542c2f3f15", "comment": "Malware payload (Formbook)", "value": "7af9cc5b2aade862d245026c370d0d4fd4d375426cd26357abba3ddb4c8a9824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492582, "uuid": "301d1a0f-5557-4156-a3ca-1605a727da10", "comment": "Malware payload (Formbook)", "value": "ce226142865574beef49be41a405907c3c3b5ea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492582, "uuid": "d1bfa5ad-5498-4469-bf2d-2b9584ded2c8", "comment": "Malware payload (Formbook)", "value": "befe9ee81a9caa7701adc2c614f75d10f15b79ba7f578a746b21535ef644c7fb1aa27b9f7d842b817c23ce7c1c01b448", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492582, "uuid": "b7e023eb-26f2-4fb9-a32c-e2f36c568566", "value": "T191059C4962108393E1247BB6C0296FB403709D3DF5E2D7C6BD857ED7BAB2B91092352B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492582, "uuid": "ca8c6b4e-c4bb-40b4-940c-caa15baa71e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492582, "uuid": "950ce695-0300-4a1f-b115-7a6dc9ef5eb1", "value": "24576:RUOPypIzaWUgZxRMlhnmogCjQbWHjVfB7pWYirXeuuoA+o:RUOPypIz1UexOlhn10WHjVfBdEXeKA+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693492582, "uuid": "7d59e6a6-0632-4032-a0e7-c269d26e9c72", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693492582, "uuid": "8c3611d8-e765-48e1-870b-7d6185c9ebe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492582, "uuid": "967e57f0-4088-47c6-8e75-384e4295aeb1", "value": "SecuriteInfo.com.FileRepMalware.671.27237", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff2af6a-47ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693452368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693452368, "uuid": "819eea9e-7531-4e81-8a13-dcd8cb5359a2", "comment": "Malware payload (AgentTesla)", "value": "01ea3ff5bf3f267cb8f13bc7e4592c25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693452368, "uuid": "37bddc02-5ad3-48cf-84ad-e23a38058225", "comment": "Malware payload (AgentTesla)", "value": "7c250877c093e218c81529d58cd93138ad277a7a7831ce76d73180608060b3cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693452368, "uuid": "e22903ed-5f19-42ba-a828-ef9b7f94858b", "comment": "Malware payload (AgentTesla)", "value": "c042c72f6720679e06d9613a9cfa02a07ad98af8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693452368, "uuid": "7e16bd52-ca20-44ca-bcdc-4a26e4e824c2", "comment": "Malware payload (AgentTesla)", "value": "b8b7df1969d4957cecf3da6880678ea08270af578de51d65674b2d1f791d563f644f4fb5ebc79b472058e79adbc68b14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693452368, "uuid": "de45fe82-6023-42cd-b503-105131457d75", "value": "T16F65B16040FB5644D0A7A6BDF35AB635423E9C8C42BE4AC773C2BA7C74C2263D91D61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693452368, "uuid": "8b2c55df-6468-4e34-8721-8e15f448db7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693452368, "uuid": "3245d239-2a45-4685-8397-747aa2126001", "value": "24576:0XPTrJDEPUkrkBkBoV8EqOkpY3dvKfyFZA60dH2:Gj8EqOkpUFEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693452368, "uuid": "2c2d0ede-6f5f-4c5b-a758-283f8a2e166d", "value": 1452544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693452368, "uuid": "d80c2645-7dee-4d21-b871-cdeb8f659076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693452368, "uuid": "a10a06e1-d17e-4055-b25b-34f5eed4842f", "value": "Second Warehouse Order(PS) Packing List.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e950e0-47c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1693460558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460558, "uuid": "fcd53e94-938c-4841-b6f1-38dd066f5ec1", "comment": "Malware payload (XWorm)", "value": "64f5a85b6d5d9f592f20c5917b22b289", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460558, "uuid": "93cc6196-affe-4a23-8617-842786a97fa7", "comment": "Malware payload (XWorm)", "value": "7d0a2c9c9de07965780910bd7eed20910347eb5c26593e64cf0570de4db0d53b", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460558, "uuid": "1a8b9a6c-c467-4d27-a60e-65a8e958e58e", "comment": "Malware payload (XWorm)", "value": "cda72fe8927b712787034d3b0cd616362c57ca97", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460558, "uuid": "ae043db7-a3dc-4181-9155-01a1480359be", "comment": "Malware payload (XWorm)", "value": "e6ab9840e86b1b7c45eaf4a74350681b0e766fd5494299d828f87816c831ad6d8605bbde3e418105579e86128e9eba08", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460558, "uuid": "0d7269f4-4b97-4836-88ff-db63e974ea98", "value": "T1D8B2E16FB32FF9A4F117847E925FCBFA725355CC9D98B18BB4847602288068236171E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460558, "uuid": "005baa92-c17e-40ca-9080-7bdfbf9239e6", "value": "768:VPk9SBzuzkm19Uh0xpBpM04Rw7s7+9MWGrp62i52sfKZD:Vs9NzkHaDpx4Rwi+mTp67509", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460558, "uuid": "db68ccb6-1902-4642-9dfb-074cc336e5c2", "value": 24673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460558, "uuid": "5b978203-37d7-4e18-a37b-1f9b524f33cc", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460558, "uuid": "ec68e259-a495-4c6e-b055-4c11dc72bce0", "value": "OmnibeesReservas_2022067091.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d83721-4806-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693490218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693490218, "uuid": "71cf943f-775e-4e2d-9dbf-5104a7b76fca", "comment": "Malware payload (Amadey)", "value": "eede39c7c0198e86a3b75d2b8af77201", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693490218, "uuid": "f9279e4e-ee55-4f9d-b0cc-8b476c57c22b", "comment": "Malware payload (Amadey)", "value": "7d61b2faaa4ca4c6a3ace89ab8a514c1d928492f4e41552b0386ccf7506d6727", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693490218, "uuid": "d7d25ad0-72c9-4961-a120-cd67064699f7", "comment": "Malware payload (Amadey)", "value": "b4545ddfbf9a70674a3f28aafe7abf7b4828b9f1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693490218, "uuid": "b1afa485-e5c2-4b06-aacd-84802964e41d", "comment": "Malware payload (Amadey)", "value": "d83052690dc37925539b768a04a7d8a649c96f49bede6893a6ec7aadd85d02818d0ff73e71c4b4eae7f231f541d67db8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693490218, "uuid": "4ff0f5b4-5984-4591-82d2-10c2be3b02e4", "value": "T1BD06A40E977695E8C5B9D03CC51A6227F9223C4DC234B7639BC65B42AFE17A0B63D381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693490218, "uuid": "5286fffa-d610-4ce8-a4c7-82370775da75", "value": "d339886668b2a33d7f455fb43d1fd5c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693490218, "uuid": "953bc820-498f-446e-ac06-e66c390afed1", "value": "49152:WAzCMQRS6jNdVRZLYZZtuafWNoG1wCUAKhj8VnF1Ij86+wI6BN8qKpmPsTuwV8:FOI8qZUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693490218, "uuid": "15e280f8-697b-47df-b0d8-5727410e369a", "value": 3685888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693490218, "uuid": "49e8bf34-b521-42a5-a15e-e3c89e8d6d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693490218, "uuid": "f12dafc9-5463-421b-89a9-366b0fd87001", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a41d1dc-481c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693499656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499656, "uuid": "45ab5d97-ee4f-47f5-9e5d-d1ebc4074b73", "comment": "Malware payload", "value": "71d06975fe56e919974fb5218b2e37af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499656, "uuid": "5735bc55-a6a6-441e-bfcc-edb4b9882042", "comment": "Malware payload", "value": "7ed148a738a2129d54e167fd38ae5a3cd5aaf36cd2d2e4e4dab01eaa9add8f49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499656, "uuid": "bf9b821b-06d2-47d5-92c0-ab8b8b02ece8", "comment": "Malware payload", "value": "28caee7b65639c2d7d28944cddcf1f112a504759", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499656, "uuid": "0a38185b-2a36-42de-966c-e22b36becb3f", "comment": "Malware payload", "value": "a7b231748f54164191c909139eb0584c0e2da44f9c2b6646052bdf071040fb870508652430f86bddca891c05711fe712", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499656, "uuid": "b34d41a5-a756-49d6-a110-b662bb111a5f", "value": "T1D933C80AEF944EABDC6FDD3346A9074235CCA54B12A43B3A3574D838F66E50746E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499656, "uuid": "3fef23fc-7159-4d6f-8b92-27d2e274f4c7", "value": "768:xqYZKI5kxd0qeJqtCjD/we6eYLVZJQiGXi6veZIDTjeZYJedXw9jpI:0YZKGkxd0qwqtvb3JZJQi+JTjOYJeKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693499656, "uuid": "05c3e061-71c0-40c3-ac52-50bf8e789723", "value": 51704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693499656, "uuid": "667ed01d-d960-4814-b0e9-4275c68e7de2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499656, "uuid": "6de8ab04-b1e0-4b9f-aeb5-0658b4ad6f5f", "value": "SecuriteInfo.com.Trojan.Linux.Gafgyt.6249.31446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884dab83-479f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693446100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446100, "uuid": "ba89fb9e-19ae-41de-a023-f816201b1e5d", "comment": "Malware payload (Mirai)", "value": "a91c674da933de6a7d22f01c564a7b6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446100, "uuid": "71938df9-e9df-4ace-b24a-2404b8867b66", "comment": "Malware payload (Mirai)", "value": "7ee1493e381ae512ec0d6aa4fb4683b2c283e14a06adad2d90c72afea94690c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446100, "uuid": "d36b9345-ecc2-47f3-9ef3-d04def51ecea", "comment": "Malware payload (Mirai)", "value": "77a69fae3673fd82de34ebb0a0054c5ea952d6a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446100, "uuid": "0e345b89-58e2-4e44-8567-54c3111e8e7d", "comment": "Malware payload (Mirai)", "value": "f25f1a8bc050f78a07f2ea0ab976d94c88ef43d3b9945637430efcd53878eb4a04d75d3aa03e6d00bb8b97a232204455", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446100, "uuid": "7341cf8e-0e93-42af-bce4-3f1e854fa369", "value": "T16EA2E059BF1C858BC836393442D9E9862291EC61B3ADDD4A0A90C0AFF5A33957434F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446100, "uuid": "0b84c124-8782-44b4-a64b-fabd6a4a8841", "value": "384:M06Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaz1Hb+502F2vwA9B1fKVVXr6SyW:G98o08kxofBE+ZkXaVbp2F2n8VVXruW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693446100, "uuid": "683fd10f-1eb9-4749-89d0-6fcca534c356", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693446100, "uuid": "76facd61-de7d-4bc4-b1ed-d2c418f237c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446100, "uuid": "4c1c80f5-7a9f-47b8-8001-72432db3a181", "value": "a91c674da933de6a7d22f01c564a7b6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036d1d8a-47da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693471218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693471218, "uuid": "748214d5-cbc8-47b6-9d98-a0ff0bac73d6", "comment": "Malware payload (DCRat)", "value": "b76aae2c9211ea08c264dcc8b2d92e94", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693471218, "uuid": "a64429ad-18bb-4f4f-b616-eda4822f8fd1", "comment": "Malware payload (DCRat)", "value": "7f6cb2f1d0a91f0e2dbdd7f9d77990d7e47edf50b5f0a0894a1b405f7a8bdfac", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693471218, "uuid": "969939c9-59d9-4604-8fd7-085fbd348542", "comment": "Malware payload (DCRat)", "value": "dfe81b74c34b586984cd12da8483d1101c576d1a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693471218, "uuid": "5c6c731a-82ea-436c-a133-584e1ff0d516", "comment": "Malware payload (DCRat)", "value": "dd001b9449eea21fedf529c2c8e2c41f3d8e818f2c69c1a57266f9a5c49c0ad5bc813e5466ddafbc614d43352fc4164b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693471218, "uuid": "c80c0675-b9f2-4a9f-869d-6dd4e6627b68", "value": "T1B6658C027E48CE11F0081633C6EF494847B1B9556AA6EB2B7DBA376D59123A33C1DDCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693471218, "uuid": "e30593c9-44d4-4ef3-a3c4-63fe0f245c24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693471218, "uuid": "d7af5672-4236-43c4-988b-b67e2e23828b", "value": "24576:AIyLN5cj4PR0l8JezUNO0GvIJnRuJw1PAlsxm/A4Q:3wNI4P88JXPZnRz1Il4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693471218, "uuid": "60dccb48-80f0-48f6-9c44-c2f8228fc118", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693471218, "uuid": "47faef3f-7144-44aa-90da-12b1dd1f473a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693471218, "uuid": "b8a3daef-29b6-420f-917f-8fa959a805a1", "value": "b76aae2c9211ea08c264dcc8b2d92e94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c943af-480b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693492581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492581, "uuid": "2fa18f9a-138e-4446-9898-9f813c0434b5", "comment": "Malware payload", "value": "5955d0d7f63b2cbb4d724c8597f17065", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492581, "uuid": "466b5b3a-7309-49a7-9be8-3d667ab58eaa", "comment": "Malware payload", "value": "85e06fedb8cdd8ea049ec9b62d480e58e55356953fc02694863c916d204f5614", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492581, "uuid": "240d8aea-0e63-4ac2-863c-8359b02cc353", "comment": "Malware payload", "value": "4bac0dc7c2bdec705093e56c33e314054f70e64a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492581, "uuid": "a9c7c2bd-160c-47da-a18c-8aa8458a5bd5", "comment": "Malware payload", "value": "918b4ceed56c9309aee6cdfdcc7afca8749cb4eee1fd2132d907bec6ea7598e29585c937c4cc0abc681f585cee6be42d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492581, "uuid": "7341e174-215c-4913-a309-c68f00dc4cee", "value": "T165F4CF56B250E867C62875F7D016A3F403B1EE25E5EED2C72C86BDCA75F2B810702867", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492581, "uuid": "a2529e97-02f4-4aa5-aee5-fc1ede3ce0cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492581, "uuid": "e6c5328e-e727-463c-b2da-028d21bc6b37", "value": "12288:84kfOEmJZeCxAjkJy/y4Nm28NcpatN1d3wDQYpp8SMDNiM35jS:CWEgZxNJyrNm22Oc1dgDHMhiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693492581, "uuid": "415a43b2-6d34-4037-a54f-3b8fc272ee82", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693492581, "uuid": "0b77b16e-3313-4cff-8588-557d40b597a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492581, "uuid": "63ec958f-c60b-4b88-bc9c-8455441902e4", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.DWR.gen.Eldorado.18487.14548", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff72d084-47c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693463050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463050, "uuid": "c952a317-7b04-403f-b36c-e1cf0c22f0ad", "comment": "Malware payload", "value": "86943c185f22b6db86f992ee7e98ed6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463050, "uuid": "17b92458-3854-4d82-8727-584a4eac7cdb", "comment": "Malware payload", "value": "865ce93c33fd5a94da06f2267d3d0817b95c2af40a6fc64bb9de0191ae6dc93e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463050, "uuid": "795cc5ff-c8cf-4589-b34e-b0a50e71e3bf", "comment": "Malware payload", "value": "53572347e926f7dfa5d261634f59b2f2d997dcf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463050, "uuid": "d2e4134c-5575-46e0-b383-ba5f6604b8e4", "comment": "Malware payload", "value": "9e72283266fce6513d56decb7dca8e21b809feb5465bf18381ca41b82102ae5b97e7c0b0f2cc819c1c8319f74020aaab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463050, "uuid": "53a43731-133f-4bc4-9956-14a08705151f", "value": "T106D523217EC08432D8A6193A26B1A7357775BD301B36CFDB53981E6D8F251C0AA367B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463050, "uuid": "126f670c-cc59-46e6-aecb-adb96a75a2cb", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463050, "uuid": "44c75040-525f-44dd-adae-9c6663b3cdf7", "value": "49152:qDkUjjLte/HmWJfK565eiZloo3i1Sld7WDn9O/5k+qcIUwsUtBOI7AXCSreCFaTI:q4UjQ/H/J/5eibYMqD9O/e+qczUteCSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693463050, "uuid": "9565b0a6-d41d-4726-badf-01be2f98c7a8", "value": 2849697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693463050, "uuid": "bf3ade5c-4b0d-449b-baef-a243f138cb93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463050, "uuid": "d4287ca7-87f2-4656-b7a0-97f977de7602", "value": "86943c185f22b6db86f992ee7e98ed6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cb338e-4831-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693508645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693508645, "uuid": "3044b747-33d1-4eef-9366-d18c341caeb8", "comment": "Malware payload (Amadey)", "value": "91073c383c5828128cd16e14223fb59c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693508645, "uuid": "1d74f952-b98c-41c1-a28d-edf33a53e79d", "comment": "Malware payload (Amadey)", "value": "8770a893bc2ac58f0cdc6fc5c9b1499819215a26fbaf7b0915d3d75fefdae0dc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693508645, "uuid": "b7a99035-c538-4889-af18-099620aa12bd", "comment": "Malware payload (Amadey)", "value": "1b86871962f18400a86e5db8d944a52647ded6b3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693508645, "uuid": "7d2c38d5-5982-4ec9-8a68-bf3ccc0f8bd4", "comment": "Malware payload (Amadey)", "value": "9021aae46c82e7a6b6576b2945446b7f2b8ec6a07decef17ed38a901abe5b3515fa9a2c27946225538b079379efa7267", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693508645, "uuid": "75a0a764-9546-43c4-9a55-4ffe282c6e5d", "value": "T1927622D93700269CC41D8830C833ED5B7376981B6E9AA96773D77B8A3F76331A605B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693508645, "uuid": "0bd12f8c-2975-4370-9656-cde48195b96d", "value": "ee26deb5354c4489ff0dc7547168b2dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693508645, "uuid": "ae2e3500-9c64-4796-9512-bdcbb723071f", "value": "196608:7fX5m0N5j9Wj6J/C6tpMcB1c/Sm7hMm71csL:7g0NZ9WOw6tphm7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693508645, "uuid": "5faa707a-8e01-4e04-a322-b163fc9d89b7", "value": 7810048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693508645, "uuid": "3cc65b33-eac3-4b6e-a347-8fdf51f98cce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693508645, "uuid": "53a96e87-ef1c-41f7-a547-f78f4e43800b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab14ec5-483c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693513374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693513374, "uuid": "702d755a-042b-4d17-94fe-8578a8a1609a", "comment": "Malware payload (RedLineStealer)", "value": "2a794cb7295cfe817f2be57a570029b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693513374, "uuid": "935c81b2-d2ef-45b3-937e-36e270a58bf5", "comment": "Malware payload (RedLineStealer)", "value": "8820b3948e3208c53a1272305219bac844373a51b4ebe4eeee268ac4313e7494", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693513374, "uuid": "9a3a1712-5907-4954-ab7d-42bbc5065cb4", "comment": "Malware payload (RedLineStealer)", "value": "049ea75db28ec8c043e6bf4a4e3f7ee7360c40bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693513374, "uuid": "6f6aa5d3-f0fa-42a3-b838-7ea7234ad854", "comment": "Malware payload (RedLineStealer)", "value": "fdd44ea01d3a120bb7b63fe067f3f5281b6dc090f699b113e7b0163d35d3244800df0dd15fb24e0c18ea1f127214102e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693513374, "uuid": "b9393b28-cc14-4e1f-8933-eb193b20f6ca", "value": "T159051212ABD9C873D976377018F606C70E797DA05E7863AF22059C664CB34C09972B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693513374, "uuid": "ea905112-c8d5-4215-846f-2eb4b1c7d537", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693513374, "uuid": "1eb4ef90-45d0-4293-8bbb-94b718ea92c7", "value": "12288:CMrsy903/k4Hec6gBUqZdfNTc7i07Yqvi6PJwWKlLsfWFJJVR20OQjKseA:2y4HecdB9jTS5YqbwIfWla0OwVeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693513374, "uuid": "3d2c52f6-ce39-44a8-9424-33626abc6339", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693513374, "uuid": "cd374905-2e2a-4cab-93e1-6f0d613c82d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693513374, "uuid": "0b69fd78-e5f1-48f2-a9c0-80627c66d67c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e968e4dc-4821-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693502098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693502098, "uuid": "c4c317be-4049-4c02-b560-350b2315ebbe", "comment": "Malware payload (RedLineStealer)", "value": "1c4b971a208f2d6ace9050557cae7aec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693502098, "uuid": "1afd7c53-c048-4558-9e33-9878e0be376f", "comment": "Malware payload (RedLineStealer)", "value": "8823fc60c87a31d84002d5511b66c1981cf1e873f5bef6610f3ce5596909e7b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693502098, "uuid": "095254b2-02eb-4f8a-998a-5047fd0d699b", "comment": "Malware payload (RedLineStealer)", "value": "58a921521bb8fdca18ea8f69ea37294caf77a792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693502098, "uuid": "2cc0a696-0168-4243-bfc9-61132708755d", "comment": "Malware payload (RedLineStealer)", "value": "0d67a96b1a7c2ed96a760b1156ab2f1c84c32db0f1af3c5dec55e9981b2dc9b8a1db57333162efbef410f74426e4d39a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693502098, "uuid": "6205b4b3-f766-4026-8862-85b8cf8af8cf", "value": "T17D841221F3E2C8B7C063417D44A4C6F149B7BC622D7990EB2B581B3F2E705D05A6AB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693502098, "uuid": "3d327649-dc1b-411e-a8c9-b92fafae4aac", "value": "e095c86cab8803cbfa52c1620fa35581", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693502098, "uuid": "effa1e03-edc8-41aa-8eca-517286920848", "value": "6144:jbRgIniIGywpLR0rS/v7OL8ZxK+V/8Q+6E8hNNivfO:RDniIGNhuyKwm+V9VE23iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693502098, "uuid": "60df3a9f-a902-4849-9e40-e841a715fe3e", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693502098, "uuid": "33d9ecca-d0fd-40be-8796-7c0fe82bb2f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693502098, "uuid": "9a33dfc9-1301-4cc7-9246-c234a8588bc0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397ca8e3-47f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693482905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693482905, "uuid": "9b694a02-3004-4e93-b897-85d5e141e78f", "comment": "Malware payload (AgentTesla)", "value": "e2b0c57edbdb3e186fd6ea4eddd5e361", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693482905, "uuid": "721fdb7b-c11c-4888-bc03-8abe5967ac6d", "comment": "Malware payload (AgentTesla)", "value": "896621f964ff7abbe9fa5b2c8944ae2e5b16cb659e94eba7efbdd763641ddcd7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693482905, "uuid": "5b347923-7ff3-49a5-b232-607025c9dcac", "comment": "Malware payload (AgentTesla)", "value": "2f18393cba06d93761bcb93a01136ce8b65f1ecc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693482905, "uuid": "8cc4542d-d47b-409c-8193-a63bd3c9c1e0", "comment": "Malware payload (AgentTesla)", "value": "111db1134be51e45b3e9b390f9ece63ee3fed2265eafb9c66cb4299bdae5aab9a302bfd316e9ede84c0246da4dcd9114", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693482905, "uuid": "efb335f8-590c-4a04-a793-47409d018c3b", "value": "T1BDE4221052E41B33E27983BD65E0734407F27B5A5736E2592FE0A0ED4DB2F029AE5B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693482905, "uuid": "dd38f655-0950-4c15-b0c0-7ff868a053e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693482905, "uuid": "d2e46640-9bb7-408b-9407-b690beaa38be", "value": "12288:LDfOZ1yWQnohN364SP7sMwnXOVm8agjWfzNp4q8WCbksk90j4oaPbfSF:HWZDQownwn+yRp4qkrcoaPbf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693482905, "uuid": "3bb8f4ac-c74c-4d3b-94bc-a54f0f55e2fb", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693482905, "uuid": "016c78fb-bcb8-4a34-8c55-31c3b64bcdcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693482905, "uuid": "8d8074df-18af-4b89-a741-895815fcc2b5", "value": "SecuriteInfo.com.Trojan.PWS.StealerNET.176.1180.18091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6910fa8c-4836-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693510902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693510902, "uuid": "d283dae5-0af6-4997-8400-6150cbd86766", "comment": "Malware payload", "value": "402fc7650db1071cf6d40ba264e980be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693510902, "uuid": "8326d42d-755d-439c-853b-7fe50cba8497", "comment": "Malware payload", "value": "8a37bd459d396d77b404a656c88705883cc8662d2101eb26cfe3ee137060f6dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693510902, "uuid": "3dd0a7a0-7517-41db-a994-5d97f44a7c79", "comment": "Malware payload", "value": "87e98e8e7497cdb6cfa822accd370300b259e62f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693510902, "uuid": "d0bd3f5b-e543-4970-b407-207c5ec2082d", "comment": "Malware payload", "value": "bf78737f60ae9ab47733cddaa66d3bda04412d060c5073a33a64dff58243f6a9d18cb08796386633c02e699a2f6a747e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693510902, "uuid": "a77f07ce-22ec-4544-ac9b-a1051196e365", "value": "T10525D81BEBF500E5F57AC13599A26169FDB238D54B38A7CB87804A0F5B31BE0AD39701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693510902, "uuid": "868b1d41-1fce-4c24-8797-204fdab6d874", "value": "fa2737ff29b2c325c121a0867390efe4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693510902, "uuid": "433feead-eeab-4a49-a27c-316b317ecbd0", "value": "12288:0xFT8CwP0nFfaLqy4PdJ5L0jhNwhNf+8/96LPbRMfMDhoTP98r0:0xFTJ4SFfxy4FJ5L0jy+8/9IRKM9eV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693510902, "uuid": "27a31635-03ad-4200-81e8-1a2485bec543", "value": 969256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693510902, "uuid": "aa5bd99c-f7f8-4ef4-9fd1-43066ca18879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693510902, "uuid": "1ee4322c-93ff-4e40-a614-f7d9e1531653", "value": "HotkeyService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88784a9c-4838-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693511814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511814, "uuid": "5707277c-cdb3-43f5-8d3e-1d8deb63be12", "comment": "Malware payload (RedLineStealer)", "value": "a5229255500c44580ffc2b8fb01e8bfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511814, "uuid": "c80b8aaf-9816-44a5-99c1-98148410fcae", "comment": "Malware payload (RedLineStealer)", "value": "8b99f2e7ade6578142f97f13794030881242ed574749ec633cf4f87feb808a3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511814, "uuid": "78bf49e3-3eba-44c1-b795-8ce5cfbcd1eb", "comment": "Malware payload (RedLineStealer)", "value": "0e371c1d5ee1182bd7f1b378449edbf5df0e771a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511814, "uuid": "0596b3ea-17c1-4395-8280-c51764287f7d", "comment": "Malware payload (RedLineStealer)", "value": "356a75ab2226c3cc8b7bd565f7382db848c20653f5801cb7853fd71b33e1c3c0af78a36b875c1cbd5847452563a8a3c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693511814, "uuid": "636fcfaa-108c-4c5c-a751-c397816e5b6e", "value": "T19B051242A6E59433C5B627B058FA0387073A7DE08D3956AB3795AC5E0DB33C0983637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693511814, "uuid": "0ee33e49-9882-4455-84e7-8c8008890e98", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693511814, "uuid": "7680683e-6e0b-445c-a0eb-a39cdd974f8a", "value": "12288:LMrjy90E3epnRRmuy7jLFpnOmF8nyyzPgFP0J9gWEFbcZ56YWSvhkFBDiyUmPCE0:My73epnu5FOILUgW8bc7uL4yUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693511814, "uuid": "8d276b85-ce0e-4349-9dc8-728058531136", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693511814, "uuid": "a3aed264-5a7e-4226-a4b9-dddc5590bcde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693511814, "uuid": "f0a2475c-b580-4637-8f4a-d9c5cb6b62f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e608ec0-47c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693460552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460552, "uuid": "e131fbdb-0236-4d95-be48-774c4ee91177", "comment": "Malware payload (AgentTesla)", "value": "c31928dd1a31808c3dfacb00b6bcbf76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460552, "uuid": "b5f8032a-3c2a-498e-8215-d3df33ccd655", "comment": "Malware payload (AgentTesla)", "value": "8be7de7be4d576cb3229283f4e33d8a33f4b394c20436632b71b6e05c1092afd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460552, "uuid": "b63763e8-8baf-443d-beb1-7883e3a541e6", "comment": "Malware payload (AgentTesla)", "value": "eb9439771718d0c6d739e0e0b39cda30bfadcc1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460552, "uuid": "7f430d8e-889e-427c-82e1-6874bb116af0", "comment": "Malware payload (AgentTesla)", "value": "33dd0eb8412b753a31730419b88f7516e17951647a0fb95e7c6294648a908b569d384c7d767610dbb2aa34a6e770069a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460552, "uuid": "74ff3b0c-d2a8-41eb-beb6-3248461d4bd5", "value": "T1F1F4334CCFC8E9E205C974E54BE62B75474C2585022B1A788CD2E9DB3FDB7E44ED908A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460552, "uuid": "ea24ca84-d101-4def-af3a-fb714d4ac214", "value": "12288:17L7kQ5qmHZamim0RoqwRGjjyKU+VqrfvbckpJUW3uWmIPiilQKqO3r1R:1bomaoq+RKUxbFmWTmIPrQK937", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460552, "uuid": "00982338-1010-4e1d-8d5a-3b3c5c2ed583", "value": 747958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460552, "uuid": "1da6b14b-223a-442a-ae83-8da1ed31f0ff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460552, "uuid": "f64a2ad4-6c5a-49f3-85df-330a1179b1a0", "value": "New order for PO_1211992.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c16a34e-4823-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693502746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693502746, "uuid": "6f09f1e9-cab6-40b7-861a-c45ed00cb14e", "comment": "Malware payload (Smoke Loader)", "value": "e0b8831dca1bcce50c8b4e4529511b4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693502746, "uuid": "e5c895b0-ff8f-4a8b-88b5-0af08f5ea306", "comment": "Malware payload (Smoke Loader)", "value": "8ca632e409a6918bf30005a9b2e561771f6427ed03e836c348143c8ef2afbc41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693502746, "uuid": "e2b27059-4025-446b-8b0a-c8359dbcf1ef", "comment": "Malware payload (Smoke Loader)", "value": "b761f6a7e7cf046900d8b0c94e331fa727470c41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693502746, "uuid": "52487a19-7bab-4d66-ace9-02c66c779848", "comment": "Malware payload (Smoke Loader)", "value": "a9100504bdbbbee3a85a9592f6f925c01f781db6da8d1fc83c85c86b90e4378e029a3f5ba8adc507b1375c5d7fcf4379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693502746, "uuid": "5bfda5e4-0a3e-496b-95e3-77d0221632d1", "value": "T14824E022B7E1E073C06349741870CAE03E7B7C31267659A77F58193F9EB06D05AA9BD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693502746, "uuid": "cd56aa6c-80e5-462e-93e4-8293b674359a", "value": "e095c86cab8803cbfa52c1620fa35581", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693502746, "uuid": "8ed6b53f-72de-47a3-8c1c-2973dffa3631", "value": "3072:BTcYvERrKjtdxgGtj2U6bYKMFoBzb0ex6Sa:9GRrKjtrj2l/zbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693502746, "uuid": "e6afbe26-d1a4-4072-9897-eb3eec5ca033", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693502746, "uuid": "cca8fcc5-dbbe-4f84-95e5-f4d338a2e272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693502746, "uuid": "b06c6068-f34a-44a3-8635-3797a96ee839", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331d23bf-4803-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693488907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693488907, "uuid": "0ef4dfb3-1cdf-40c2-b32a-794a5af99b77", "comment": "Malware payload", "value": "2b66af3a382a6f861d4f42b21c2b9ca1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693488907, "uuid": "aacffd4e-b220-4f0e-9a8e-88bbc5dce6e6", "comment": "Malware payload", "value": "8d0a6dbce15e45b5ea6c09d4883d549f1c2c6431313dd85a99e3a5af55518dab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693488907, "uuid": "d60d1106-a2f3-4828-a09d-fb842c652cd3", "comment": "Malware payload", "value": "bfd2076e350163d86c7571384678fcef86b22a08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693488907, "uuid": "fe1ac60d-a6e1-49ef-9ab0-e58e9d0df358", "comment": "Malware payload", "value": "85ecc800212a16ae66b2fe067bd5d1bc365d3eb9cb91e379d29a2ca8f8ecac864319cf29db1e609ab3171c2295b00a63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693488907, "uuid": "c6112bb5-aa6a-4c5a-828a-9e2a50bf5d79", "value": "T132E36A0235D080B1E4B302764AB8AA515A7DFDB10FA556DB77D84E8D8EB46D0BF343A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693488907, "uuid": "64a324d9-54b8-4fe6-9d13-b8bbc086cfab", "value": "b2af7241534d0497575b96e6726c4b5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693488907, "uuid": "1244060d-34aa-465a-98c6-370d54fa6083", "value": "3072:npHSDEcteBxS6Q8OFDwtSuJ+TOgGAep99ZVh3M5:pHSQcs+t8OBwC0VN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693488907, "uuid": "e31149e0-0940-4b7b-96f0-d3a70d82ca2b", "value": 151040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693488907, "uuid": "e95082b2-9464-4b7a-819e-5a1a02c96b3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693488907, "uuid": "0a1e9efc-8009-4708-8953-64e3087e70da", "value": "SecuriteInfo.com.Trojan.Win32.FormBook.SISN.MTB.2761.11514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb53229-47c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693463078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463078, "uuid": "4a14954d-8c78-40cf-8ff9-77c9076bf3b7", "comment": "Malware payload", "value": "0dd2b5c33ce5f526c7398ea834eed53f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463078, "uuid": "f5fcb86e-a82f-4910-8363-e898bf1cd12c", "comment": "Malware payload", "value": "8f3d178a34191bdf188a52d6db00ea2c7b451669005f9a08063b40c5299a6094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463078, "uuid": "105fb9ba-967c-4e03-a099-d7b4129da052", "comment": "Malware payload", "value": "d970988485af1a01230bc29d2f205337158dc15f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463078, "uuid": "6aeb3e21-4ae8-4c0a-8fae-5fca81293ec9", "comment": "Malware payload", "value": "35d4a8c5e9b3b0224a9ba21fe94fa9c0f155762d920cb18ca13588ac4a7a8cb939d970b3798c2fff965f1e1599bc1697", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463078, "uuid": "36fbe770-25d7-4ab7-805c-c006357bb152", "value": "T1F8B53352902AB38EFB022C75F1B451BEB17C145A6DD11E6AF1E6BD0E3E508F68D7D006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463078, "uuid": "88547f4a-6bb1-430d-aa03-5ab7d0bcf176", "value": "49152:MY5UqJTec/w5ashu/usRTe2WjCJILmGsO8ASotjEH10DwJ4mQDc:MYUqI5aPXZJIpsr7VrJ4zDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693463078, "uuid": "5c5764ad-9b7b-4add-b0dc-3f50c99dee00", "value": 2309291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693463078, "uuid": "86fea3aa-3adc-40da-bd6f-9283f85815a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463078, "uuid": "74959743-6159-4049-ab29-54b0a97b5b34", "value": "0dd2b5c33ce5f526c7398ea834eed53f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06cd3ea9-47eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DBatLoader)", "timestamp": 1693478525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478525, "uuid": "b936e32a-3678-4b6c-b06a-842a278156d4", "comment": "Malware payload (DBatLoader)", "value": "3b43ca7461a06f3f25fa1a036840e48e", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478525, "uuid": "f7e573bd-97c1-4cdd-ab02-dff30ee73e54", "comment": "Malware payload (DBatLoader)", "value": "8fa3e79856319c3ac7ff04639dcdbaec1ec7ce8c92e4a7aca8637751c84a247b", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478525, "uuid": "06219031-984a-4d82-b95f-b17c79227dac", "comment": "Malware payload (DBatLoader)", "value": "8b644136d6801347372d4c468d32e2f02959bc92", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478525, "uuid": "6719d683-6022-4e5c-bec0-ef4a9e13dd48", "comment": "Malware payload (DBatLoader)", "value": "6821b75e2004a809b762bb47c32ec0614bff099d2250724756c0bf1bdd3d04b35dd8c2920273800c71331cb78c8e04b7", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478525, "uuid": "9b9eb040-4600-4452-82bb-2309050f91b3", "value": "T14D55D0D6B7A0C9B7E29729B07C2AA3F55C1A7D311CA434923AF33D580A3C751262E1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478525, "uuid": "79032b76-4bd0-4eb2-9c2b-4aa4144d36dc", "value": "4f224357de8c719e6361247ffbc04e8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478525, "uuid": "8dcd903c-6a36-4ec5-9f22-d35691a6338d", "value": "24576:6JlDoyUj2DceiZF5NIcbjAYKUx7ADHxOx4yHR7eeKwxK5K2TKEDDNuhoU:6J1sPVAYdA7khFxacMz8oU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693478525, "uuid": "8b2f1162-9fcf-4a2e-9715-719e525eb030", "value": 1349632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693478525, "uuid": "7035c1c6-4fa0-4c07-a14f-6ab00682ffb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478525, "uuid": "6c4b16d1-d015-4646-8108-7cf2d7ace8da", "value": "SecuriteInfo.com.W32.ModiLoader.WG.tr.22779.8690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e88dcd-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693466366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466366, "uuid": "3062c7da-97f3-4d40-a7d5-1e16b4297b45", "comment": "Malware payload (Mirai)", "value": "b7da58857097984b0b47d0bcd0e8df7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466366, "uuid": "8cded810-0860-4615-922d-8125e2ce01c6", "comment": "Malware payload (Mirai)", "value": "9045799c97d457ca905491415a0e56cce2aa1ecbb7e0cb2653ee0879098055ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466366, "uuid": "ec902298-3058-4b39-ac2a-ebb009890225", "comment": "Malware payload (Mirai)", "value": "cc81d3543325c8b66ea7964b9ff06e996bde1b2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466366, "uuid": "44644b29-e178-46a3-98b2-1b86b09cf752", "comment": "Malware payload (Mirai)", "value": "3ea614d6d23b32e6b21650749799653aa8c76909a8c869fdb96ab8530cbe0bdb4ac95f9d63d0a5b7968943529cdf9d7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466366, "uuid": "e52eca9c-bd51-404d-b3c5-38f2a5428a71", "value": "T1E5213296B1C46D54DF18EB3C5EB10693BB05C964C54FF38E4F0E86B6291B28C66D40E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466366, "uuid": "0f29a09d-7d35-4952-ae98-6c78d0b2e09a", "value": "24:w5olnAwdGtSnUpzzbBWpzm1or5gDgvmI96vGlikC7m172KJ3Nfi:w5olnPdxnUpzzbBWpzm1bDgvme6vGliV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466366, "uuid": "2ba7576d-4797-4760-8cd1-e467c4ac32b8", "value": 1204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466366, "uuid": "885947cd-65f5-4a25-ada5-5a6469ca6479", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466366, "uuid": "f3199db5-959e-44e1-ab1d-75d43c32ca81", "value": "b7da58857097984b0b47d0bcd0e8df7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a14bb08-47c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (UACModuleSmokeLoader)", "timestamp": 1693460142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460142, "uuid": "476389c5-a73e-4bb7-8d0a-2e8647251378", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "621e143243b614d72dd0a355c8789899", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460142, "uuid": "09639ab2-d44e-44be-bd04-6b3685ba6bc2", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "905b9db8cf5a3001318b28ee5dc674f8f65ca1e4306aab9e331b3bba24e7b8a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460142, "uuid": "02440abb-e104-4dd0-8fd5-df52af842b95", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "1da76d6bf7be8a9342fd205a5b250bae7a3c90ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460142, "uuid": "53b4ef6e-4324-4cf1-a7d5-6c4e7c9affe3", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "6841773dae6bfacec8e561a06d4c8c1f1bfeab5a0f37532a8a8c1af2cfef0b2b09c33dc9de5804131df0a831b23aa646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460142, "uuid": "5a76c0d4-85b0-4ae0-ac0f-003152f155c0", "value": "T12FC40133B6D2C072E53756701661D2B11EB6BC700BA155CF2BA42E3A2F746D18F3939A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460142, "uuid": "66805950-fa8e-4b41-a426-1eeac1fc84a9", "value": "1a8fc4793fbcc767c326587aa9ce326b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460142, "uuid": "17218ee6-9874-441b-a56a-20c4f570f3da", "value": "12288:LW86pgVmN0WzPc8/C5tWaoduPTRO6kqaSjwgs0jv4pJg3L:a86vN0WrclvHwWTRO6kPMs0jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460142, "uuid": "d76dc271-b233-4963-9874-119f728ca584", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460142, "uuid": "07cd1715-056e-4fb2-8d28-a8e9099fceab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460142, "uuid": "76b4fffb-a3e5-4a63-a3ec-695aadb11e4a", "value": "621e143243b614d72dd0a355c8789899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab281d87-47fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693485672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485672, "uuid": "81869a03-bdcc-4071-889f-aece8dc6fe85", "comment": "Malware payload", "value": "ca7502cd02a0a170d9f4305c18410126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485672, "uuid": "6eb47692-4a26-4ac2-9e06-24b60d157286", "comment": "Malware payload", "value": "907ed7e8aa2058d9e4509c779c9525356965992271ade6991af8bd4bbcdee260", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485672, "uuid": "9b29f747-75b9-4acc-a724-e4ea8ccde696", "comment": "Malware payload", "value": "b21efab03bd4740985a51bae2da86fd723f19d86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485672, "uuid": "3c5c7ed1-1271-4489-97d4-19e90a1e6952", "comment": "Malware payload", "value": "501f3191c0eaec1061b2af719a11b4b10d10b4b67b98dd33f04f6d6858a827b5bc5391ce2147cfc1e7ebf5c6e243a9c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485672, "uuid": "12088f68-37a7-4550-8819-61e2dd5db6f3", "value": "T19276239233615889C8998C72C823FEFA79B59E768E01A47735967FCF1D332A1B203547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485672, "uuid": "f79349e3-4a8c-43a6-863e-e21cfbe91420", "value": "de8af78b3569eb79f0a43010a95e85a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485672, "uuid": "df30b465-8bc9-481e-b773-63edca6f3b08", "value": "196608:p6eXl2olmwb1nxbAsDMsCegYQRYEMIbYq:s6l2ogwxnx8sAdGQRl5Mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693485672, "uuid": "bc397f2c-26eb-4ceb-b1ae-9c04698b2bde", "value": 7439360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693485672, "uuid": "5b0c105d-26e5-4bae-baec-135234122018", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485672, "uuid": "7e565940-3bc5-4e96-84c2-852a4a62b867", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "decf3a65-47ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PripyatMiner)", "timestamp": 1693478458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478458, "uuid": "f381c003-374c-499b-bcef-ef752e937b89", "comment": "Malware payload (PripyatMiner)", "value": "80ecb74de111f0f6e1fd35d1c3e5238e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478458, "uuid": "c46f8ed8-900f-4ddb-a46e-e60457e1aaaa", "comment": "Malware payload (PripyatMiner)", "value": "9084423577dca12435f58eaaec583e8362cad6d25430c8d91ab185f11cff9364", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478458, "uuid": "dba98f5d-de97-4e51-9602-9ed788335194", "comment": "Malware payload (PripyatMiner)", "value": "43d12011d5b0d4b99ff23f2efa1c55267918f4cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478458, "uuid": "ef2f37d0-680b-4cc9-8601-c6c7d906923f", "comment": "Malware payload (PripyatMiner)", "value": "2b53dcd6a2d7983dda01f9a9ea5d3b133b1452ec8abe1475067dacf652ff4e3508daa067c36b18354e14c96781825553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478458, "uuid": "a6acb5c7-682b-45fa-9c71-f37ae407af9f", "value": "T1B2B6D093BE4CB946B373A961BD73123B668E16725B3B0FC1187302EE7C6114329AD5B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478458, "uuid": "b573910e-a3af-4449-87b0-aff66326b59c", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478458, "uuid": "98e0b3bd-ab46-4cd1-a4a4-87df16ba79d9", "value": "196608:CK3ycH1yITlQZuVP1Z7XNXzBjPImQPOpSUxvSBpU/MfBB7w+bOZJImVbbby8ByFv:CK3ycH1yITlQZuVdZ7XNXzBjPImQPOpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693478458, "uuid": "a6694397-0d75-4fbc-a6ca-38dba339fc43", "value": 10424320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693478458, "uuid": "9222cc0c-24b5-4520-807b-31d42b9a7f44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478458, "uuid": "e860bcab-0f46-4152-b692-cf82698c6754", "value": "rust_cheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3548156f-482e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693507379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693507379, "uuid": "97112c9f-2e69-459f-8c56-fcac6f6cd8f9", "comment": "Malware payload", "value": "4db9be2fb76f2b55bd59428d4fd0a730", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693507379, "uuid": "8605104c-1b53-4603-a912-01a58b9297b0", "comment": "Malware payload", "value": "933f7adfe560745c5d3f176c2517df34909e6ed7c755b7bf8a11ca247e7542d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693507379, "uuid": "a8853b1f-24f2-4553-9541-2e66cebf2576", "comment": "Malware payload", "value": "75daaddf232b0456b9ee395e3d93fd1434e6e85d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693507379, "uuid": "69502ad2-a6c4-425a-b5c6-3ba0ce5f8f36", "comment": "Malware payload", "value": "3a3c1f24dd350b2a2b072969430ae532944180745c7972eedac6e56bbbc0382516edc7abe6676ecf189cdfa912c6294a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693507379, "uuid": "b6cdffbb-b701-4de1-b6ce-6075440e3c8a", "value": "T1B0C41281A22CDE9FD3BBD134D653412AB357EA7A62F10205920FBFCBE8664D58311BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693507379, "uuid": "9d68445d-b907-4ac3-8dae-07550bb06f3e", "value": "12288:SwQ8qY+MABW6kW3ai3ALB+mJIueye2awTkU7FKYLrPOItu2m7PH3:CY+Mcq5LosXeyen2kUs8+2g/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693507379, "uuid": "a806c1f4-cafc-4ef6-b9a8-9f24cc16a506", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693507379, "uuid": "b16587f9-1e24-41ed-9961-2f21202f64c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693507379, "uuid": "cb8ed556-a4d4-4a17-95f5-d87fcc45d8fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bdb67d-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tsunami)", "timestamp": 1693466388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466388, "uuid": "b4646ff3-f677-4ce1-a246-86e8ab7e7b16", "comment": "Malware payload (Tsunami)", "value": "3a4736f621ed35f6cee74d01b286ef50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466388, "uuid": "ee62047f-294c-40e2-961a-c9aa52e25bcd", "comment": "Malware payload (Tsunami)", "value": "942f3bebc254c08f9115a3bd7f1ab56cb02ff766df12fb5f2935a7409491f353", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466388, "uuid": "b7812bd6-2fa3-43c0-9c3b-011ca0f234a2", "comment": "Malware payload (Tsunami)", "value": "d63d6924a716e6220d0bd9146b42e16581ac2aea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466388, "uuid": "fff8c665-50ed-4df5-ab52-8f247e45ee73", "comment": "Malware payload (Tsunami)", "value": "8730ef57c28e01efe69e407fcf1938a5fb303be7a5aafd46febb5cc1267d597130f76af4f131fe81e90fbf8dc5e387ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466388, "uuid": "3119224e-6109-486f-9a63-92fc48577794", "value": "T179E2F7A1698AB2BED4F8257A9407167803838468725FA3C7B4DF4528FF87B4C6C61F4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466388, "uuid": "9320d9fa-f3ab-4346-9069-308ab6e52e11", "value": "768:RouKUHa2+LrQhmbCiDUfvOANu/YK9JTmx5jBs:ucHh+dbUfE/YeJTELs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466388, "uuid": "432210db-3440-4d14-b5bb-5b82d7fa3a10", "value": 31316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466388, "uuid": "0ca6fc2e-8cc5-4ec1-b0f4-bc493364424c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466388, "uuid": "0bf6e283-76ee-4d90-9eeb-c79e5a619b54", "value": "3a4736f621ed35f6cee74d01b286ef50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2cf9b31-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693466412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466412, "uuid": "22f0d75f-3cad-4a82-b43f-ad610f5574c0", "comment": "Malware payload (Mirai)", "value": "9d2dae894262fae18c6a1ddd5563c8ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466412, "uuid": "bbd745cc-ecd6-47e9-acad-9dc6a2b85d03", "comment": "Malware payload (Mirai)", "value": "96f8062095dd8db75c702486222c993a13e76312c774f9c1d6038aa12d88cc24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466412, "uuid": "6f89e2f5-8a08-43e9-a903-e5b657e84ac7", "comment": "Malware payload (Mirai)", "value": "ad549858efdbc9d6b23b35d03bc914f0803d496e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466412, "uuid": "24b435d0-459d-4556-967c-a59e4bd4397a", "comment": "Malware payload (Mirai)", "value": "9557e13876f356d8d0bc18820c54373f37cb2b521cfe014e4caa1a6408f906495a1415104f48f10fe4402d64989599d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466412, "uuid": "bf632513-c00a-4104-a8ed-80e9e428eee6", "value": "T1DD41DC8E5F315EE4F195E83C8B370B3567AB564887D14249E2ACDA002EC434D899E7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466412, "uuid": "fc88778f-8248-4377-aa2f-1b61322e791f", "value": "24:3OShMgJc8AmsCxj8Amyz/z2HcllPUqtWB4u3nliI8paXDdz3N9l5zBkEp7iZliAz:+SegJNOw2H0y1zXD/9LuEpBnHTROR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466412, "uuid": "97163ea1-fe3e-4d17-b1d6-daed6598f19d", "value": 2016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466412, "uuid": "ec373853-d41d-4b87-bb98-42b0b13bcbe4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466412, "uuid": "edae95b0-25c7-4efe-956a-a697f0df2aeb", "value": "9d2dae894262fae18c6a1ddd5563c8ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2600b1-47c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693460446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460446, "uuid": "3d11d1e7-3a13-4e8d-965c-77f271854fd5", "comment": "Malware payload (Mirai)", "value": "562ad7f2a26f66ba2ae1950c604dba1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460446, "uuid": "1a38d64a-067d-4052-8a3d-5d4f9e40bcc3", "comment": "Malware payload (Mirai)", "value": "97b5a6b477193b444f2215e5b8849fe79f2e93b9519c198c69c355108586a87c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460446, "uuid": "519dfbbf-a68e-4834-8441-7f2641f5a3c0", "comment": "Malware payload (Mirai)", "value": "3d70ebbd27258a30346bc0739adf854d9d0a558d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460446, "uuid": "3d61e362-bf35-4f10-a315-af4dc2834c82", "comment": "Malware payload (Mirai)", "value": "3a13a6a4514b6b3778da1c594aace501268d0e9cb805f962f631086586597f3e1059bafd19bbc0879f267cc03844162a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460446, "uuid": "065381a3-776e-4f97-957c-7bb757484fa4", "value": "T1A9D35B06FB418F13C4D617BAFAAF424933229B94E3EB730659285FB43F8665E0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460446, "uuid": "49b51c2c-5ef4-40d7-9964-a0ec6a2494f0", "value": "3072:TDvifpXS+5mdlVXfqEJvitr6xQds/HQq5QEbOmyM/9Ybfrr:TDvifpXS+5mdffEp6xQds/wqXbO3M/9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460446, "uuid": "42ae468e-7adc-4609-8247-5fec83c40fce", "value": 134572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460446, "uuid": "42a75e30-0257-4d49-b7d3-e86715786947", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460446, "uuid": "f95b1c9c-fa67-4243-ab13-9cf23f89ff70", "value": "562ad7f2a26f66ba2ae1950c604dba1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97e197e-4849-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693519224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693519224, "uuid": "0d26aa5b-9b32-4a89-a8cb-5f7fe0fffe8b", "comment": "Malware payload (RedLineStealer)", "value": "c6e9f88aaf7c41c4e0481d936fd0c409", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693519224, "uuid": "d25e9abd-0e61-475e-9740-5a9e444fdb24", "comment": "Malware payload (RedLineStealer)", "value": "9952bdd105c2983bfa7fcd7f832c7d4725133d6bae7548d86424dd6d1b391aac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693519224, "uuid": "33990ae9-c97e-4f8b-bdb4-cc3434438b0c", "comment": "Malware payload (RedLineStealer)", "value": "61d35a6f84d24c0c4b41881168302b7786631fa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693519224, "uuid": "41646273-9e42-4ac0-976a-660e7bd03710", "comment": "Malware payload (RedLineStealer)", "value": "848a99bdb702c2e3aa20d6b3a90be8ee56d58001ba8fd7b68a3ec57b897ae2636424aef18437689083a4e00b3f955203", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693519224, "uuid": "84b4670d-b533-4b73-ac9b-43d6e68525f4", "value": "T16135231BE7C49561EDB257B098FA07E30A357EE18A3C836B23564E0E0D332E49935767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693519224, "uuid": "9a34b80c-e3d6-4dc1-a051-ea68a869c812", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693519224, "uuid": "34628f31-5c2c-4b9a-b60e-ac892bf1f2e7", "value": "24576:hyR/8QCHY+XDeCoWE1DUDAJeYbF3dCkbxgLa5o8wImgWF+yglG:URk/4+XrobtYYJ3wkbxiz8jmgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693519224, "uuid": "a61ddaf5-76c1-4a24-bbf8-ced277e817b5", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693519224, "uuid": "7ce3451e-d749-4c69-82ad-32267330c08f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693519224, "uuid": "35cdd92d-3e83-43ba-ba6d-f5f0b27c85e7", "value": "c6e9f88aaf7c41c4e0481d936fd0c409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f269aa2-480b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693492417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492417, "uuid": "694a68ed-eb3d-448e-9ddc-c72bd7c09f94", "comment": "Malware payload (RedLineStealer)", "value": "5e7210ec52a4e20674dcccf065505f55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492417, "uuid": "18c680f9-0ad2-4a94-97b8-973ca28f34e4", "comment": "Malware payload (RedLineStealer)", "value": "99550f4b46a2b9b5f6b1e72116e84973ab22cbb2b1f8d2a03dc919db4cb93952", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492417, "uuid": "8b72a96d-9fba-4738-9ddd-e09d22f1bef5", "comment": "Malware payload (RedLineStealer)", "value": "66d8625e7248ab5f1c4751074a62c1676d789996", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492417, "uuid": "bd915dd8-9c79-465b-a46f-51885f622a33", "comment": "Malware payload (RedLineStealer)", "value": "eeea0a26128e524460c1d3474e4a663e03b70fbbfc5cca887829e06a35f861c9f782c8e147f0c5545ddf196c29d1f6ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492417, "uuid": "0e7430d0-ca5b-4bd2-9d97-e8d316ea3828", "value": "T1EE757C3378809061DDE714B68BFCB8ED427DA4F00B1E45EB26C817EED6546E23B35686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492417, "uuid": "0c600724-baf7-4697-a6f2-cc895fffa082", "value": "c7baa1f8b820f7451154e3ded9107d22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492417, "uuid": "99331010-87d9-49d0-a4fb-7ad6628510ff", "value": "24576:ByVFXfK8SqdIc8RXPFTrh3y/Z4uJpcuW:t8SqdIc+NNiZ5ZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693492417, "uuid": "f68b4110-281d-4c1c-88d8-1ac00c5c0dbc", "value": 1701376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693492417, "uuid": "8369bd91-6242-4cf1-9111-acf7e3a660e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492417, "uuid": "429f5fd4-842e-400d-b860-b5e80feac22e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b3fd65-47e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693475869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475869, "uuid": "9131cb6e-6b11-4e88-80cf-e564d78492de", "comment": "Malware payload (RemcosRAT)", "value": "443bf2d8983f6ca694ca047e9c9c2987", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475869, "uuid": "dd61d4e0-c5bc-44a9-a243-269574e09d92", "comment": "Malware payload (RemcosRAT)", "value": "9c3055f884f0c111916ae74a58017b115b89482776becd8dba6cec1b983b91e7", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475869, "uuid": "e5612a5b-2e41-4ccb-9e30-d1c19bc46d91", "comment": "Malware payload (RemcosRAT)", "value": "92fcf0f069283f79088dc67c07e59e88f87ab0aa", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475869, "uuid": "bb2ae64f-0804-4771-8e85-bed9d4ac33a3", "comment": "Malware payload (RemcosRAT)", "value": "0f551b55d25fbfb215dd52b7cf72717032842029f862a4c70c8b7975d31be42462398e41f77391d431ffcedf0dbf86de", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475869, "uuid": "475d0ab3-115d-4145-8b5d-7925627afc4d", "value": "T10E0533286A3A81C51E8934157652A7C7D18EC7CBEA741780D72943FFBFD6206B8ED81C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475869, "uuid": "f2b54d3e-47fd-45d8-921a-ecf254ab34d6", "value": "24576:zb9yR+j6iK4DLZmsq53fuiy2a6dTdpmH7TMemftFg:vFXZmbuiyH6dT2nZm7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693475869, "uuid": "feb56549-b5f4-4df1-a9ca-31eac6e2a769", "value": 853230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693475869, "uuid": "73f2a79f-aff5-44a7-9dc5-3f043b734950", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475869, "uuid": "77f65b59-cead-4526-8467-d33da16d8414", "value": "HSBC TT PAYMENT INVOICE 201.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde86f0e-47d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693471208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693471208, "uuid": "30fceb92-03cf-482c-87e3-3674a8885cdf", "comment": "Malware payload (RedLineStealer)", "value": "308717a99b5cd9701497bfd3e2276309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693471208, "uuid": "b7656597-bf18-4917-acb7-762420503d6f", "comment": "Malware payload (RedLineStealer)", "value": "9f8a9a96bcd4b50414604cbd67f282226a2af227972833725e133c60da35ad43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693471208, "uuid": "e1879975-25a9-4ad2-8fc2-9cf95742ee29", "comment": "Malware payload (RedLineStealer)", "value": "16720188fac4c8625c0bc96036817605b10e4301", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693471208, "uuid": "b6046b54-4079-45c8-ae28-3d9f4c0894e2", "comment": "Malware payload (RedLineStealer)", "value": "640c2a35d1e3f8f5d6e6a0962070a9e97311b681f59c01a23a43ab902b85922793bd60a8256ea4b6335c26309a56330d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693471208, "uuid": "affaea57-d1a9-494f-b3be-7e29aece1f0b", "value": "T102756B2FF880D361DDE711B746ECBA25866CA4B0071915CB56C8F6EFB620DF13A32586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693471208, "uuid": "4deeaad4-937c-4e1a-89e4-bad4751e8e4d", "value": "c7baa1f8b820f7451154e3ded9107d22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693471208, "uuid": "e0fca717-9fc6-4847-a5cf-a47034f2ed8e", "value": "12288:VmjymUhUJFXf6rt6x6vbA14LU0gApH0q17ia6r6QHrhbpOYmnVHnuHu6tgJhVsWb:wy4FXfDx6vbA1YhpHL+rhtObhsWXUuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693471208, "uuid": "46d9e316-0eec-43d7-9820-8c26011b7ea3", "value": 1655296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693471208, "uuid": "764c4f54-e3a2-4064-8c0d-656bbac8699f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693471208, "uuid": "812efa00-c761-42c9-9218-e7485c78d730", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.6.12804.5732", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a427fb5c-47e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693474064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693474064, "uuid": "fc860162-1d66-4d21-bec2-3893c19a8b91", "comment": "Malware payload (Formbook)", "value": "b680334c61f59a518e8af43d1468c33b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693474064, "uuid": "b470ac7b-aabe-4080-98a2-c6530906106e", "comment": "Malware payload (Formbook)", "value": "9ffa96e46faf0575d49897cf2babb92f611980b60b539483d162cda6ddc19057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693474064, "uuid": "85ae4cf4-fa3a-4dca-a553-c8f1afad0186", "comment": "Malware payload (Formbook)", "value": "61fc8060db6636dc2d4fca3a9e6ea8f4a74d9f72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693474064, "uuid": "baac0174-5943-4458-8088-9ed1f9e98b1e", "comment": "Malware payload (Formbook)", "value": "931b4be8fbb991cd3d1041d0da771df2b0ea6a263cade5bc8b5b3b027549d9d81854acd4da7d09eab1c2e450401eb2b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693474064, "uuid": "f8cead70-1f34-45bd-ad85-31655ec751ee", "value": "T11E7423643169C4AFD0B2CB30283AA658AFF9FE391C7693171B50165EBD7F182941E393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693474064, "uuid": "85286f69-bbb6-42ce-abd2-ccb1f29195a3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693474064, "uuid": "7bc2c881-33ef-4c93-ad5a-2ef6d6cb6591", "value": "6144:vYa6D+EInzxmI242mQ0r1KByoDlnOxzOQFGaJO9835lIcwOKEWaIPZv++UdSzCd4:vY5+EInzUIf2m3YMoDlOtKaJO9CY53PV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693474064, "uuid": "2d0b1d3c-d87e-4007-a612-1a909e55f5ef", "value": 359866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693474064, "uuid": "12e1c936-8cc8-4e21-af57-6f004c8e480f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693474064, "uuid": "b3a4b1c2-4377-4a25-9749-6bc37b88b925", "value": "MV. ZANTE VESSEL PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b24404d-47ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693452360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693452360, "uuid": "1559c4ed-2c82-4ac9-be02-e2855598c18d", "comment": "Malware payload (AgentTesla)", "value": "69e420e33866712abd3f45573a18c3f1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693452360, "uuid": "6a0e8c70-13c3-4696-b3eb-d56db6cdbe92", "comment": "Malware payload (AgentTesla)", "value": "a02d04f3d61c3b4922e54c12065178ce77135a450839134e4f11371681a040ce", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693452360, "uuid": "85914d75-37ab-4694-ab0e-4540b1da0db9", "comment": "Malware payload (AgentTesla)", "value": "effdc839eeb3d93bb5c68336917e8d990f27c66c", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693452360, "uuid": "a5bfb314-0589-41d6-a7d4-120cd1e7a8ad", "comment": "Malware payload (AgentTesla)", "value": "5f7d1997cdb46220b41798756a706bd4b3430527d8e1e844e2615b2d21312e62512c92d65ad93a905deb8692331179f3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693452360, "uuid": "edf9e719-63e4-4561-8fff-f25e67abe50b", "value": "T18CE433639B43E120BF5AFAB2400D937E2A7655D36952006D70D4E3F19AEB15EBC3F841", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693452360, "uuid": "39e40a19-4d8d-41ec-a8f7-1fad42be979d", "value": "12288:Y8MlnCLf3gK+f5B1cf00veLc9BC8tQmbiGXk6yNa4vMOF/3vAHfzFu2GSNefoXF9:BQCTbdfIEC8aWXkh8OtvcfzFDf/XUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693452360, "uuid": "9c5c8f92-a8f8-4bdf-be47-da1aa918b23b", "value": 719426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693452360, "uuid": "b847f7da-944d-4bd4-a197-46bdac91bed3", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693452360, "uuid": "bef9a765-4315-4ad4-98e4-7b03e0516e0f", "value": "Second Warehouse Order(PS) Packing List.xlsx.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2439b0-4822-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1693502403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693502403, "uuid": "a6ac1524-1d26-4bfe-93db-f4aa8f461691", "comment": "Malware payload (Tofsee)", "value": "7528efcadde7fa954158750f42fb787a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693502403, "uuid": "8e1b2c87-8cb3-4d98-9e90-5c01426c1442", "comment": "Malware payload (Tofsee)", "value": "a1212ba3d3135a4127a79a2ad2c513ecf400077c44f2ae45e6f3f3a5aa31ad7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693502403, "uuid": "f912cf03-04ef-4685-a46c-e6baa5d23c11", "comment": "Malware payload (Tofsee)", "value": "c45e5959a4dfbc9d2fc3d2beb49bee58e8db85b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693502403, "uuid": "0861b72a-d8a7-41f0-9956-1e4e1fa35b39", "comment": "Malware payload (Tofsee)", "value": "bc153d8c3046bdd0a6f57fe2d76cb9e45611bd57b5b56baa64cafabeea02ddb88b9236aa036e361d07158ccca11e79b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693502403, "uuid": "7b839469-05e5-4cc6-a040-1179aec09089", "value": "T16E24E011F7D1C0B6D053453015B0CA902BBBBC316A78A9BBA7185E7E5FB07C06A397B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693502403, "uuid": "c0d74210-d05d-4500-9dff-dc4ba7489d1e", "value": "e095c86cab8803cbfa52c1620fa35581", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693502403, "uuid": "b8952128-ee50-438e-8fea-aebc531a178b", "value": "3072:ulIOvQRk3dABjdQQooUX7+SDoCtc3orzkz:MwRk3dA/Zq+SMazkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693502403, "uuid": "d82dbdb0-d035-4de0-8286-9cadccc47468", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693502403, "uuid": "216cf3cc-175b-49a5-9e7b-a5dcde1d846e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693502403, "uuid": "3f542da8-5fe0-4025-b401-b0a2793b3c86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2b5869-47c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693464062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693464062, "uuid": "ae193674-2e1b-45d8-a103-050ab05f7649", "comment": "Malware payload (AgentTesla)", "value": "1b76068ef610fbb0669497621369aed3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693464062, "uuid": "a4be5caa-257c-4df2-941f-e0af1579bd54", "comment": "Malware payload (AgentTesla)", "value": "a42fc25e5c4b617629fe6867cb6625b17f18625b6a2102343dd51219bcd99760", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693464062, "uuid": "9a5d2f2b-76bc-4e0a-bff9-a65aafc8895e", "comment": "Malware payload (AgentTesla)", "value": "487059ae7b9fdd6c45b812b3d2a96b0638477920", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693464062, "uuid": "be8c31ea-dbb0-4f0a-8945-8af9ff01897b", "comment": "Malware payload (AgentTesla)", "value": "7b115c388ec92423fc48b59f15f49d05bb37e448ea4f8f25f99953099d2fbc0897e5572d61cfd64273b172fcef370f0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693464062, "uuid": "aef698e2-f8ee-42c6-a470-62e376d54651", "value": "T1A4E4F1F9A69CE8DDE98A2D338CBC550110666D89C47F86AFBC15395488F338275DBC0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693464062, "uuid": "1e253792-2db2-423b-b211-b2a2c31e3b52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693464062, "uuid": "3496ca63-fa85-46de-8abc-50780062c62f", "value": "12288:p/Z9pqJWY98fgmKqgqDLlR/KW03OQbx7hFQvgLt3Zz9qVg:JZ9peW08fZLDKW03OQBzYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693464062, "uuid": "caa9ccc9-c403-44fd-bd41-d6a9420d8cc7", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693464062, "uuid": "963c4945-e4d6-46ab-8477-bcf38b601393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693464062, "uuid": "7ebb24e2-8103-4c41-90af-02ed0e359793", "value": "SecuriteInfo.com.Trojan.Heur.DNP.Om0@aiFIFxg.26661.27696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ec8581-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693466358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466358, "uuid": "7c09d5f9-cc99-48c3-95e8-e29697bf67ad", "comment": "Malware payload (Mirai)", "value": "ef0b5709df2b68882dff234af3a5f406", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466358, "uuid": "2a3abecd-0ae2-4ef8-b768-f68fed285f4a", "comment": "Malware payload (Mirai)", "value": "a4327acb54fa4e44ff5bfce5927d603dfec03a02f6d237461db460b04339dda8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466358, "uuid": "6996afa0-751b-41b1-ac9a-b75df22f3736", "comment": "Malware payload (Mirai)", "value": "9a0727cf4ad5caf3975d0a8de9b0832b35439074", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466358, "uuid": "fb6745c9-2fe7-4392-86e2-600ed919d9cc", "comment": "Malware payload (Mirai)", "value": "ab550d769bf7e4e011d3c38651f0894f022ec802c480ec0e6c617add1e36bf07f0e15c898ca2e2651a9e2ebb9679c3e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466358, "uuid": "6f01ab74-ea38-4ab9-aa42-d0b8895f4488", "value": "T18E21CB9697EB6D17CC840233ECAF5720E322AE94C69EF927E35112251C3F31A1F31049", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466358, "uuid": "d6aad07c-ab4c-4678-8eac-e026bac08c7c", "value": "24:Jysdht0gP9qD0at6EoDbGP8rUlFSs0VzLCkIdsx2H5I7KF1NfO:J1/DFqDPtT8rkFSsCzLSIGLN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466358, "uuid": "c53548d5-f7f9-445c-8f33-f67cd6f26945", "value": 1176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466358, "uuid": "47ce8c13-9351-4cff-9d97-c60fd52ea9fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466358, "uuid": "29315956-4078-449a-9377-4d90451b7a11", "value": "ef0b5709df2b68882dff234af3a5f406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e87334d2-47c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1693463012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463012, "uuid": "205bf151-17fe-4e52-987a-c4248f1e258e", "comment": "Malware payload (Fabookie)", "value": "bc7ff726368fc78f8a2dcc4bee7201c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463012, "uuid": "3a61478e-c985-4284-bfbd-fe750eca79ed", "comment": "Malware payload (Fabookie)", "value": "a46d8675ca4d6973db87cf86c7209d7e247083633d8262a7f56b1975dbe52ba3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463012, "uuid": "31947c76-f5b1-455c-8389-46252e198635", "comment": "Malware payload (Fabookie)", "value": "c0f7493cac5313813bb51f9aacbc057552938d58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463012, "uuid": "f22c0cc6-b9d0-490d-829e-84959db0f2c0", "comment": "Malware payload (Fabookie)", "value": "2cb6dd81b18de3e352fcb76ab3c4e8fe15fd9d49836ea41ef5b50bf8fb96f2e388b31b28e2157dbb1b0903cedd86edc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463012, "uuid": "d67d867d-5725-4b63-8606-1a925bccdf21", "value": "T120647C56F36540B7E1528035C593EBB2F6B27C562B20134F0790FB7A2F336626E29B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463012, "uuid": "01adf954-cfec-4581-9f37-7bf1b4fca5ec", "value": "02a84429b024f8e8b499d5d5730c3f0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463012, "uuid": "a9c28404-a32c-4924-b94f-d301ae5e70bf", "value": "6144:q/ji2H5hOorWFoWdN46Jq6VWxtoloBj5rbx:qbOoyNdN9JPVJ6Bj5rbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693463012, "uuid": "44eb84ff-1b1c-423b-8a30-9ab314199e95", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693463012, "uuid": "a1aa41c1-9bfe-44a9-8e5c-22ca9af05bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463012, "uuid": "3ee2c018-020b-4ad0-8b0a-60c72fdffa4f", "value": "bc7ff726368fc78f8a2dcc4bee7201c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782d350b-4812-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693495465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693495465, "uuid": "2bdfe2ae-6da2-41c0-a809-40b50cb25b71", "comment": "Malware payload (AgentTesla)", "value": "765a7f3426de3365b870cc99538eda74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693495465, "uuid": "8d3db178-6a94-4dcb-a032-9c9ef3eef0d2", "comment": "Malware payload (AgentTesla)", "value": "a473ff3bfe26ba63b3c583fa1780f4e4b041b3815f656bf7425764a61c3224aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693495465, "uuid": "b2086469-7bf1-48f8-983e-7cd89836a95c", "comment": "Malware payload (AgentTesla)", "value": "d42101278e8e952942b3ecdfe92449d67cf834ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693495465, "uuid": "a9c60f5d-f98c-4d45-b5ff-94fac40581c5", "comment": "Malware payload (AgentTesla)", "value": "45c9652fdc10e4541347fa9073f3c2eb08df618194f12656046d8fbdba5da2b9ca43c5859fc000d3124542e0ba75fdd3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693495465, "uuid": "cccb9841-5e55-4bde-8cec-f536c490164e", "value": "T170E42308E19E72B34ED55D64F0D62E7D48C79F174D1128FB921AD0BE87E8CE1889E21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693495465, "uuid": "1ff848ec-decb-4869-97a4-019dc7596a9a", "value": "12288:i/81c2scSSyausdGj0gO/ySZ0HeEoqJF7ExoOw1NhpnJVcUF4AwY:i01c2s97auw/yS6+bqQxo7hXVXFrwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693495465, "uuid": "54a6b109-7c03-4107-9cb8-b811313b5f96", "value": 684646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693495465, "uuid": "10ba4ef0-e93e-485d-8467-b5e987da8931", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693495465, "uuid": "e1ec58cf-cae5-4292-ab6c-d817189a6e23", "value": "PO#006543678.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742393e3-4808-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693491164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693491164, "uuid": "d3a6486f-1c9d-4321-8721-02faa08b5688", "comment": "Malware payload (RedLineStealer)", "value": "9451cabb6a19f7a4610bc7abc27feddb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693491164, "uuid": "ad001a51-3a35-46ab-9b7f-02da0f4d98b9", "comment": "Malware payload (RedLineStealer)", "value": "a4ee2cfc1cbd9e298141bbfde343af98dd6f8ef9f72edae72e40689f894d76a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693491164, "uuid": "2ee29b33-3dc7-49b6-97c1-01a1f3bec656", "comment": "Malware payload (RedLineStealer)", "value": "fa064a2352b283669be8a781a7059d8005d22b79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693491164, "uuid": "9f8447fd-a979-44ba-9811-1965ab2c59ca", "comment": "Malware payload (RedLineStealer)", "value": "c323098ac369fdd7bc222a05244b421eee7aca01b7c6cf19517ac56033a2b11da43b7959c05163f9e5e759f6f49f78a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693491164, "uuid": "a5504142-b192-4570-9fb2-be640a98acdc", "value": "T1B4052397F7DC00B2D8B91BB428F687870B347CB2492552AF3B4A965E1D73190687633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693491164, "uuid": "0dac4de5-c3ba-4d32-8fee-02ffe773dc90", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693491164, "uuid": "9217af70-b0db-4a47-8d09-1b2f90ce5019", "value": "12288:nMrAy90jey2SiHFSumTGMYjvPJMIop5Nh+WKJlWUCucfRF583SYTYKcqst2c6A:nyRN5XeEjZMFXh+WKoxLfRL8CDqa56A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693491164, "uuid": "88397591-e9b4-4483-90a0-231a558730ca", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693491164, "uuid": "fb4d692b-2cc4-4a6f-af4e-f4528f945cd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693491164, "uuid": "92a82857-0fde-492a-aaa8-2a88786c6a97", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16aa2c49-480c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1693492725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492725, "uuid": "f1084c71-836b-4b99-8af9-005cfd1a06fc", "comment": "Malware payload (ArkeiStealer)", "value": "bf81661814944b92da689f1c461ef908", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492725, "uuid": "84f05d94-1760-450b-af2f-6bde34773f5c", "comment": "Malware payload (ArkeiStealer)", "value": "a524fce6eb4ee25ed07de294220d9c2445090b6c18b48802219149162152fea1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492725, "uuid": "1592f5d4-1489-4341-b72e-9dff8cf8db5c", "comment": "Malware payload (ArkeiStealer)", "value": "7e3235d7ce69217063f53840e6337633cc721ec7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492725, "uuid": "6b83715b-91ac-462c-b39f-31de9dce49b2", "comment": "Malware payload (ArkeiStealer)", "value": "5e35a9cc888674c7042653111d3331e6e15deeb2dcb6e7afd584bda5edea8d6626fe2278df2a4795a6d4a17fa4d28883", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492725, "uuid": "0b2bb4b7-c9d1-424e-bbca-1cb8028cb11a", "value": "T166A49D0352A1BC61E5264B729F1FC6F8BA1DF570BD897B663318AA6F04B01B3C663741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492725, "uuid": "24ae8e00-7f2c-40b0-a96a-479eb5d33aa0", "value": "2f69518aa1d8a1d2ce824b07104b5c0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492725, "uuid": "be99ccc2-3b19-4ed1-ad58-f6a88a28d212", "value": "6144:WWcIRLTO5mqX94gHnlqzeI+Dv73D7yAACFNs3/Aw/OzcGzVN:0IRLTRC94gH8zeTb7T7yNCrs3IzzcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693492725, "uuid": "852895f2-3568-4cce-affc-a33217e8f607", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693492725, "uuid": "8f41f870-a00d-48c7-9350-9e4e3577a61b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492725, "uuid": "ee23d912-6d03-4e8a-8b70-c176eb8008fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81169b8-47c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693460407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460407, "uuid": "28708f33-2fd8-4976-87a1-5947d3d438e9", "comment": "Malware payload (SnakeKeylogger)", "value": "94479278aa85e2fbb5bb01078cd0b1f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460407, "uuid": "85127c8a-f495-426a-92be-15bcfe1cf697", "comment": "Malware payload (SnakeKeylogger)", "value": "a6a941ea3495f88aafd18a5feaa9fee285912255a2ae6556c090a6321f7feefb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460407, "uuid": "7e424200-9640-4993-8a61-330968912452", "comment": "Malware payload (SnakeKeylogger)", "value": "e367050dc6f8eb61b1b18f4bd7ac376b05c85404", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460407, "uuid": "993c512c-4953-4a7a-8ed9-fd6bac2d68f1", "comment": "Malware payload (SnakeKeylogger)", "value": "93814fd420d4bbea4b72c181e49b8735f15379502075eb187a3cc74a21753db78cccd3b3bbb1e9a15c6595dfdb38415c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460407, "uuid": "a491bceb-56f4-4cd9-82df-4bfb5196c503", "value": "T122E4121891BD5713E87593FEA060A30403B26755A331E28D2CF9A1D7EE36F468EE5B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460407, "uuid": "600aef6c-a002-4257-9c0f-2587a33e1c32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460407, "uuid": "3e3a8504-5e6a-473b-878f-e08943ea0566", "value": "12288:kufOZ16VTQ1j9T9RG6q9srDdim9mQ3UInfvho3HlvEfmKd:bWZket9T95+sNF3Zm3Hlum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460407, "uuid": "2ec01cca-b81e-4d96-8ba6-1a9c1ce67fad", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460407, "uuid": "7cd3f2a8-abd9-4002-b905-c5b6b43e63f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460407, "uuid": "5b827c2e-d9d7-4eb2-a3a6-3fd50745a136", "value": "Acc Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64baa28b-4835-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693510465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693510465, "uuid": "c6ed3e63-ae19-4987-8e97-747714614c43", "comment": "Malware payload (RemcosRAT)", "value": "f79093c8b632acc16ca7f4a3b982d957", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693510465, "uuid": "2cd5c753-81ee-43f0-9396-c0ba6e512787", "comment": "Malware payload (RemcosRAT)", "value": "a8c7f79f118f3ff57bef79b5877355adab4269c99a6c61dfca429a46ff0fb357", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693510465, "uuid": "8e8355d3-a05b-41eb-885a-c50f2a238b7f", "comment": "Malware payload (RemcosRAT)", "value": "38359ac65f4df8cb0057fec6fe7a5e259c3446c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693510465, "uuid": "290f79c3-c9a1-4cb7-b93a-9d6bd704a6c6", "comment": "Malware payload (RemcosRAT)", "value": "057d5f0bd9f2243f2381d2e1917df2f2d5c62efec08bebc1475af0ca258c513d2dd77804720fdae84df8a4188f6610ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693510465, "uuid": "1937a0f2-8196-4ee7-9780-2191d2ac213f", "value": "T10BB49E01BAD2C072D97514300D36F776EABCBD202825497BB3D61D9BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693510465, "uuid": "6994a54d-aa10-4d64-b84b-36470226bf3b", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693510465, "uuid": "ea746dd8-a38a-4071-aba3-83e3592f7436", "value": "6144:Qu/TwNrjB5ikgxx+bdPoWYnRmCgEVAWK9goN1dFv/xpM9rsAOZZpAXNc7cbv:Qu7wNB5iedQ1RmPEVAWONjpcs/ZpQbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693510465, "uuid": "d85acff8-ae03-491d-9470-784b87e102b8", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693510465, "uuid": "d615c241-38fc-4155-a99a-252ba1c44580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693510465, "uuid": "01ef76d3-119b-4051-8278-2eb96b3e56a4", "value": "x7qEy4NrEjee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd8e47a-4825-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693503478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693503478, "uuid": "f15a3df5-657e-4bce-85e2-3d4ded288b98", "comment": "Malware payload", "value": "2d02b1d2ea79eaebda6d221ee6e8fdf2", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693503478, "uuid": "8054485c-0318-408b-b384-e94b729a16d7", "comment": "Malware payload", "value": "a8eed563dfc4c42a1f4aae628df948566bceda3aa3297eb61647156a52737e6f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693503478, "uuid": "5f9b0fb7-9f31-4254-a0db-7f82f4849c1b", "comment": "Malware payload", "value": "5a37216d4175024e786f657c9dfa5c2de2c7851f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693503478, "uuid": "236cf6c0-adeb-459b-a61b-fd25ba4daa0b", "comment": "Malware payload", "value": "a0638e51fbe7bd873d8e10ccd890edef8b0e941bf5612b845b0efeb0df065819d881c8775d133c1754751fb6b4bfa4b9", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693503478, "uuid": "0e3865fd-38eb-4585-b146-6be1b7b2755e", "value": "T185A523113B8AC536DAD60731417787B52A697CB51F30C1CFB7993A6C5B32AD2A938323", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693503478, "uuid": "7ac1ad1e-505e-4406-a42d-82fab8304440", "value": "49152:mpUPhCTtpQOcLFqCGSO+XTX/PJtpiEOzAcrgAuzGPDWfec7zR:mpgMtcFqCG4DX/UEOzjrgAuzoWfec7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693503478, "uuid": "1880b073-b00e-49c6-a897-8fb4c4822d65", "value": 2174976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693503478, "uuid": "58b74543-56bb-4c5a-9386-065811a1b527", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693503478, "uuid": "5cc1634c-a465-4089-97fe-3f142dc6cd72", "value": "okkk.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0f1f27-47c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693460414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460414, "uuid": "8812339f-a9a9-4082-bf89-f5d951713b5e", "comment": "Malware payload (SnakeKeylogger)", "value": "270831ef4d96ebbec003b22ebb676c78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460414, "uuid": "c81a2784-df6c-4e92-9b11-22a315ba841e", "comment": "Malware payload (SnakeKeylogger)", "value": "a9ab4e13cdbebfec5197adfb01e69c3e1452c2dcc693bc366b082ef63cd5e3aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460414, "uuid": "1754d831-90d5-4614-8766-1d868ba5cf5b", "comment": "Malware payload (SnakeKeylogger)", "value": "39e3b58af2331d970431fdec17efadb43c4dc8ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460414, "uuid": "50f18e65-a7c4-40d1-a83e-d48ebf515b9d", "comment": "Malware payload (SnakeKeylogger)", "value": "bf7034c2e93fb5ef24da8ca96e6b1a85dcbe185aae5f00c79d894b5c81a9d4a654547fdf1b73c658d44aa3b8556e8924", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460414, "uuid": "a4f9c760-5efc-4f50-9b0b-c3aad0ac8ef1", "value": "T138E4232891D81363D5B2C7BDA674772807B1B3106732E34E2EE191C65DA2F12DDACB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460414, "uuid": "5498e21a-6cb0-41c0-a8bc-5ee23b5aadec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460414, "uuid": "cb17d9d6-935f-44cf-94a7-93d8bf906f2a", "value": "12288:9wfOZ1qtmG9RjHNdFR8PvlUFkJJJUFe0tVG1gRF:KWZLG9FLzKnoFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460414, "uuid": "030a678b-e976-4877-bcdf-84e22269ac74", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460414, "uuid": "eb6f9b04-3074-4ad2-b96e-53f217fc1984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460414, "uuid": "493166b8-51fb-42de-960b-1c211820bb16", "value": "Current Price List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64db03c-483a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693512776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693512776, "uuid": "5111a5ae-9424-4084-b642-26e69121f273", "comment": "Malware payload (Smoke Loader)", "value": "f40e9364ab5804080cca42e0e201b89b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693512776, "uuid": "4d63a87a-1922-4cfe-a69c-0860a262d814", "comment": "Malware payload (Smoke Loader)", "value": "aaa4711bade536afb177325d7971df195bbd235238531c57adcd2c2a7d98c5c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693512776, "uuid": "1fc83861-64fc-4e2a-bf0e-2d8dc6ea2d02", "comment": "Malware payload (Smoke Loader)", "value": "35c24766966dcb152b16d0ea25132da84f08f0ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693512776, "uuid": "e555eae0-abeb-424f-a05d-55be3d3705b5", "comment": "Malware payload (Smoke Loader)", "value": "57739fa1abeae9b78967bc7dc45bac33129238bdf7202a05f35fc7d29e28a427fed77dfbccccaa5cd48e73211eeda090", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693512776, "uuid": "8eff7dc1-9a13-4fcf-bf1e-93c000332d65", "value": "T15224D021FBA0C037E063457144A1C7B45EBA7C611A78DA87AB982A3F5EF07C05B79397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693512776, "uuid": "f8e7896a-4821-4a4e-813d-00fc7d0d6149", "value": "ec0247b44470961b20f0db210d28af81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693512776, "uuid": "1b155ca9-34b5-4c5b-8012-42c6f0e24aa1", "value": "3072:vKLxYvgRbgBeCiP+sIvTN718RjtrlG6mk18/5d:vi5RbaeCiWxF18Jtrl/m645", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693512776, "uuid": "54130013-145d-47f0-8b03-fed359523f86", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693512776, "uuid": "2df73c76-cbf8-48b5-a388-0279dc887467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693512776, "uuid": "af7217d8-381c-49cc-acdd-07f6beb501c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e067be6a-47b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693454408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693454408, "uuid": "e58e9d5c-9680-4d66-922b-10adeb26ee1d", "comment": "Malware payload (Mirai)", "value": "17ca0c6e6ad70d1fe500c9b8a7541ba1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693454408, "uuid": "a007595c-500b-4298-a976-8e0359639f37", "comment": "Malware payload (Mirai)", "value": "ab614ec482e045d9949d6335f31d66adeeaad509179d837d3b9d119227b76a67", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693454408, "uuid": "29e9fe7c-dc21-4f2c-bcca-e5747aa57f1e", "comment": "Malware payload (Mirai)", "value": "01eb33d911ae086b911376a3653133f2abea153d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693454408, "uuid": "659987e5-cf45-44cd-91e6-eea5a9e29257", "comment": "Malware payload (Mirai)", "value": "a210e121667265c8bf2e1da43d1bfe0ffb2bbf0cd5b94988df4193156e864dff764232d7b1f1f87fae3c4a0c49b76e26", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693454408, "uuid": "6a98baf7-ff70-4265-8dd4-a9038ad4b3ee", "value": "T1D1A2E11572A32D56E3ED1C3DC96E831BB9A70BFCD0F632766D415620C94D20A3E39A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693454408, "uuid": "b871e9b6-c6c7-42f7-b5e0-5f89f0396aa4", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjohymdGUop5hO:vvQn4j+ZO5fKAlxss3Uozk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693454408, "uuid": "5f87f87d-b5d9-42da-a88c-ec18f0b19375", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693454408, "uuid": "4633f5f3-350c-4c80-a69f-ef78eaf39a2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693454408, "uuid": "7ef9c525-1300-4815-979b-2e1569dd0308", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96433b85-4845-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693517420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517420, "uuid": "279c4530-9cb6-4e8d-af88-8cfb582f70a7", "comment": "Malware payload (RedLineStealer)", "value": "b853002555ca924961c8cfbf9a97629c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517420, "uuid": "888d897c-a8dd-4a01-93f2-12ad54c3875d", "comment": "Malware payload (RedLineStealer)", "value": "ac09e247dbe7d255efc93cf1f2d25ca8378893dd7ed17e90065b8bccb80f5983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517420, "uuid": "42bdfb61-96ce-45bc-8aee-26ecb0f180bd", "comment": "Malware payload (RedLineStealer)", "value": "a615e9e1bfb89b60bf464dc271f8c24da0e938c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517420, "uuid": "86ef1005-4643-41c1-a7c9-0bf5273ccd14", "comment": "Malware payload (RedLineStealer)", "value": "22bfd861a830ca50be48f98509550e123ced883a648c28c164eef9f082a89777d01b9f36bfdbffb793837ea24d8dcf16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517420, "uuid": "16372355-163f-4e75-b078-d9bd840f5f18", "value": "T134352326F3E59033EDB66BB009F626531539BD906E78835F1A08AC590C77686B47332F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517420, "uuid": "7efb6182-1f36-41ad-8cdf-94e7e788d62c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517420, "uuid": "b05d0dea-129e-43e0-b36c-9d6c11dffce6", "value": "24576:Iyyd2txZjjpXYfqkxJRRJi/Au1gf+BJxY8Jo9a5ioEywMfwTINg5:P42txBpXYXPJWjzxYMmvoEy9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693517420, "uuid": "73e0a151-8c40-48da-8f64-fe2056eff837", "value": 1149952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693517420, "uuid": "04319b99-aad7-4024-8d5c-fdd7d27b19af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517420, "uuid": "38f1f30a-3c92-4e1c-ae3f-d67449761617", "value": "b853002555ca924961c8cfbf9a97629c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73696d76-47b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693455944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693455944, "uuid": "12fd2c4b-1af0-4a3a-8a53-6b3ad052bb26", "comment": "Malware payload (AgentTesla)", "value": "e46413d6e4171762b627fba68de38951", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693455944, "uuid": "a3091a5a-46d0-4e4a-b230-810962686923", "comment": "Malware payload (AgentTesla)", "value": "acf6272cc20ca1b49a18b2c532b4857fb690ca849e5acab504da319a85d8a35e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693455944, "uuid": "825f92f0-99d5-43ef-a911-3a602317e709", "comment": "Malware payload (AgentTesla)", "value": "2e7d6dc27748090e17d340d53e3765f254d45c9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693455944, "uuid": "70da4367-01e1-44d5-b1b7-918fe062f6fd", "comment": "Malware payload (AgentTesla)", "value": "d929252e07a8fff930de36013e56d56b57cbce014e1ac77a00f8117a01a24c0086773ea5b743be953ba74671c372ded1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693455944, "uuid": "1b10bdf5-0d73-445a-90e7-e487b5a6f2f6", "value": "T1A8F433240FB395F59C9240E238C844F5E5403A9B71C9906BE972760F7BFAEAE540F5E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693455944, "uuid": "19fc2e2e-dda1-40e4-b2c2-e7539a4075cf", "value": "12288:A2nWq6ZIJgkUqOw8Gs2obrs03LP+vikbV1COwbItnRUtz8Mm4asAsWKcmAQGSOaE:vYiJ4xw8t9kO66EV1XRUt8bJsNEmOTOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693455944, "uuid": "126fca2e-bd03-4b34-b188-85f6cd73f883", "value": 753233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693455944, "uuid": "481c285d-3f14-4b01-bdfa-a51f3e9ace47", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693455944, "uuid": "f6b6c496-b68a-4892-aa4f-a25712843f41", "value": "Order_list_(P.O_R477304).xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600bd4ed-47ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693478245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478245, "uuid": "d8c9f4cd-62ed-42c4-b691-418c57a47196", "comment": "Malware payload", "value": "a7d22b730d1cf1cef7db1d8b87fa66d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478245, "uuid": "c62f2f2a-9377-4d14-88ae-8eb462933862", "comment": "Malware payload", "value": "ade8d6dce1824c8128c0274f283a46183280ee83b44274e1f46a4871719954e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478245, "uuid": "ab6fe204-0aff-4709-a13e-f22d678b5730", "comment": "Malware payload", "value": "988335a1530aff0e01f73b5f77315817bb17e52d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478245, "uuid": "cf729c49-9fd0-4edf-88dd-5f6b1be5ab99", "comment": "Malware payload", "value": "c42a8fc41480dfc496f8a30a3de51a1e66e9c8d579e3bdce788a057a50a72edf4519dc7cf8da8623aa0868b4175c9fad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478245, "uuid": "cf97bd7a-aa68-4f15-9536-f11ac960b1dd", "value": "T11DE633027A4121F2D97364304EA5BF90B47BBA300736CDAE7798CCE68D326D25719F5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478245, "uuid": "061772bc-be10-4d27-85d2-746b6768a755", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478245, "uuid": "fab667bf-74a8-4451-aa8c-37c62f885189", "value": "393216:7Uh2HFWevyHJUTnf+Jr4Bejf6WRWbDlZUEFxEDoOX+wobJnto0:7UcHFuHJU7EjCNbxNEcsjor1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693478245, "uuid": "c559d34c-2fb4-47c4-9136-aa0a3cb07529", "value": 14095550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693478245, "uuid": "83794fcf-6de1-4e67-8a1d-b412e3811517", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478245, "uuid": "584e28cd-fe55-4a48-91de-fd2156f52c7b", "value": "rust loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244cb2ff-4821-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693501767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693501767, "uuid": "ad59dfad-0175-42ec-a57b-f803dc5adebb", "comment": "Malware payload", "value": "222cf7fb823aedd40d2b57b2a8d5ea86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693501767, "uuid": "9a3f00a9-ec5a-4be4-b9e8-7df74929cad5", "comment": "Malware payload", "value": "ae549e5f222645c4ec05d5aa5e2f0072f4e668da89f711912475ee707ecc871e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693501767, "uuid": "ac8bd562-e11e-430a-9b63-9ab52fab3671", "comment": "Malware payload", "value": "1f0fce06fd1be6318f4adeee0fd9746667f955ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693501767, "uuid": "2a8d9d06-10f6-4f1a-99c7-0877d93cb41e", "comment": "Malware payload", "value": "90101390db856f8934599c6fd20a51bcf993d71cd30fd082f5da0de65c0255acde40e5cfc3f672f6c92021ffcaa0cb0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693501767, "uuid": "0352254b-c14b-441d-a156-0dd48472b0fa", "value": "T1B2C22904B768C23FE3AC4B796473521042B1E6A7A503DA8A6DDC50E67A23BCF47416DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693501767, "uuid": "49c0be9f-c1fe-4ae1-8b50-76605e9f074c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693501767, "uuid": "18767e45-0df8-4773-983e-a26c88b03dcf", "value": "384:ZIuviQDw7RO3m94yOcTmd8zMcSm1oiV0EOycOZsbs7RAYwQpIf//cteQjRhZEz6/:ZIuvZDwQW9Wd8mm1oI0OsQF3CjzPol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693501767, "uuid": "86a5f44d-b49b-44dc-836e-d5e2b3a3a8f2", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693501767, "uuid": "be27b638-f823-42b1-a4df-654b9d5edd0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693501767, "uuid": "a0d5ae28-03f5-4830-9151-ad912b7f4ae6", "value": "ruzxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1196fb63-47ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693479402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693479402, "uuid": "759e5ab0-7df9-4f13-8d8b-31e0c7f61a68", "comment": "Malware payload (AgentTesla)", "value": "5fa6455b37595abb523059f2834e08db", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693479402, "uuid": "3a626190-2816-4576-9a86-c1a62160ee46", "comment": "Malware payload (AgentTesla)", "value": "aebf1dd23c2e0a0fbeb5ad07d0fbfaab7eabef26ede6389224ee5885a39c605c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693479402, "uuid": "508ef111-69b5-462a-8f09-d7bf29fc7cf7", "comment": "Malware payload (AgentTesla)", "value": "35ceb910520755d453fb86b068f2b1c82c28b0e9", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693479402, "uuid": "8364ed9a-ef1a-45f6-b613-4c797ec744aa", "comment": "Malware payload (AgentTesla)", "value": "8b9c33b53f37f6433836a4bda61e67c87358aa95aae1002da5311f16ea0a4a6035f4038cdd3fefa9cbfffca9d65ed81d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693479402, "uuid": "8c77eac7-6a36-4e5a-bdce-527501da6c47", "value": "T13CD423325D8DD1A8BA7061B4FD57C50337BFB380868512E297915B2706D2228BCD9FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693479402, "uuid": "89e40ef7-d133-410c-ad14-4cc93acf1ca2", "value": "12288:ZePdPgg5i23HjCBXHfTZXm+8ptFLgs57x0VQGbN3fUr+DblU:ZePmYi22BXlXm+GLgQ7xIQGbN3fUIblU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693479402, "uuid": "34e037d0-1989-411f-870e-29baae983bcf", "value": 619084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693479402, "uuid": "acd918ff-6dd3-4518-b006-ace0188dfd9e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693479402, "uuid": "197f37bb-a753-41b3-814f-e0e3143c941d", "value": "\u6674\u7f8e\u65b0\u8ba2\u5355OP53532.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d94b373-4809-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693491475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693491475, "uuid": "957734c6-f2c0-4c25-be9f-872e2df8f030", "comment": "Malware payload (RedLineStealer)", "value": "76d6fb3f46995e9a2d7d947aa401c85f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693491475, "uuid": "52e216fb-6820-4ab3-ba00-13148d1407ee", "comment": "Malware payload (RedLineStealer)", "value": "b0834a8e1fbacdd4fc8f34e4103dbd9b83e847206dc6ead63561722c5f03ea27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693491475, "uuid": "ce940fc0-213e-43f4-b1b9-e99a3b8a6c1c", "comment": "Malware payload (RedLineStealer)", "value": "e506b13eac3c89b815d83702690e0400987e25d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693491475, "uuid": "b9d848dd-d013-4b7f-80f4-e5c8532ba6f7", "comment": "Malware payload (RedLineStealer)", "value": "b7b1cb7a5f0d78f923cc7756b39ff60989364c5eabc1c389e87408feff11dacdf9022a8423e430088474ed5fd778a3ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693491475, "uuid": "455331e2-89c7-4d4b-a0a5-f8906d510cf9", "value": "T15D94F126B681C037F12316740EA2C7756B277CB14FA6A8CB57C05B7E1E343E29A39356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693491475, "uuid": "11c7a8a7-4040-4c26-9c50-0c47b1fdc0bb", "value": "c614d8d8bcef689d6675c8b116f7714c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693491475, "uuid": "aabe71b4-a078-4816-a480-da46cf31dba6", "value": "6144:eLkpngcuVbGHDjEl7tweikvfgE65l0ozABEAHfIjEWz7IpoU5H3F:e2ZuVbGjjAxwpogbzvzA2i2UpoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693491475, "uuid": "73968fe0-d9b0-4fb7-8aba-0a6cd7c6ee94", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693491475, "uuid": "a018d69a-b940-4efe-8629-bac0ef3129be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693491475, "uuid": "3559de55-a8dd-4f9c-8aaf-1654b6f7917f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b1e81b-47fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693485321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485321, "uuid": "2c0f3cb5-ad5a-403d-bea9-f11e3a253a27", "comment": "Malware payload", "value": "15c588ca4a424961abb8ff61557996c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485321, "uuid": "4ed7babc-05ec-4f41-b07b-184fc04c2c1b", "comment": "Malware payload", "value": "b117097c81742dea535dbe2919273e7f9e61b3198e1e8adf721370e11b645cd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485321, "uuid": "0d588e3a-5b0b-445d-a73e-d708a72d49ad", "comment": "Malware payload", "value": "b917c5f2eafd42d843318c6799467dbdddb4113d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485321, "uuid": "113c11d9-9894-4005-ac73-3f99c7ae8b1c", "comment": "Malware payload", "value": "aa1df043c47d2037c031668bcee013610c2efdabda0c7f14821bfd5671a1db3f6c3770f38e6e478cb8a6baeb6987d0c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485321, "uuid": "88f4e1ab-db70-44b2-8146-cf2a69d2b7b1", "value": "T11063A40BF1E884FAC954C97650D74662B32B9DF1AB4F07622C4D93902B8FA591D2FF48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485321, "uuid": "824a0b5f-bb23-48e9-8786-f9ff6610d424", "value": "192:dID/9RbWl6fUQ/lndlpq9fd/hkoaYGL8aBfNV1fbnUD4eA5pjTVU7VDl2:87bWfIoaYGLnNTjS3U1U7z2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693485321, "uuid": "f8b5ac46-59a9-40e4-911b-5ccd7f54b571", "value": 69980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693485321, "uuid": "a385da5a-967d-421b-a0c3-d34083ea2ac2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485321, "uuid": "8e92b8a4-035d-4642-90cf-5691b56c12f4", "value": "SecuriteInfo.com.Other.Malware-gen.479.14835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3412fd57-47e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693475165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475165, "uuid": "fc2347f9-10a9-456a-ba09-1b53b251e4d5", "comment": "Malware payload (AgentTesla)", "value": "20f4e595fa1456e0079e3677e0e937bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475165, "uuid": "fe5fcef0-7ec3-4e8b-a904-a35dc8307da4", "comment": "Malware payload (AgentTesla)", "value": "b127a2d6e3b9ab44bf923e3b82b7dee72d078fe9d8b490109efa4271ac9cfb1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475165, "uuid": "ea1c7d6e-f78f-4ef3-a34c-f8a8ba4fa200", "comment": "Malware payload (AgentTesla)", "value": "a88df56c17e41b2076d1868568992aefd24b8568", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475165, "uuid": "750454c7-eda4-4796-8c4a-8a3254e520d5", "comment": "Malware payload (AgentTesla)", "value": "ad4ca19f4dc431a3b5ca4f0ab1f1726fc438615abe0aa286643f2c57f1c0d1a094fceeb5cd0f87dab72c5aa2f2ff39dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475165, "uuid": "f5c2a58f-e51f-4295-8dbe-a89cf502c45c", "value": "T1CF156124D070B3F6FB4117AC7167F75002844BFCFA9C60B86EA7AD09A0933965ABD5D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475165, "uuid": "ef228acb-33b3-4063-91da-afcf431999b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475165, "uuid": "8282b612-da7e-4f7c-942a-99f033ecd56a", "value": "12288:mDaIkfrIkfeSWrdkDY6J+s1VGZsTdFh0lq994hiAwXykosk:m2IkfrIkff6dF6UfCTqlq9lnXposk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693475165, "uuid": "a52859d1-c807-4b2c-9498-4ce6cc3c1bd4", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693475165, "uuid": "3d3b0a14-4698-47d0-84dd-65943ec6b873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475165, "uuid": "f5c4cc6f-d2bb-4592-bd79-26a8d2c437dc", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.FQW.gen.Eldorado.13255.18544", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13168f9d-47c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693463083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463083, "uuid": "8902ca2d-e0f9-456f-a75b-ef69f6f6222f", "comment": "Malware payload", "value": "c79eb90e5b12a16b8caafca72d3f4255", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463083, "uuid": "dc82c5ee-4d50-4a6a-b1c1-af44413d0a03", "comment": "Malware payload", "value": "b410d3ee796ecfa18292f6c084161c31ae03253c0be3f28efa1682083e7338a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463083, "uuid": "d6580699-1d09-4111-a7fb-aad5c73c9700", "comment": "Malware payload", "value": "9ec661dfcfc61f227fb14462fd192ba7f10bfd56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463083, "uuid": "8ecc1730-dd2d-4389-bc37-edd51a6067a5", "comment": "Malware payload", "value": "6449caddd04a396b5cda37880996c86ee2fa355f688ddbfa55cd8382353a4ab8554eed38a1b2196eea1b0b54b3c57f10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463083, "uuid": "2521c2f1-9814-412c-aa3e-9f4ffc90cd01", "value": "T1A725D7109701532ACCBB75FA4BAE703DB10CEAD01344A5C745C86AFEDBAA6F13D3549A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463083, "uuid": "864d9517-8532-48d3-b7ab-f7eb6cc19690", "value": "12288:Hh7yKwBpUVk1IvLlB9EUEurBuWdJsMLUWR24KVdR803KOK5OU7qOcnPWuZiA3nhY:HBcO19SWdwWRhpHqPPWuPnhMll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693463083, "uuid": "b0a6eb2e-60d2-4880-bfe7-1f670241b582", "value": 985500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693463083, "uuid": "eb124a65-a7a8-41c7-bb85-8e333239c6b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463083, "uuid": "00ce3a1d-efd4-45c8-8758-a7925a69e7f0", "value": "c79eb90e5b12a16b8caafca72d3f4255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8aa1f71-47f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693481400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693481400, "uuid": "e67689ca-b511-4806-aefa-a01f10c808cb", "comment": "Malware payload (AgentTesla)", "value": "eba9a1b743995e42862e3dea25db1e26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693481400, "uuid": "f693ef47-1686-4db0-9b61-9c1f9f59ab5a", "comment": "Malware payload (AgentTesla)", "value": "b5169b6fa30cff601e0f3473f0a95006767553560753831f4e7f365758011433", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693481400, "uuid": "50142ecc-c2de-4b13-aabb-2acb33b38049", "comment": "Malware payload (AgentTesla)", "value": "c3a03e2705f0085ee86a72358eb982b2faf7a001", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693481400, "uuid": "d396cbfe-4e78-40d7-a2aa-db96ea5328f1", "comment": "Malware payload (AgentTesla)", "value": "7e4a7a78e2053c75c95fc11df3aa3d0151d5a41967efb582a40295cfc2909f77148ab9fcd9aec89788646a01fce2c5fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693481400, "uuid": "cb0a2a49-fa19-48ab-87f0-198083752a82", "value": "T11DE4E01836B81F26D6B8C3F58574655817F876AE253BF34C8DD274EF2A61F820A41B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693481400, "uuid": "4b8001ed-946d-41a6-8028-000c801e3b88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693481400, "uuid": "3449ba2d-35cd-46aa-87d8-626303799ff1", "value": "12288:970wbqMiz0S41SC28Etmchj9mKoXHCB9UhRcOJ5cdxU:9pb3wH8Et5j4yn5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693481400, "uuid": "d73a6cc4-f2c9-4885-9a03-f4aaa6075c5e", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693481400, "uuid": "35b44fe5-82bd-47ff-8b15-588ec91aed12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693481400, "uuid": "ea641c6f-e09a-41dc-858a-833b29b95967", "value": "PAYMENT APPLICATION.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9499894d-4837-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693511404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511404, "uuid": "e9e91387-6554-4a12-9497-529dfabaafc1", "comment": "Malware payload (Mirai)", "value": "c30d1bd99b3ced68e23f7839952fb91e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511404, "uuid": "f8e6ce0c-e09f-4339-9ce7-c4fecead8d16", "comment": "Malware payload (Mirai)", "value": "b6ed9e08022f6f1e31eab859411bd75d7ce3bd8d23ef54e06bc0c056462372a6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511404, "uuid": "6e3cf42a-60ca-4d0b-9e08-0383201aa51b", "comment": "Malware payload (Mirai)", "value": "a8749229568a12a774b8cee462a46f009ed1c86c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511404, "uuid": "0da14ddf-c9a6-4793-a5e7-e95247183129", "comment": "Malware payload (Mirai)", "value": "c5ea5d89f5312cf77f029611ea90793b2be40430057a693a5fe0dfa7b576cfa6fb23fe03f1ef742179ac490e676d1725", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693511404, "uuid": "9d1f769a-963a-47ec-8d43-17de01d5e7fd", "value": "T1EAE2F12A029F874BFED8B2F7EDCC30A44CB56E6623FB8F632D0858D112176C515A585B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693511404, "uuid": "c9dfdcaf-9614-4b1f-b611-42cfec72b55b", "value": "768:wq3yhi2rg98FdmvPyQw7NABkcEfcVyVVtXZE6lZPrNIYGoPKc:7iFdmvPgACcEfcVOlE6nDNIYGiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693511404, "uuid": "259292b4-6a8c-4962-910f-6b439865020a", "value": 31352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693511404, "uuid": "36606883-d0b1-4c50-9dd4-b451e4a9558b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693511404, "uuid": "fd079cd7-d6b5-4843-a7aa-3f6d277bce8a", "value": "z0r0.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d4ef78-47f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693482904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693482904, "uuid": "4d785395-3e01-496c-abca-9c58931ac9a6", "comment": "Malware payload (AgentTesla)", "value": "ea97520f8e1283f2e2cd16230478c164", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693482904, "uuid": "e48dc6c1-0aae-4a6f-8573-61786f2dcf28", "comment": "Malware payload (AgentTesla)", "value": "b71e956546baa2b1f867e650a45fe9b60cd7160c311c5c2cb49785da8a57b40f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693482904, "uuid": "d6a4f32c-b291-4f1d-b54e-fa7407f779a7", "comment": "Malware payload (AgentTesla)", "value": "e6cc862c9b7dbd662ab9821c08def69de9eecd7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693482904, "uuid": "dc8b9dd9-9a20-4c1d-813c-3334739d96fd", "comment": "Malware payload (AgentTesla)", "value": "435e669191b9beb5372b4a7765eedea8c42a283b087877bea4cdb45d52cc257c2299741e5670658c86ac64d85f536474", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693482904, "uuid": "36163ba1-bed7-4123-8b26-5507eedfb46b", "value": "T18E05230341C55C4CC4A2A3FAECDBD581837D5DB3561EDC79EA3C8D5A062A32C372AE66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693482904, "uuid": "68425c24-51f3-4cd4-8437-1b0df94824ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693482904, "uuid": "c82ec800-ac4c-4fe9-85f8-25bad272ee3b", "value": "12288:y3q5rqSgNU1yjN2AwYxzGHOmcnYMFBfj5iiFKv+FhaUfmv8+QqFvW/hzmRKrcZh:7JgeIjNwkGGTfj5iiFjFho8+Tm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693482904, "uuid": "7fce635f-8a53-49b4-bda9-d2d01924f1d2", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693482904, "uuid": "3d782092-b409-4430-a367-b06e89b03600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693482904, "uuid": "f08d06a4-bb88-49b1-844c-2f826ec18415", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.28600.7595.4585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f210ea43-47c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1693460451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460451, "uuid": "f81189cf-86b8-4700-ad90-c16025ec2225", "comment": "Malware payload (AsyncRAT)", "value": "a824d5ae995e025f951d2a04792c7307", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460451, "uuid": "b5e4eda0-5aa9-49b2-8796-c826d6b4eb8e", "comment": "Malware payload (AsyncRAT)", "value": "b7d4b9e9051e99ad6b53905d98e6a2f29eb7c25a012fa7fc1e6e546761a538ec", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460451, "uuid": "0b7602ab-06f6-4f89-b9a4-bb90de6e9e40", "comment": "Malware payload (AsyncRAT)", "value": "d0e9c86d9875d0bb3bae347420d827bb739a8d56", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460451, "uuid": "499b971d-aa03-4f87-b543-6bef72c95121", "comment": "Malware payload (AsyncRAT)", "value": "44b5deaf81370277da35444d53bfa1c4a91e86610bdd6d508734662856f5ab32c224364454c70a988b50a640efac4a69", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460451, "uuid": "6af0da13-f90e-4e53-9134-4fbf7f8d7bde", "value": "T1CB648D03FB4394B0E26723FA6885973A2AB4D7201864D5B3FFD4DE1BBC71D62161760A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460451, "uuid": "a3feb499-77cb-4ccd-b4bd-023ed08b4f4d", "value": "8496a2b6c2c34c25fa1b98e929fd1485", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460451, "uuid": "6f2bf7dd-a26f-4197-bbe6-6c3525affa6c", "value": "6144:2TiVSIllyI/bi13ow+gidaC4akQT9rJGyUg7hdC81PQ0okbIx:2TiVPrJ/Vw+giIcjMnPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460451, "uuid": "5a7d7a92-510f-4e6c-85ea-f6b18cfd500d", "value": 312360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460451, "uuid": "ed80cae5-8c1e-477a-8551-e04d5c205a62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460451, "uuid": "86f4e9c0-3bee-4f78-a432-bef5eb132e9b", "value": "a824d5ae995e025f951d2a04792c7307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9d022b-47b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693454404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693454404, "uuid": "d3a8327d-b4af-432e-894f-e5cfdc19114d", "comment": "Malware payload (Mirai)", "value": "9da8fd06c7dba0f8ef8f5a207fcf88b8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693454404, "uuid": "3e5f248c-e88e-4ad4-9963-402ac1cb641c", "comment": "Malware payload (Mirai)", "value": "b823e4e3dcc66d7e40a28628685b413b27f0f2f483894bdc2bc146676573616e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693454404, "uuid": "98667b24-c42c-444e-a808-f058208f106b", "comment": "Malware payload (Mirai)", "value": "b97ff0352f9f12eb41d3d52dcbc22fbbc25bf55b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693454404, "uuid": "0a4997cc-0fc2-4c77-bdd0-ee294a15ab46", "comment": "Malware payload (Mirai)", "value": "464adb21043cc0c77923d77a1236966525e3418dde1d6aa382bfbdae59a93013f54eb96a42d07783c3413b7be2d3487c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693454404, "uuid": "d5e762d8-dc15-4f3f-89eb-3c7a4204843a", "value": "T1D6A2D029BF58828BC832797455D9E5D21257FCA1F29DCC4E2940C15FF0A33A96434E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693454404, "uuid": "97eeab95-b464-472b-989e-c2ccb1fb1b63", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTB:798o08kxofBE+ZkXaITbp2F2TWul0c51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693454404, "uuid": "2ddb0f65-3076-49f9-895c-c54d7c8ee538", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693454404, "uuid": "533f800c-8e51-42d8-bce3-8c70ae01fa8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693454404, "uuid": "1c36e901-e4fe-40ef-bdda-fc9d0a174292", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d6701b-47d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693470384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693470384, "uuid": "961def47-d8aa-4d14-a9d1-c2fe16bb3cad", "comment": "Malware payload", "value": "895f70603d7588504b3c70641ebccdbb", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693470384, "uuid": "5cf0b825-96c8-4c4b-9768-83654bb51a04", "comment": "Malware payload", "value": "b89a0f07b5503e2ebf1e8ec06557981eb9b180aa86e1ba3cd0ee9cb4e08b7de2", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693470384, "uuid": "09b2c20e-2aa2-430c-822b-a697cbaa61c9", "comment": "Malware payload", "value": "754ba3226f4d3f9f2cdd787d4c8581988859ffac", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693470384, "uuid": "2ffa9160-74c4-4ebb-8ec6-ee5964115807", "comment": "Malware payload", "value": "0f9f57e544cb2b81b8f93fb3847e3dd251b40aa0436b86227f0e51cb18e3eb085098001c9f538d6b8966e1ebc37b1a41", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693470384, "uuid": "e2dc1487-6d2b-4045-9178-cace41fe007a", "value": "T199B2E9D6BF82305082A76063B3170107E096AC5E66ECCCE5F357F2A8E958764B37E794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693470384, "uuid": "aa5a9feb-29c5-4263-9069-5855231b01c5", "value": "384:YpTkTRFIPmvIKYUkl1iZ4MBDP2jGM3du0Wzj+iWaGvTNMN+n03q066HeR/c3+VS:RRFIPlc4MlP2jnaGJMsn03q066+Cuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693470384, "uuid": "405d33a3-4287-4f53-9ffb-6d1c4eabd699", "value": 24269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693470384, "uuid": "680986e1-a852-4fba-bae4-b4900697b113", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693470384, "uuid": "71c65451-254a-405f-b194-98a2d84b0ee2", "value": "authentication.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69ed365-481f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693501154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693501154, "uuid": "b7fd488e-208c-4d45-b39d-3804db235be2", "comment": "Malware payload (AgentTesla)", "value": "979c17329c699e2ae849835eecbc49cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693501154, "uuid": "29c8e57a-c455-4a7d-932c-c592b337614e", "comment": "Malware payload (AgentTesla)", "value": "b905e2aaf41c07e00b4daf4c1d473a43880057be0c95268a5c4eb8c838f80c2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693501154, "uuid": "ed9b0bdf-aa8c-4701-b0ea-5ba48b5f7735", "comment": "Malware payload (AgentTesla)", "value": "15a37e6c00fa53ca4cdb16283a50c16b966471d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693501154, "uuid": "d9db99f5-7a88-4876-bb99-ee741a4c458c", "comment": "Malware payload (AgentTesla)", "value": "036061a2af3036584428a12b9e98fa8cf9d19c3ec715adb6f10d6dafb1181dabeb5d26dd92dc8025adb5c517f1abe79a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693501154, "uuid": "b45ff3bb-de37-47ef-95b5-b84a3fcde19e", "value": "T1AFF4D002A250DB52E560B7F7D025A3F407B6FE26E5F6E25B1D817CD636B3B000A52E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693501154, "uuid": "9603b34b-df98-4004-9c04-3f7fb82dea3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693501154, "uuid": "3f49ed52-8954-4929-a77e-15ea5f566e3c", "value": "12288:dUOPypIz+fOUmJZeCBF5beT6XHJIl2JKBP+2njHBWBHysWFi9/7+dquKrR5bN:dUOPypIz+WUgZxBzbC6XHbJKkOH8oPi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693501154, "uuid": "5df7444f-0213-476b-9a3a-43366f6c1b9f", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693501154, "uuid": "18b3fef4-ca7c-4635-91ea-e63e16dd2789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693501154, "uuid": "4ebaaca1-b595-4c4d-9954-de7258e71aa3", "value": "Factural comercial 08312023.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6684f7-480a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1693492088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492088, "uuid": "c5b16ce7-44bf-4468-8149-8eb4d733f86e", "comment": "Malware payload (RiseProStealer)", "value": "515ea0f3c7c0d9193b51a5f2babceffb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492088, "uuid": "eadecbfb-ff0a-470f-a6ff-d4d665e76703", "comment": "Malware payload (RiseProStealer)", "value": "b94432803f9367eddc11894e2ca715e003246a7ec8066efc65eb1a183296642c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492088, "uuid": "4740398d-0f7d-4b95-9610-d78047463042", "comment": "Malware payload (RiseProStealer)", "value": "e67cab75656e6d4c67f54bc1ae44d3022fb73ded", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492088, "uuid": "1e11a362-1925-4a70-8b8f-b35a4a673aba", "comment": "Malware payload (RiseProStealer)", "value": "d45bde7e0bae574610729a05cadc66b436135785355c89a15e33bb9bfa2d3db475e1c514ba51f61102c9f38ba7855d61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492088, "uuid": "2d589d87-8823-415c-8456-14e9bc8cabfb", "value": "T15A25B031D1629072F862103232CB97F36AB6F43041A559ABEFC51E5A7DB27C49314BEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492088, "uuid": "67a46c38-4952-419c-800e-c95b11a375a0", "value": "5ef501bbefbcf2f3ff01b85852aea8a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492088, "uuid": "11cf0e7d-d562-4a2e-8a74-c6540092a018", "value": "24576:665OEQksNY1MOjOz9Nx7QXATKYDThF9l28oS54wGF8A7qtbdJ+fqiN6hEWTcgiMt:665OEQksNY1MOOz9NaX7AlM8rbdJ+fqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693492088, "uuid": "bba1cd4a-d431-4755-83fd-6db080fd4175", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693492088, "uuid": "5a0fbf9f-3292-40fd-85c3-bbb221c83611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492088, "uuid": "f18dffe8-6386-4241-985c-65a24852c242", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37581ced-481c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693499651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499651, "uuid": "bfd14d64-b47b-45ed-9e85-404d4c0c9719", "comment": "Malware payload", "value": "947205666f3f98f10904243eb3d02814", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499651, "uuid": "d4e9c824-645e-46a0-bee3-12dd4bd84239", "comment": "Malware payload", "value": "bcc5e4b49c5b80c0afca7438f751442a8ac33633fa20279385929f445e00d484", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499651, "uuid": "ca00ab1c-1be5-4e84-961d-3f21fdf25c6f", "comment": "Malware payload", "value": "3e64f51b27ebbf17ddbf529f7adb0da9b48ed27e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499651, "uuid": "76191c14-bcbc-4b6a-9e24-f8443fdf2a57", "comment": "Malware payload", "value": "9f3ad6bf35c1479c6c9e5ab0a4b0e7732bfcf9bcba41d5297a33d8fd6a7719b9a67d648df515852c9f21a1af7fad1573", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499651, "uuid": "9c1b4f6e-214e-4f0d-ae7c-2ad968bf55bf", "value": "T1E8033A636480D4FDC8AAC37457AAF53EDA33717D13F6B22927ECAD265E8AE005F59000", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499651, "uuid": "5dfcc05d-dc47-4e2b-b26e-b7cb50f6e04b", "value": "768:2gSIFeVh38fcVvpqHpOMro31a32kygxIH:jSMefyIvpqJro32yO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693499651, "uuid": "77a1f408-76e3-4fdb-8efa-f60d5ce94381", "value": 38688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693499651, "uuid": "a317e2f9-7269-4224-8841-d7efdc8f8828", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499651, "uuid": "a0185b19-5833-40ce-ab93-7a5f9a61b6d3", "value": "SecuriteInfo.com.ELF.Gafgyt-NI.11036.14163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16078213-47dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693472108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693472108, "uuid": "0037a6a9-9d8d-454c-aa07-58c038f7afd8", "comment": "Malware payload", "value": "5ebcfed001c94937be9cc591da52c791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693472108, "uuid": "b5feeaae-eba6-4e93-b408-701fe0225f7a", "comment": "Malware payload", "value": "bcd559f3c8a3c9b8887e1e2a8935fc373e17874729587f3a87fae4044ce23001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693472108, "uuid": "28854192-6328-4a1d-a872-f0fd57b32a2c", "comment": "Malware payload", "value": "c23efbf940ed5151423a104ce6cfc38978df4d39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693472108, "uuid": "c576333a-7cf6-4fcd-bba5-522720cea084", "comment": "Malware payload", "value": "661edbc2d5433f59791376d9268fb324c914552ad995da539269352587f3c4c86d6a89377bcf8701739c52bb4f219577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693472108, "uuid": "212afc89-b418-4b02-b79c-81ad7677b722", "value": "T115F26B51FEC3CE34E0EA48B1D1FE7B2A812E01F8036678D776E86D25A5C19E13EB4215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693472108, "uuid": "90958db0-59fc-4740-ae91-e15e2b868fae", "value": "1b075ea841673b07c60264fe622008da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693472108, "uuid": "4eb5c51d-61bc-4175-8a8c-cece416e469a", "value": "384:SPYgoVFCScn27DjrKwTb4oCiyNUr2NEfHjvSzxXuqOrq6n657WXPbNhtB/df:sYZVFCbn27DjrH/4HRmMx+667XTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693472108, "uuid": "04060321-3807-4abf-8007-e71166713aec", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693472108, "uuid": "861c127d-7cfe-4c54-8748-b030b528e0b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693472108, "uuid": "9edf7758-52d6-4833-b273-98f397bdbbce", "value": "TR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814452de-47ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1693451672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693451672, "uuid": "e8ddd8e5-7c3e-460c-b195-9a5035a146c2", "comment": "Malware payload (GuLoader)", "value": "8287c44ca50917a3452ea644faf5526b", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693451672, "uuid": "3f638677-37ff-4b34-b54c-cc455dd82d11", "comment": "Malware payload (GuLoader)", "value": "bd043af859a796897462ed7a5aadb1c4a145f67f01a00c49b45a4b80564da6bb", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693451672, "uuid": "e9dfdb49-a9d3-42a5-9122-8da8770d65ad", "comment": "Malware payload (GuLoader)", "value": "140985e27a1e09a2a0842dd4cb663c3c0cc7260e", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693451672, "uuid": "f84dd7cf-04e5-4892-a149-447f5b8c5955", "comment": "Malware payload (GuLoader)", "value": "b824080fb9781a662c9e214e2c4e093708433c8c8a0454123c59a521b50cc806377d3ee2862710c593de6d2a86c1b68c", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693451672, "uuid": "c18a139e-bb98-451f-8427-7f0ee21df02c", "value": "T1B1076B30EA44021BDE8313BBAC6256D3A93CD6115302229AFA9E135D1B574DC937EF7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693451672, "uuid": "f4fa0fda-5520-4d5e-804b-26b5063beb88", "value": "21314122cd4542a6b9b297f52a87acbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693451672, "uuid": "6b4024a6-197c-4fd6-a511-5620079ef07a", "value": "49152:LWtfl3xiDZjSPQaLOpU0dpBYYZFfsqWGXwuO6Bpp5r8/XYpnF4tk11zppI04zmHr:Ctfl0kYax0dMiNsqWGXwtyn8/U5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693451672, "uuid": "2696a526-dc82-48e5-90ae-1aead99010fb", "value": 18181378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693451672, "uuid": "f841e66a-9e71-4499-b068-85332f8cd7cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693451672, "uuid": "8c9399b3-7cc5-4cfb-a8ad-e48939fd408e", "value": "Chr%D0%BEm%D0%B5S%D0%B5tu%D1%80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c9b0ca-47c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PovertyStealer)", "timestamp": 1693460105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460105, "uuid": "bfbb3757-8183-495c-8aa3-b654753de9ba", "comment": "Malware payload (PovertyStealer)", "value": "18ba002f79b9c39cd419f9affd820f61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460105, "uuid": "10728880-bd81-458c-8d01-33959a5a7b8e", "comment": "Malware payload (PovertyStealer)", "value": "bdd1fd0520b04d9f5c8cb66c639a6d6bb7dfe7dff1e533224b7175efa14bb240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460105, "uuid": "c2b82806-3839-4b37-b270-27a43255b379", "comment": "Malware payload (PovertyStealer)", "value": "c1daa37a1d3020234de23c3717a9bbb50cf68815", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460105, "uuid": "099072b7-dbcc-4de3-a2d6-26f6f3248bbb", "comment": "Malware payload (PovertyStealer)", "value": "cce5c689196a9268ac2a8d61f266d193b8138ec4b93bc0562e01842636afc9f07b830666d2dc79dfa80918b0492f453f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460105, "uuid": "5082637d-50a4-4ef5-8aae-bfdc9ca49b82", "value": "T140246C0074E1C072E973153109E4F7B95A7DBC714BA26AEF6FD80BAE4F302D1962196E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460105, "uuid": "7566baf0-d1d9-4d5c-859d-e368573aaae1", "value": "b54c77155566d77775e85f5f400b5a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460105, "uuid": "5b7f4ab7-d17a-4be6-9bac-f71c2e228749", "value": "6144:WgnGaXIxzuid/svQvk9JxTnAAOU2WauTO/B:WkYxzuA0SP/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460105, "uuid": "0c4af5ef-7eaa-4176-9395-04a195865c64", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460105, "uuid": "783d57a1-a2f1-4384-a543-4ebeb2132de3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460105, "uuid": "20f260b9-4ff0-4b74-88ed-776784a76e4c", "value": "18ba002f79b9c39cd419f9affd820f61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee2b789-47c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693460526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460526, "uuid": "90e7a416-5cd9-4978-bfa3-4963fabc744c", "comment": "Malware payload (AgentTesla)", "value": "26fc39370d43347b8dffc6a65bb47bd0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460526, "uuid": "1ffb2c22-8ace-4246-beac-92b3042ffd6d", "comment": "Malware payload (AgentTesla)", "value": "c0cdbf1f06967ed21beeac44d82b6fa168ec433ee130c042c6ffaf16029d9003", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460526, "uuid": "5fb4fbbb-b5d2-4246-8e42-9e1004309089", "comment": "Malware payload (AgentTesla)", "value": "baec1af78c018b110a6b0ed494ef7e5c95e2bd5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460526, "uuid": "dcdb8dfc-8cef-4609-909e-60faa34c9851", "comment": "Malware payload (AgentTesla)", "value": "8313493eae203927684fb5bd57ff22335e2a8357eeefe6fff2779572c8a9ef6ce783e24dc17ed6be33c0fb0c0673891e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460526, "uuid": "9381b58f-60ad-4baf-a0d3-4596a7cee993", "value": "T111E41262B0B45B18C8FD57F940AA521207F16559136EFACC7EC430CBACBBB454D28BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460526, "uuid": "56e178fb-931e-4835-9997-715225cf02f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460526, "uuid": "fad79163-e053-471b-8ef1-d6d27bed30c0", "value": "12288:BULv1Zdpq4GgMJnTndf/BraWsGFv2aoUHj5yYmSlJZyKtZn6:+Lv1rpHGb7BBCGp2dUHwOlJQKtZn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460526, "uuid": "728e9088-5cfe-46c0-ab02-1073c4fef470", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460526, "uuid": "ef558b23-b204-4c02-8afa-3258a1596764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460526, "uuid": "4b145201-71ef-4283-b6e8-b249ccf922d2", "value": "DHL Express Recieptts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803548f4-47f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693481735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693481735, "uuid": "68fcb767-22c7-4b74-9644-2be102d9b92b", "comment": "Malware payload", "value": "33a1cc504b545fc22aa44dbc9cf12882", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693481735, "uuid": "8397d015-efa1-4729-b3ff-21589930b77e", "comment": "Malware payload", "value": "c4664f4963b95d61ac7d0bbc3d4033b82f048a60b62f7e79cb82b011b70f6cea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693481735, "uuid": "c67a0c5e-f317-4bbc-bcd0-6f836c6fcd83", "comment": "Malware payload", "value": "5d6a278a97eeda831c629433bf06670d048c8d36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693481735, "uuid": "f60d5399-dfdb-4e85-a127-dce10bf88034", "comment": "Malware payload", "value": "d7186925c957b4e853753248cdd0896fa3dfeecb54110deb397f49a08442d1af4586046852dcb56d58e4b90abfbb913b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693481735, "uuid": "4136c868-9d3d-47c8-ad8d-f8c9abd32f3e", "value": "T11DC412021738E586DE3BE134D5993A0102652E93A3AFC71316F68A7F253231DE5DF68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693481735, "uuid": "8cc47da5-00ac-403e-b1ae-fe4c71f9cbbf", "value": "12288:Nj4BtcQeIgyRN5uU4ldmFYI6iOmYEer0sUa50E/rYoiZ5+0PaG1K/Y2m7PHv:V4BtcQeIgENNwmx6idYpr0+SEjE5+Wv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693481735, "uuid": "8de31c6e-11bd-4214-ae89-88c935715f13", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693481735, "uuid": "cc0fcee0-2239-4aaa-8d3a-b61dc99676a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693481735, "uuid": "6cd82be1-6336-495c-8f41-f751f89d1c16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5ba4fa-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693466426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466426, "uuid": "eefb794c-a9c1-446d-b549-21eb7be01704", "comment": "Malware payload (Mirai)", "value": "934508b1bc4654f1d7a9bd3d4165c983", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466426, "uuid": "68bb2c54-1004-49d1-b728-c7c9386727e0", "comment": "Malware payload (Mirai)", "value": "c48334a7c63955609ad0fab6c1790c979c8969cc8ac90c8d867314f9262cd950", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466426, "uuid": "b8c7f7e6-a7a2-4467-9c01-a731bcba6975", "comment": "Malware payload (Mirai)", "value": "2d82f4997972c55833cbfe49d9d2143ae6f1d185", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466426, "uuid": "b6855653-dc27-4238-8034-1ca8e5605e59", "comment": "Malware payload (Mirai)", "value": "c7c7d019b40d6ec9f59b7d3a8c7a16465110523e4e7cf5719653dea5f70cea5ae8d7651a01f62ff91bc2f750b9f9fc2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466426, "uuid": "8f4287e2-cc01-4982-9939-229f537b9c7d", "value": "T1E821A8A2A7E35D16CD841633DCAB5B20E322BE84C99EF913E31212261C3F20A1F21159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466426, "uuid": "ca66495c-0503-4e8f-873c-874078c96dd0", "value": "24:JKR4llMRgP9qD0at6EoDbGP8rUlFSs0VzLCkIdsgHkRGIU/KY3NfW:JKqTFqDPtT8rkFSsCzLotIUiY3Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466426, "uuid": "6cbeae6b-f068-43d3-888d-06f134ace0b6", "value": 1168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466426, "uuid": "ba80e96f-d9d9-49f7-82b0-68cc3b884def", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466426, "uuid": "f1129cca-5d97-4763-992d-3734d810a3b6", "value": "934508b1bc4654f1d7a9bd3d4165c983", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5acd47b1-47c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693464063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693464063, "uuid": "936d4dd6-f907-41b9-af2f-e5e40dc111f6", "comment": "Malware payload (AgentTesla)", "value": "fb0bee5c17b1992d95edcf9c3e76b82d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693464063, "uuid": "74838723-9bbb-4ec4-be42-f8d9cc61bddb", "comment": "Malware payload (AgentTesla)", "value": "c61cea9926860a1011c07352370d7b49f83bfcdb1ffbada16c8aafe873256b1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693464063, "uuid": "f1ca2ac7-4cfd-4558-b524-f37ce3e02cef", "comment": "Malware payload (AgentTesla)", "value": "bd4fe2c8e709d6ed1c2f9325da73a9923e81c220", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693464063, "uuid": "2e44234a-0cc1-4d4a-9b50-a0cf01469126", "comment": "Malware payload (AgentTesla)", "value": "b23537bab32f96c01ce04fa8108780f0dc430a08b881c3275b5c4d4127a5778c752093b51e1f82cbfe65d7f74df2e3ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693464063, "uuid": "5374d2f4-fb49-4aac-8c37-e0d7b441bebe", "value": "T1D3156124D070B3F6FB4217AC3567F75002444BFCFA9C60B86EA7AD09A0933965ABD5D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693464063, "uuid": "d2d2b6c8-26fe-4d54-8fbb-dc1e3be0a08c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693464063, "uuid": "1f03c96c-9cec-48ef-b0b9-2fe82462ecb8", "value": "12288:wd4RIkfrIkf/SWrq0DMGlkg4qHRQ03ek8ZOnO9vHIK:wdsIkfrIkfa6GGSgtG03V8ZgO1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693464063, "uuid": "623ea7ba-60c2-4c8d-ab64-d0963719a8c8", "value": 942592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693464063, "uuid": "6e874086-96d1-4831-a282-2c7b88b5ee89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693464063, "uuid": "11f0f04c-7c5b-4c90-89d1-772e2fdcbdd7", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.FQW.gen.Eldorado.29034.9530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a24b59-483d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1693514119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693514119, "uuid": "78a97889-aa60-45f7-a18f-c2f11e7c2dfe", "comment": "Malware payload (AsyncRAT)", "value": "018ed5e21ac44a7bed37d0f30ab22bbd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693514119, "uuid": "ff6ae499-6c77-4c3e-bc99-e8539501ca88", "comment": "Malware payload (AsyncRAT)", "value": "c63ce128ee4c0442e303b86d27e3e7df8eff15a04a44ada8cabfa965144ccf56", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693514119, "uuid": "2eaee914-1aec-4537-8515-d95e1bd0154f", "comment": "Malware payload (AsyncRAT)", "value": "8bde13d8322c59cf548bb6ee5ef280e5c9dd0a42", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693514119, "uuid": "c6ed4c8d-81a5-4c3b-a820-093986c31e4d", "comment": "Malware payload (AsyncRAT)", "value": "58fbf4d49a33b1af79b3f9c47f7e1719397cb6924fd33a1d22abadb63115a4e121bd4b8779add278aa018eb626e758c2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693514119, "uuid": "d287e91c-0a89-4888-9012-c14d69e02110", "value": "T19763F8053BF98019F3BE8F7469F6628546F9F5AF2912D54E1CC810DE0632B829941BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693514119, "uuid": "02e7dea6-e1c5-48c3-92fc-1a47b796f241", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693514119, "uuid": "180285ef-92be-40f0-8cef-6f76988784c4", "value": "1536:h2wukvF1ak9gcKu5UYFgwLZAUbXp3EZVzm4WrPlTGRx:h2dkvF1ak9Ku5UYFgwLZbXQiBdix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693514119, "uuid": "4032e28d-dc35-4721-a83b-a5fd82309fa6", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693514119, "uuid": "28d4323b-a238-4642-80f9-6109709b452b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693514119, "uuid": "172137b6-cbbc-4886-b1c6-cc5d12a25809", "value": "018ed5e21ac44a7bed37d0f30ab22bbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79270a8-4816-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693497316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693497316, "uuid": "1d65a574-dbeb-4ff6-814e-c32c265a1175", "comment": "Malware payload (RemcosRAT)", "value": "111355b58d38248c4f0d96a509ca44e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693497316, "uuid": "29f0a912-0aaa-4cbe-8bc0-63efeb446bc7", "comment": "Malware payload (RemcosRAT)", "value": "c67621749a60aa3546fbfb190a151ad3339d2a96a89e83491acb396709e9cb22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693497316, "uuid": "96ee5186-9f4d-4992-8ff0-10dfdc404016", "comment": "Malware payload (RemcosRAT)", "value": "24c5d3159af9d992a0a26368cf65ba313f3e8be4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693497316, "uuid": "8c667008-250b-4bf4-87a2-e21df7dde5f8", "comment": "Malware payload (RemcosRAT)", "value": "677fefcb3bf0cbf9fad6c6b07f0effe9e2786c4c2782f9e9dd83dd23eb892d8aac2ec1053cd891ec8dd07a1fda2c2ffc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693497316, "uuid": "bcf974cd-0b0b-4f56-b0aa-c5aada3182cf", "value": "T17B458C93F380147FF1A6C63BAC8E7BFD94A16F4D190A08412EB42F48FF6D641699474A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693497316, "uuid": "140eda2b-b3b7-449a-822d-bceb81e411ce", "value": "ab49388f1a819498b47a540e48d11f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693497316, "uuid": "7a8207fd-182d-406b-b77c-383c7015219a", "value": "24576:H/LsqswSUjWPTu1ipkwqqVn8EvDC5Gk2D9f:HYLHPAiT8EGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693497316, "uuid": "1382fdd2-cd85-4887-bacb-8f23a0d9fdae", "value": 1232384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693497316, "uuid": "c55892f3-c141-4969-8872-8b3dbaf63426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693497316, "uuid": "6f0eed3d-e9ee-4ba5-9877-f1771eb95bb1", "value": "111355b58d38248c4f0d96a509ca44e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8693cce0-482a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693505797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693505797, "uuid": "97366e74-a1bb-4704-905b-0d27c13ec230", "comment": "Malware payload (Mirai)", "value": "32230723167be7feb5201b97e4f27d10", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693505797, "uuid": "6969968b-6ed9-44dc-8d27-4efc25026d86", "comment": "Malware payload (Mirai)", "value": "c6eaea5aaa2b7a9af5d2a13220ef30de4bd31dadc348a8d15afad2976ae33b35", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693505797, "uuid": "2bfe1b80-0951-4f53-8f44-b5ca8b8c829f", "comment": "Malware payload (Mirai)", "value": "018125905cfae5a63d488db52440fc2425074eda", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693505797, "uuid": "a0d186ed-b590-4a59-9f38-932a5224daef", "comment": "Malware payload (Mirai)", "value": "0ee5bd2cc501f95bfc96298967a5a0d7ebe078754da4b9b75a0b601d296e8868780da3bae98ab9e146fe8bd3c59fd6b8", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693505797, "uuid": "ac41e7d9-d077-4011-805c-e7c24163f654", "value": "T1C6D2E0EB65BFF173C035A874346011D4FE383A13E21D9B6F0CA9ADBC56B27802A50E21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693505797, "uuid": "6b246485-a07a-4f3c-9e41-295bc165c56e", "value": "768:UYSoXdJZ5U05VxmHSSc+H2c+lPRkgSx0su:UYJdJZ5UQVH/+Kmbtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693505797, "uuid": "f67d0fa1-8595-49fe-8d92-af7830eae74b", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693505797, "uuid": "7852f2b2-ff9e-4401-a6e8-974109a3aa5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693505797, "uuid": "69f0378f-b55f-49a4-895b-63199092f77c", "value": "32230723167be7feb5201b97e4f27d10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a1efb6-4814-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693496243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693496243, "uuid": "f3c5c5ed-6bcb-4ffd-b5e8-f5a6e775d36b", "comment": "Malware payload", "value": "00726911b9d848edfd007eadd8e99737", "object_relation": "md5", "Tag": [ { "name": "asmi", "colour": "#69DA10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693496243, "uuid": "95e12ed5-518a-4abf-8e78-c34b9dcb1161", "comment": "Malware payload", "value": "c6ebb72e3f276cfa6277450db0c0baebf12244aec0ae01991e6fd7d479848919", "object_relation": "sha256", "Tag": [ { "name": "asmi", "colour": "#69DA10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693496243, "uuid": "855967a7-032d-4b73-b29b-c52f0f9bbbae", "comment": "Malware payload", "value": "a76e15b2100e91ea0b38fc1538372d2db96e3aaf", "object_relation": "sha1", "Tag": [ { "name": "asmi", "colour": "#69DA10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693496243, "uuid": "89b0c6fc-ef02-4c49-9d63-e02fb07028ce", "comment": "Malware payload", "value": "16c3f0211d63653ae201ced6e56c9f7eef4c3dd10b33d4696f36958afa47752f9f8ba344c97fa3e093a2c2fe7bde7348", "object_relation": "sha3-384", "Tag": [ { "name": "asmi", "colour": "#69DA10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693496243, "uuid": "c7d4911e-67d2-4778-93a3-789aeb0cfbc0", "value": "T13C73F61A738920F7C536D17E99820226FBB1B02413751BDB518589BA9F613EC3E3DB86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693496243, "uuid": "0e37333b-fb91-4cde-a56c-c80a3d42ddd7", "value": "f01d3112a8a7769fbdf3dfd7aa5b5d6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693496243, "uuid": "1561e010-1eb1-46f4-bee5-7dfdb9e46f85", "value": "768:bEdlGkRauX9hxYvy/Q4GEvT+CC+7msOBipA39:e1NhxYUQ4FviE7msOBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693496243, "uuid": "01e739a1-7b43-418f-9fb5-0a64d7a79919", "value": 78848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693496243, "uuid": "4b31a6c9-669b-4411-8fa5-bea139c4372e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693496243, "uuid": "dc53d59d-71dd-47c0-9dbb-a91968dadf49", "value": "mal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc44549-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tsunami)", "timestamp": 1693466406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466406, "uuid": "23c5559f-9031-4b3a-aa24-06f19495c74a", "comment": "Malware payload (Tsunami)", "value": "03755a6ff8419b31bc6a6eb091c293ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466406, "uuid": "6bfe40e7-321b-42a9-a068-82f99828c3a1", "comment": "Malware payload (Tsunami)", "value": "c6fd2da5ec731e3793c38e4386267ecfa2bcdb01fce86353468f1a063efed771", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466406, "uuid": "6eb6528a-44d9-4144-b3a5-08fc46c3df73", "comment": "Malware payload (Tsunami)", "value": "e528f8bcddfd55c084d8ba232e2daa0f49e73324", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466406, "uuid": "6ca6a4d7-0103-4d40-b19d-92ed76298a3c", "comment": "Malware payload (Tsunami)", "value": "fcaf487d05633bc6a339ecebf0bc6f69f3cc69e91ad2a40985f1692fb5e3f202c2c096d290eb36f9ea2ae19d7ecad65b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466406, "uuid": "c9e30f86-5280-4cfb-9c81-8958ea416c96", "value": "T181C2E986BF00943BE5E0263D484BCB68A2B09759C632820F77AD351C9F377487E7E649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466406, "uuid": "c440722e-0a97-4ebe-81c4-ba52021c2420", "value": "384:Alj8lBz9WvqAFga2Lg5+x6SLd9cyG5z+sRj/yuCN0eRfET/oqTk1X2:K4L55XLkE6SvcN0sRGP0eRfaJTqX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466406, "uuid": "338cb6d2-6cca-4476-8ca2-b45e79fbcc13", "value": 26121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466406, "uuid": "da1579cb-4a4b-4324-a0ce-f064774428ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466406, "uuid": "d140dd4e-11dc-4e1b-bcfe-3368556b2b2b", "value": "03755a6ff8419b31bc6a6eb091c293ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f640d0-47e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693476644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693476644, "uuid": "dfb09ca5-5442-4281-8dfc-4f9f04bca12e", "comment": "Malware payload (AgentTesla)", "value": "2774a0b622e8bfbd6a4b339234fc6289", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693476644, "uuid": "ba2affed-d44c-4558-bce8-aef708cef104", "comment": "Malware payload (AgentTesla)", "value": "c8db380ca07d006181dfa5dfa774c52a97b03688af074b796f3e4da284e8a4bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693476644, "uuid": "8a4636c3-9013-40ae-826a-60ef2cd8c908", "comment": "Malware payload (AgentTesla)", "value": "28a7cfc0d6241b14e3de62fd50ffa7ba564a8574", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693476644, "uuid": "d39e135e-f76b-4fa1-9d0c-9bad6452bdb9", "comment": "Malware payload (AgentTesla)", "value": "326ab3c6ea3447c760ef9df0324828cf010c1102db2f7ac93a64fa0065fa510da53a7809b540825d4c4b490a943ee512", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693476644, "uuid": "4aedf23a-fff7-4273-b502-4e40cd57f551", "value": "T10E8229186A9CD033C6AD4A7FA897924153B1D33F7482EB4B8DCCD65628633C05B81EE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693476644, "uuid": "29fb40b4-8335-46c3-94ac-50d4d365f030", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693476644, "uuid": "9f670a91-d73e-4f55-b1e5-2eeac302e838", "value": "384:nxHgkRUx0kbAdkT6uUbHf+dqq+X1cnbIOa6Lk/FaLsKau6:xW0GAdkT6PFqHIfKR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693476644, "uuid": "c4d567f9-c899-4332-a34a-07d316136269", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693476644, "uuid": "932349d6-f020-4f8a-843b-ad2bd0c6c11a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693476644, "uuid": "2c9b7a8f-483f-46d5-bfa9-8435c334e4bc", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4e5d8d-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tsunami)", "timestamp": 1693466372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466372, "uuid": "6c27b474-ec65-457d-8911-21912bc9efef", "comment": "Malware payload (Tsunami)", "value": "5b71417ed9a5bf667221f9434e7a7176", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466372, "uuid": "4e084941-18d9-4921-9f48-d771c686999d", "comment": "Malware payload (Tsunami)", "value": "c907e8ae0842b40e8d8b660591d14bd2d4ea355028b658cea6d942457498d30e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466372, "uuid": "4eca88c9-5fb5-4ad1-a8c2-656d63569e47", "comment": "Malware payload (Tsunami)", "value": "6566728159836083e7ea4b018a29afb53ed2f3cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466372, "uuid": "4ce7bfc6-22f4-45c9-864f-7ddb5cdc0cb5", "comment": "Malware payload (Tsunami)", "value": "248e3466dbe70a0a377cf7757e5e272c6f960cd034e40f6ce77a94a9fe62b644df3691e4c22cf4dc66a6a6e9989c6cd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466372, "uuid": "0841def9-01a9-42a0-a7d8-42cc27a81950", "value": "T140F2B6C9E9A8923FC3F1B7FAE74A47EE7335869893476377B23C085027417096A74260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466372, "uuid": "0e068160-4c4c-4fe0-8bd2-591a15df7482", "value": "768:YmmPwtacE5lvyMq5xC7zW1fFXUUx4b4MnXr/U9:YXlfyMq5xgzifFXUa4b4MnLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466372, "uuid": "550ad801-7eb2-45be-b20b-619225f8f675", "value": 35132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466372, "uuid": "7a20a1e1-ef8d-4546-b2f6-395ecfb3366d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466372, "uuid": "bf8ae700-1526-4a3a-be1f-f813d3076f3c", "value": "5b71417ed9a5bf667221f9434e7a7176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb65e250-47e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693475902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475902, "uuid": "aad93802-8dbd-4447-bc9b-962edd5d058e", "comment": "Malware payload (AgentTesla)", "value": "65a0ace2ce20102bb93b1671b12ad7ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475902, "uuid": "ef959777-4041-49bd-9430-88597128d62a", "comment": "Malware payload (AgentTesla)", "value": "c99a6571d727733173ff2de1f6e19dbab04cc3fdc5d977a1afc15e9b86865e50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475902, "uuid": "12122d9f-6fa5-4979-8410-2cf2fd6bbd7a", "comment": "Malware payload (AgentTesla)", "value": "c818777e85bbda16b36e192a8d07d729464035fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693475902, "uuid": "7045a250-8e84-4467-beaa-ca49c98cf333", "comment": "Malware payload (AgentTesla)", "value": "308afcd75c968f6304f9caf3cdcfa8c0072690c281bae8d90b279c9b7ac93939f8878bf20612be0516d5a2cd29452d06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475902, "uuid": "07665e8b-a8a0-4132-8916-b3cd1b255527", "value": "T11AB423EF31A204E9437905C8A39AA307735D6102D059E225E3DDF6A3E7854A2E74DCFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475902, "uuid": "38138885-6546-40cf-a85c-ffa639cdad15", "value": "12288:faCJMe4A6LWTZmOnWd7O8Zi96zDKCCNpr2jKqV4w/V1WAS:iCJMVjwZmOnaS8ZiUXKC+iKe1VS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693475902, "uuid": "ad696223-26b6-462e-9cda-87a578d30051", "value": 526828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693475902, "uuid": "2fe846bc-5c22-4c39-87a7-a435ad244402", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693475902, "uuid": "47e14c87-19e7-4651-9a5d-aba7f439d5f2", "value": "PAYMENT APPLICATION COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d0018c-4803-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693488908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693488908, "uuid": "330711e9-0c9a-452e-a627-94dff9cc88cd", "comment": "Malware payload (Formbook)", "value": "dc13ad4cc1c11160c7823675dfac4dbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693488908, "uuid": "916e05f3-23c6-4c91-b896-3f8607d1430e", "comment": "Malware payload (Formbook)", "value": "cc3282f638a0bf6f5d3246310825760861f1ad6a78e3146c47c3e454e594c909", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693488908, "uuid": "37c06f87-19ce-44ce-a796-574649330f6b", "comment": "Malware payload (Formbook)", "value": "547f85ef84cc44b244e407f81e00d44eb91f2d1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693488908, "uuid": "67149a01-6650-4083-8a78-35588f66471d", "comment": "Malware payload (Formbook)", "value": "7a2cb18c15b7772e80e606b4c83f2f1df720adc7ade88bc61ce1d6f0ea4a8255ec75b56a3f582587b31e7c4bfa0c3e8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693488908, "uuid": "93835b0c-cc2d-4255-a47a-6bb0285775a1", "value": "T1E6256A9C3200B5DEC917DD37C9682EB0AA20AC66979BD10360173DD9BA3DA97CF145E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693488908, "uuid": "82a8b6cf-693d-4d6a-8133-71bb83771b12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693488908, "uuid": "7341bdd0-fef6-4419-b40f-fbda26dac72e", "value": "12288:JrU2FB+kxsfOUmJZeC/yUYeS7LctK/0wv4WDgOE8RjSevPiGqFPOc1xM32RRbEQP:JFqSsWUgZx/yUYH7LFqWMD8ke3DqFvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693488908, "uuid": "0b3f82bd-af95-4af7-80f7-72266bce14d4", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693488908, "uuid": "ebd1442b-f1cd-469d-94b5-1805cf289162", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693488908, "uuid": "4c734172-eec4-4c89-a51c-7c68fe7adb86", "value": "SecuriteInfo.com.W32.MSIL_Agent.FUB.gen.Eldorado.2147.3220", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e832f7-481d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693500317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693500317, "uuid": "8779853b-23f7-4016-a1ff-fb34730fcfa7", "comment": "Malware payload (njrat)", "value": "0fd9f447c7575f44d5f7862610482789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693500317, "uuid": "9841e132-7e8d-4d6f-93c5-f9f45b86e950", "comment": "Malware payload (njrat)", "value": "ccb950ef5097dbd096c9a7017cd5c0032280a0b795af1d6838953267528b66fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693500317, "uuid": "3ab40af8-331b-4b3f-864b-4884955a3d2d", "comment": "Malware payload (njrat)", "value": "c5fd98695c673bebe30707703422664c625d6a2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693500317, "uuid": "6969a1a4-02ca-4e77-89f5-8228e0ef0cde", "comment": "Malware payload (njrat)", "value": "14179c5370fae44d586a2259665be07c60b556901f59faadd71b08c6a865e06fa0004dc8b3c234593453025b908836e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693500317, "uuid": "d1d38586-888e-41b9-a2b2-ad22677da5ff", "value": "T13F93D74977E57524E4BF56F75472F2004E34B48B1602E39E49F258EA0A33AC44F89EEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693500317, "uuid": "34ece6d9-9d5d-496f-8637-241773c6bad0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693500317, "uuid": "a0d01f19-7967-48a1-8ae6-c5a26b1bb192", "value": "1536:pCmC+xhUa9urgOB9mNvM4jEwzGi1dDaDCgS:pCgUa9urgOidGi1dEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693500317, "uuid": "ff680c7b-2fb0-4da8-ba53-039e0f6a1bf3", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693500317, "uuid": "611bed88-8f40-4530-a0db-652e2fc63e68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693500317, "uuid": "a29ab6a4-7af4-4b9a-adcd-19a927194218", "value": "0fd9f447c7575f44d5f7862610482789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe64a7d9-47c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1693460472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460472, "uuid": "bdfab71c-544a-4897-9560-9a64bc4fd126", "comment": "Malware payload (STRRAT)", "value": "2a9ac7b1665ae6d0148cb3e6580f14da", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460472, "uuid": "ecf4b420-7934-418f-8a26-fb5b617b83bd", "comment": "Malware payload (STRRAT)", "value": "ce2791e51d3ef809e866b0f06015b3ca51aa6216f5f8ff3d3a8bb65333ec372a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460472, "uuid": "80c9af27-93e5-4547-abb1-ab67e667799d", "comment": "Malware payload (STRRAT)", "value": "fda52e6bd48d7991a84603ef44ac23b542b48682", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460472, "uuid": "d5d0d8e5-53cb-46a5-a547-488cbd760363", "comment": "Malware payload (STRRAT)", "value": "8e951d4644dd7e50920c79fc6ee88d08d016c37c158aff447e4afc4226969a7e68454ac348456f194e45465d611d8959", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460472, "uuid": "df8c9ab3-2874-4144-aa34-0ed8d6a8cdfb", "value": "T10404F10E6D6BC6F6D51B947228089829EACE0352C185A07F25FC96CE1DB1CDD2B05ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460472, "uuid": "4e44d931-6b46-453e-98f7-e1136f6db331", "value": "3072:ETEfvDusDeda4zz1RuHLRvpiRZbts9luBrMJYfVjA+ivewt1TEA3RQMJxEDWFF9T:ETECsDaNS8tsmrjfVs+iWMwhmDF9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460472, "uuid": "43d214e4-f5ce-4a61-a133-584225abc0da", "value": 175160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460472, "uuid": "3e72237a-eca2-4181-8880-13b9e71c5471", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460472, "uuid": "56fc9209-ab62-4b6d-bd51-d91c36ca9173", "value": "\uc778\uc6a9\ud558\ub2e4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f8e363-4813-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693495790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693495790, "uuid": "60397023-28aa-4b64-8cb5-ef08a71f3f5c", "comment": "Malware payload", "value": "2b5a79fecde4ed096d875716c6cddbee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693495790, "uuid": "7939d216-7139-4a94-af3b-992a0f7a0fc8", "comment": "Malware payload", "value": "cf0b68e32a1fa28387898e8930b324036ee8d1cee5db66e38c7d9b07381126ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693495790, "uuid": "001d94a4-39a9-4993-881f-f2899b0df81b", "comment": "Malware payload", "value": "269bd9983b9a6a6859fa52c135cacf92b3a26f38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693495790, "uuid": "923580a1-b4eb-4934-8c3f-c1d14be57a3b", "comment": "Malware payload", "value": "041d4fdb4ea155c177a9506c3dd48b5b450057abbc848a0bab520bfc79b31c9cc0fb45128781ecd36d66fd25184998a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693495790, "uuid": "35c0a260-cf4d-4e1c-8ab8-fd0dfdafdedc", "value": "T1CB156224D070B3F6FB4217AC7567F75002444BFCFA9C60B86EA7AD09A0933916ABD5D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693495790, "uuid": "22a01eec-d050-43e1-9029-7b5234ef9a6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693495790, "uuid": "78008890-d96d-4096-b20f-c55c02356290", "value": "12288:nEUIkfrIkfdSWrlJB0U28J02Cg3N7D1+2Hwk6d3ImB7uMboBaS:nhIkfrIkfI6l5PJVC+7xh+ImB7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693495790, "uuid": "27ddbe2c-94d9-46ba-9da1-0e8ee4dceb8a", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693495790, "uuid": "2874e96d-f924-412d-b0a1-2072108350c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693495790, "uuid": "51f378fe-7c39-4e06-b390-236e9d5374f5", "value": "AskZEUG4Cz6RtRM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b4da8d-4805-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693489899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693489899, "uuid": "8848faec-9f17-4c2b-a3a8-64289e5be664", "comment": "Malware payload (RedLineStealer)", "value": "a10ecc8a679810587d0d1bcc1f617268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693489899, "uuid": "e8c8f1a8-79a0-4830-a1cb-32ac515ee08e", "comment": "Malware payload (RedLineStealer)", "value": "cf2ee7eb8b7752ee67c4ae3841da04e42dcb3f5fe7070ccfdeab964828ee6f4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693489899, "uuid": "6f318410-501a-42dc-86f4-ae3a5e3a7b1d", "comment": "Malware payload (RedLineStealer)", "value": "17cafb5e7d2277381cd39a426ac9cf38ece63782", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693489899, "uuid": "86a93105-5096-4190-b9e0-075c7a17ec92", "comment": "Malware payload (RedLineStealer)", "value": "5b415b8c5ba8983ecf0c50acc15256893d9c7c0c22ceefc92e4578d08a307750d8464141a498f41e87c3c301e636db5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693489899, "uuid": "508ef510-1dc5-4fad-82fb-093b6cfbb35b", "value": "T16F744AC0338669CDCCAF89F1616167348A62D442A357BB537C8BAEF73D59348AF411E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693489899, "uuid": "c063ee68-7400-44c5-a976-0a712ee76717", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693489899, "uuid": "b2fc6776-57e9-4e20-85e3-6b33c8a4057d", "value": "6144:gxx+cqVW05h4TXGgka338piCzCbNaSe/N1avTi:g1qdf4fzCzCbNaSeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693489899, "uuid": "e5ed752c-8259-4fc8-8389-25b9f307e1c6", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693489899, "uuid": "de992893-0c1f-43cc-b6f4-caf56b8e39a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693489899, "uuid": "c7da664d-27c2-47d8-98d7-a9dcd482132b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccffcfb8-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tsunami)", "timestamp": 1693466402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466402, "uuid": "0eeb2baf-eb8a-4dd8-979f-ca10482fdf34", "comment": "Malware payload (Tsunami)", "value": "668ebf5febdc1001e45a9d9ea4bde1de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466402, "uuid": "d2bb2cd4-1345-43e6-b2ac-c0681de11340", "comment": "Malware payload (Tsunami)", "value": "cfa10209f65661337c3cc322a27bf23d78ec5229f46da093675557532426be4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466402, "uuid": "7098e6d9-fd03-40af-9ffc-2dfd76b9184d", "comment": "Malware payload (Tsunami)", "value": "2875343a3d76f4382c8e647be4b03bb1afe376d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466402, "uuid": "5680c5ba-8908-41d3-8eb1-fee3eb929e4a", "comment": "Malware payload (Tsunami)", "value": "8849c4850bf9c3c02fae21c0d8fde2d69a346ff7296cb9300f781f53c47010e1a0522046d9c8188861300ddaed003882", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466402, "uuid": "21fa3665-f1e1-47bb-9318-fc6f34329865", "value": "T1A8F2C989E9A5923FC3F177BAE74607EFA379469863472336B23C45903741718BE30650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466402, "uuid": "22ac50d3-6f39-4214-b76f-edc857d0aa0c", "value": "768:oKWXrm5Rfut6DRxyqHrgt80FD3DO+VXVUx5ve9alAJf1:oy5Rf+6HHrg+kDzO+Xa5ve90K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466402, "uuid": "750cb270-8bd1-4532-851f-3c7fc44edcd5", "value": 35634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466402, "uuid": "c0b9fc10-d1c7-47c6-9134-d9291123e443", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466402, "uuid": "4dd64bca-a987-4e94-818c-0050da9ae9a5", "value": "668ebf5febdc1001e45a9d9ea4bde1de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ae1154-4846-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693517719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517719, "uuid": "741c9a90-1bbe-4e5d-a6a0-e65643d0ad85", "comment": "Malware payload (Amadey)", "value": "ee0eed0c8d992b994b81e3870ff0ecd4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517719, "uuid": "97a251f3-3935-4b6e-a550-d330b99ae522", "comment": "Malware payload (Amadey)", "value": "cfaccdc09bb8c95376a00ff081b9e69d3bc5dc3bf8c461f2c26fcde780631139", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517719, "uuid": "2b281cfe-86d7-4fa1-80c9-a50f59c7b596", "comment": "Malware payload (Amadey)", "value": "bc60b234c006fbe1c330c7ced6cdfe48771a176e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517719, "uuid": "044d29ba-e00b-4589-8f96-9f89014f46ed", "comment": "Malware payload (Amadey)", "value": "b47574d73eabd28dc51fbed2e5197363dbc8584d9bdd51c83b2b54b7c8f0244eec045128710aaef873b6f0369df36644", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517719, "uuid": "245043f9-de00-45b8-89a7-b1c88be46bf9", "value": "T109352386F1EC84B3DA32177018F606D71D3A7A626C74876B6B84184F0CB2241E976B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517719, "uuid": "33d4d1a5-2770-41c3-8141-d1ba3d105897", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517719, "uuid": "d05cf2ca-7083-4270-b1d3-ce101a3ebaa4", "value": "24576:Sykv3IDRwKfGJCePKxMQX7i8VokWc5uanYJlyZKQaqT/Us34:5sIqKOJzC5ZVokv4qV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693517719, "uuid": "43304b8d-8a72-41f5-8867-5e6e0838c666", "value": 1149952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693517719, "uuid": "b40d257b-a564-4b4e-98b3-206c276a2119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517719, "uuid": "41a63c29-deb7-47a3-911e-0c03a092a4e3", "value": "cfaccdc09bb8c95376a00ff081b9e69d3bc5dc3bf8c46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f625999d-484a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BumbleBee)", "timestamp": 1693519728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693519728, "uuid": "8dc97dd2-03ad-4cb4-b62f-3e8645d9c6a6", "comment": "Malware payload (BumbleBee)", "value": "4bedb6fb5a11da21e757fd205f3fe347", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "new_black", "colour": "#D4F367", "exportable": true, "hide_tag": false }, { "name": "rar28", "colour": "#618C7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693519728, "uuid": "62dfd7b6-011d-4afc-adb4-4a6eaf05cac7", "comment": "Malware payload (BumbleBee)", "value": "d0e01dcc6c4cb19e8848d18c1a7e6f6aac8ba48ce6a9052576e60e36cbb7596f", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "new_black", "colour": "#D4F367", "exportable": true, "hide_tag": false }, { "name": "rar28", "colour": "#618C7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693519728, "uuid": "d4724c3e-478f-4052-ae36-e37816011dd5", "comment": "Malware payload (BumbleBee)", "value": "14c45096824fad54eebb9a7658b842b96c026fba", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "new_black", "colour": "#D4F367", "exportable": true, "hide_tag": false }, { "name": "rar28", "colour": "#618C7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693519728, "uuid": "a6bb37e6-8748-46f8-9a58-dc7268b6ad8b", "comment": "Malware payload (BumbleBee)", "value": "91d321004fb9e22ec63660fd424888ddd3a21fc5519408df6826111c31fed1d020d1f52f8a7ff1bd609fbecaf3e5ac2d", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "new_black", "colour": "#D4F367", "exportable": true, "hide_tag": false }, { "name": "rar28", "colour": "#618C7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693519728, "uuid": "ecc0f098-8843-4077-932b-aa236f4748e9", "value": "T17E458E36E9E90F45D143A577025AA5F27AAB3DEF5326CBA7964DD7383800690EF43302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693519728, "uuid": "ac8517da-0068-496c-9f79-75951f9fdebd", "value": "380d16d0b8cb7abfd443a144943085f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693519728, "uuid": "bd465db8-7517-48c4-99c3-e5f85c146d75", "value": "24576:nYaqXLqpXwj+iX2oNwZI7W5Hhwe10m5/nUIc:YaoLqpBiX2oNwZIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693519728, "uuid": "a3f3396f-33f9-47de-92b4-ccb09a7fd86b", "value": 1176576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693519728, "uuid": "f24b023b-caa9-4984-b771-80781c3050d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693519728, "uuid": "2c0523a8-f12b-4682-8478-6595403b6e00", "value": "0OAdzGxMsZ6ISNGMGn5vaqyLpIzmqQUlduYONsu3WW8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff4ca5a-47c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693462917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693462917, "uuid": "a2228171-211f-4816-840b-25d2d3b5a183", "comment": "Malware payload (AgentTesla)", "value": "e78f32a89bf176797650fb5162916852", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693462917, "uuid": "c7c3101a-93f9-432c-99e9-39193b43336a", "comment": "Malware payload (AgentTesla)", "value": "d2da1e88b5fd6d41bf442f432c646368a9c7bedec24d1e75b2d950b4239ad3f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693462917, "uuid": "f8b9da94-c66d-42a5-951c-a043e3b0f11d", "comment": "Malware payload (AgentTesla)", "value": "cfae9f5e09ca1c3c4b40fd0a1adaf0f4698ce91f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693462917, "uuid": "d1271e36-5505-409b-80dd-a8030f671b19", "comment": "Malware payload (AgentTesla)", "value": "139104ed8312079989228052216af98bfd87d5fd47abb9e6901e4b275dfc7555db26eb04ef447387fb46a49d4d07b02d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693462917, "uuid": "1f8a0dd3-3c0f-4b73-9be2-bd27f1f2cfcb", "value": "T198955C0B7A62487DC594B73AC2D74E244366CF442293F206358A33399D3777E6F1A98B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693462917, "uuid": "094beb15-a0d1-4872-a5eb-60b8ea246621", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693462917, "uuid": "67362a24-7bb2-44ab-996c-c86e236f380d", "value": "49152:18gAYQ/F7Ce1LXWPd01vjzYXQfp9AmV7uVMaYIkzoJWnX0QgA70G:+D/XTbsJYEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693462917, "uuid": "3a5cb6bd-557a-4667-bc43-914949e72ef3", "value": 2015136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693462917, "uuid": "588c20e4-56c6-48fa-9727-816667cf12b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693462917, "uuid": "4d7783d2-8250-46ac-a78f-5dd18c301646", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019079d3-4802-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693488394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693488394, "uuid": "df9b7540-b068-4941-b1a9-c6511af89a14", "comment": "Malware payload (Formbook)", "value": "15e76febd9a13cf44e211849c051a68c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693488394, "uuid": "87269aaa-67b5-47c8-8c66-4a4556c04888", "comment": "Malware payload (Formbook)", "value": "d4b306e65c16a66f2c0851d70709f117d2a93596fa9ad5905f99c99ea25aba10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693488394, "uuid": "738f18cd-3664-4a7d-a038-c41ab33982aa", "comment": "Malware payload (Formbook)", "value": "6d3b2d2b00e210d706e6f5746cae5e8cafae777b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693488394, "uuid": "a73eabbb-7239-4426-b4b7-1ec38a823514", "comment": "Malware payload (Formbook)", "value": "9d613e6d0b46b28e379a987b9a22902b22f712ad44bfefe3729fa4bfd287454b7221b8ef0ec0d743ff90e7973d792e84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693488394, "uuid": "7b8b881b-251a-457b-9670-122c985ab854", "value": "T1F1256A983100B5DEC917DC37C9682EB4AA21AD66979BD203901739DCBA3DA97CF105F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693488394, "uuid": "5a33388d-839e-4218-bde9-6b9feb1432c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693488394, "uuid": "2aaab271-a957-41a3-9ac6-283869fd95f9", "value": "24576:reunQk8WUgZxqyp/0knO+e8KnCqTsQlSC:nUexqahnXe8KnZTsQlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693488394, "uuid": "f6aba1ee-4e40-4425-9e88-faf410520fa9", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693488394, "uuid": "a99beecf-8086-441f-997b-b37620e5e2ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693488394, "uuid": "02acd874-83ef-4c80-8611-fe74092daf59", "value": "Repeat Order 0831023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9082f51-47fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693485320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485320, "uuid": "5871e1dc-ba2d-4a4e-97cc-7ab71d0bdf4e", "comment": "Malware payload (AgentTesla)", "value": "650a1d674bc1631af9bb264a69a8060e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485320, "uuid": "89ca5e43-95a3-4ab6-969f-b9e9baf69494", "comment": "Malware payload (AgentTesla)", "value": "d586099dd209b92c47190ee099d0f3c61ea3835815d70347b3974e59a2670ac6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485320, "uuid": "a4193dc9-0fce-4a34-b4ab-3e64226db55c", "comment": "Malware payload (AgentTesla)", "value": "c17f8eb8fb44b873bb36b3a7c6b43dfb64dabe06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485320, "uuid": "ad1c2915-9630-4ba6-9678-cbe33ed6f5e1", "comment": "Malware payload (AgentTesla)", "value": "52a3cab7f237d0e013edba4d02f810d8b9b3a3ba3c781f1c244981071bcef14ba4e48ea8b4609b7ae3c6c869b78c6ae8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485320, "uuid": "dfd5fc2a-5130-4e67-9ac7-60ae4ba6610a", "value": "T1B40523A1AB1003EADB11DB7DA4605C815FF8C13799F3ADAFB985248C11282DC2EFF156", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485320, "uuid": "3b07cfd7-cfe6-42a3-a399-9d1e01001926", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485320, "uuid": "e6471007-e3a6-4718-8715-fc968e7ae7fa", "value": "24576:8vcoCzQGCRAr8TC2MyrqB/BNFqj9g8NN:8vcoIQPRnC2MyrkBNIj95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693485320, "uuid": "86e787a3-04b8-47ab-9e51-8e394ecbb511", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693485320, "uuid": "cb549c17-e902-458f-9361-6420929f27a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485320, "uuid": "372b3f70-ab82-423d-af31-3eedf85a27e5", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.28600.20069.28020", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1997218-479d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693445418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693445418, "uuid": "ea0de108-8ef3-474c-9104-e4baa0cb8c0e", "comment": "Malware payload (njrat)", "value": "2fe130c90aa36bd0487a6dd6cf09af7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693445418, "uuid": "03d66c6f-3a8c-49b0-9d64-221e971e84c2", "comment": "Malware payload (njrat)", "value": "d63439a5b9d2e17a039312cad813f16b956d0ae81ad89772ab618dbee7f3c923", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693445418, "uuid": "afc1046c-ac6d-47fe-903f-b84d53d72e81", "comment": "Malware payload (njrat)", "value": "f70d634d1c0cf1f634914c5747d78f38f4140fd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693445418, "uuid": "5cae13b7-a490-4c76-8d43-2ed4db4f2f54", "comment": "Malware payload (njrat)", "value": "e8405dedf6b5bded689b1b3d4306e10a497a32d01888aea382d4a763677ce96ef8a9a821d76879062c0de328161ecafa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693445418, "uuid": "70a8b8f8-bb8e-4215-8219-806240dd0a9e", "value": "T1DE13D78DB694E174D5FF8BF1B4A2B2890B71A017A802930F99F114D94FB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693445418, "uuid": "33ed8ba4-2f0e-4ca1-9241-545618e3702c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693445418, "uuid": "4efc0bb2-0469-41b0-8160-2e60b5d6b9ab", "value": "384:KZyKGNUst+3gUy6jjhK6qEs1tJqzQIij+ZsNO3PlpJKkkjh/TzF7pWnpmgreT0pe:ISwQh6/h1u14uXQ/okC+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693445418, "uuid": "2cc1b78f-9315-420b-8daf-931f1530dcd5", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693445418, "uuid": "d96d7a2e-8c5a-4078-b465-cfcc2ab7341c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693445418, "uuid": "47f51dfd-98d3-4dbf-ad20-1e2f9ef3aed8", "value": "2fe130c90aa36bd0487a6dd6cf09af7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde779ba-480c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693493032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693493032, "uuid": "c01c383a-0079-455d-9306-461f3e2b5612", "comment": "Malware payload (Smoke Loader)", "value": "5d9b6231d958f2028159035586a36ab7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693493032, "uuid": "e9f73fbb-3539-41d5-be00-efa48058a9a6", "comment": "Malware payload (Smoke Loader)", "value": "d9687211c7a526b2eaedd63975a8a0deef343ec8a01a9480d3bf28316dc57107", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693493032, "uuid": "c0dde400-33ca-42a7-af6f-a4261523cd22", "comment": "Malware payload (Smoke Loader)", "value": "93e47b4b93ccabd808478169c07a08b16f4bc433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693493032, "uuid": "4ca7dc9c-1262-4f1d-97fd-a4b1abfe62e9", "comment": "Malware payload (Smoke Loader)", "value": "97ba21c38fade9fd6c4aa31e8fc1e2f5a2417ba546cb0996c5cd3ad3de75baa743ee644a5891476d940fe5f8ccd1e2f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693493032, "uuid": "a4c2219d-006e-438c-b4f1-778206eb9250", "value": "T19034CF21B7C2C033E52395704AB1C6A55B7BBCB18B6259CB2BA41A7E1F703D19B38357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693493032, "uuid": "e044429b-f120-439a-9096-faa369cc7f5e", "value": "c614d8d8bcef689d6675c8b116f7714c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693493032, "uuid": "c4cd5ca4-b16b-4e5f-9e72-886f4c821e7a", "value": "3072:iGsgOTdlneLpakmLCYHdyR4w9t+Eac+0bVsY1ZVKfg7FFPLwdQ6P36wYRbwMlF:EvepakmOYHde5xa7EVvN8S6iLwMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693493032, "uuid": "fad926bd-afa2-4e08-a889-d8d91a29fe8b", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693493032, "uuid": "e44148ec-1a4f-4ab5-8089-5629aaf82e01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693493032, "uuid": "f6f69e93-4191-4201-a9cb-e73f1130ce4c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d071290c-47e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693478004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478004, "uuid": "41c5361d-7d5e-499e-a154-8c9f10d7a551", "comment": "Malware payload", "value": "207591f089116460eecac93556cc4ee6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false }, { "name": "flygram", "colour": "#E9C7F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478004, "uuid": "337023e4-4144-43d1-9489-54c107f6067c", "comment": "Malware payload", "value": "daf3d2cb6f1bbb7c8d1cfb5fc0db23afc304a622ebb24aa940228be691bcda2d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false }, { "name": "flygram", "colour": "#E9C7F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478004, "uuid": "7d503eb3-44c4-4ed5-8e6f-4b055f07ff46", "comment": "Malware payload", "value": "c6e26eafbf6703dc19446944af5ded65f86c9571", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false }, { "name": "flygram", "colour": "#E9C7F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693478004, "uuid": "f5b8c45b-6c8c-402f-a034-e38a19b500e2", "comment": "Malware payload", "value": "6b985277949d04a5692b806a903eeee83f7a4c6c98e2163a4762d3afb58d31a181db25b98c317e6fa5417d8b54e1cc12", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false }, { "name": "flygram", "colour": "#E9C7F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478004, "uuid": "2f810141-26ce-4a37-b05e-d81731577bc6", "value": "T129C712E3F3A45839C8360572857971A1EB2D4E68DF12B29B740C772D79F32D28A857E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478004, "uuid": "69224f35-05e7-451a-99ec-dca8e0fc2a6f", "value": "786432:PQhaCgW+rjQgsjp0i2bq5TXQOtj2pG4dG5NzarvqHwl0DdaAlmE:Iha7WA2lKbgTXTtjsGN3aLqHBaAlmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693478004, "uuid": "2310adbe-1045-493c-9579-da4b81c024f7", "value": 53054930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693478004, "uuid": "9557045d-09ac-4932-9b38-a32ceadf330f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693478004, "uuid": "1e45c096-2582-422f-8afc-887ba41e9202", "value": "flygram_release.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d7424f-47b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693455035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693455035, "uuid": "7e810362-ca3a-4f0d-aa77-e5fa863efded", "comment": "Malware payload (Mirai)", "value": "3de54b197443191af644902d80b62487", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693455035, "uuid": "29c4f764-0e84-476e-8b42-5c03d0ff3e37", "comment": "Malware payload (Mirai)", "value": "dba49f19733d604a83804e1a177b1f0e7bf91047dc738da72ba1905ec4700a78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693455035, "uuid": "0789ea00-0182-4d3b-b8a5-8d2aea95f3db", "comment": "Malware payload (Mirai)", "value": "85cef9bf23d3891cc6042c542f380701e85c2c6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693455035, "uuid": "96a3c93f-fd8c-4c5a-b32e-9a0d6caef935", "comment": "Malware payload (Mirai)", "value": "a5464a7393480cf4acc17f960e487f6b2e174e46edb3ed2923c57ca59f28fddabe1df5fb6c8a1abcfc2cb36554d25952", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693455035, "uuid": "fa91cd01-b85c-44b8-94bb-662def28c973", "value": "T178A2D019D345AFF4DFAF9D9053C2C3C276E947C6278AC8E340EEAF012906056B789D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693455035, "uuid": "dcec279a-e267-40c9-9053-7dcd2e56d491", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5fM4uVcqgw05VxJq:9RxsSVsMD6xiJJE5zRWNe4uVcqgw09Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693455035, "uuid": "a30277d0-6c82-435d-8319-c4141225e0d6", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693455035, "uuid": "4e020901-8f2b-4bd8-878e-f05b36bed376", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693455035, "uuid": "da049615-fb52-48d1-bbac-d4b0e7ef66a1", "value": "3de54b197443191af644902d80b62487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788b0cfb-479f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693446074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446074, "uuid": "3796ab62-5da3-4d76-a643-17b40f19837b", "comment": "Malware payload (Mirai)", "value": "fad8a71075e93d1535f1db9fb9651344", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446074, "uuid": "1a681234-a9e6-40f9-bfe5-03484f1752db", "comment": "Malware payload (Mirai)", "value": "df6176b014d63d7898669e7674db409283463cf8ee0889acfecdd7b1e7ffa8ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446074, "uuid": "2834d211-64d3-4635-a158-973d571b1b61", "comment": "Malware payload (Mirai)", "value": "0ee48fc05e3f26561764c9de127a4631ee978e81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693446074, "uuid": "d09daf3b-0958-450d-8d36-11654d8b1b8c", "comment": "Malware payload (Mirai)", "value": "8b7bf3c629b6a750c979b85e27c604bdeed1fc84cec70aaee1d543d244c4fb00bdefefb40f87158b6415d4019752ab4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446074, "uuid": "b87f8794-33b4-4eae-890a-c62ccdb8acb9", "value": "T12C330A9AB8029D3CF90FE6BE54164E0DB93177C152830B2767BBFD936C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446074, "uuid": "a90c541e-6733-46a4-8c2d-49e6d16c1f4d", "value": "768:oBCP9hTzoEWRcqOCLuYUc6xe+Tm806Msq3zkHQXOZrupiQGT:TX5qCYWxeqm806M9kHQX0ruiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693446074, "uuid": "8661f3ae-58c3-4612-863c-425832c380bc", "value": 54928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693446074, "uuid": "f56f9b7d-0a46-48da-89f0-aaa6bb27e423", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693446074, "uuid": "c49724ec-63ff-42ec-889c-9fe89b579e34", "value": "fad8a71075e93d1535f1db9fb9651344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c42dfc7-484b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693519819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693519819, "uuid": "ccebf003-7dd7-4f94-9b67-77b6c238d8fe", "comment": "Malware payload", "value": "bde9513eb616939033b2b642189c5870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693519819, "uuid": "25a09b26-ad6a-41d8-ad61-afb17f8046d4", "comment": "Malware payload", "value": "e1b966305ebae686d323721f58e845ce4a4532e9ad8daacfa67f723b3986bf6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693519819, "uuid": "d2afaf13-bfc9-4705-b3b2-57feafae92a8", "comment": "Malware payload", "value": "c2efe843df7108b22e16352c0fa07b50bae4f1c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693519819, "uuid": "9fda2072-cf1c-4c23-a4a6-8222d0b2dfbe", "comment": "Malware payload", "value": "405bfb3f1fc4b8d4968baca25a22678ab8842421742870afd64dfc0ad5031354ea400543130942a667d65cadcea09981", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693519819, "uuid": "bf34d397-4c05-4de1-9206-3f386ba944c9", "value": "T1C52633B7C1E02D93E5320BF6AD07C1015CB6FA339E410662E67F9A8481B156DDFF6298", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693519819, "uuid": "206b47e8-9554-4de3-b4f6-4f2636ec4dac", "value": "aea59d34903869a7890830da3d90b4f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693519819, "uuid": "3addd631-2088-44fc-8159-c5959d65819a", "value": "98304:u0hdjrfXqL1GoAhrqXd03u8g2EsfGfERiyU+RIGlP:uIdjr4GNZkCbg2dCEMynOyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693519819, "uuid": "91b89fbd-66cd-406c-bf2a-2aba97e9cc44", "value": 4552216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693519819, "uuid": "427ccdc5-fe2b-411d-a8fe-1407f4db890d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693519819, "uuid": "4053ac07-4ff1-43e4-b34d-8cdbd28db7bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d598a3-4824-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693503132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693503132, "uuid": "3fb3f518-48a6-483a-9845-5430654c5c19", "comment": "Malware payload", "value": "3be49543b6b2f608de1d9b0e86afd6b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693503132, "uuid": "b85156bc-0fe6-45d9-b421-fc1fcdb87e4f", "comment": "Malware payload", "value": "e2e5f146d1fc60ebc0aed0397ee0fc10d31677d167205bca6727fde46c5746f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693503132, "uuid": "69527c26-f958-4aa2-a4a3-9c198f09f8be", "comment": "Malware payload", "value": "966b6082fc71c548418087eb652ef048ec44fbaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693503132, "uuid": "61278dee-e3d3-4541-b274-595a4ff215cb", "comment": "Malware payload", "value": "cb187a871f6f90ac9c85ce92f6e5d5502cdbbb5f54eb72f8a6c522dcf55f33b67c729152e8055716f668120a9d408cde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693503132, "uuid": "c34a8c86-2753-452a-aa7a-8443e4385e2d", "value": "T1ACC4F135835BAF6BD2BD473DA412590853E5C009F332E623FFAB50C67D21BC88672A95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693503132, "uuid": "4087dffa-940d-4671-901f-2e66270ed8e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693503132, "uuid": "91e4f028-107e-4ba1-832b-f2e4762dc261", "value": "12288:rrRGH3Cpbhpfhd23FoF0AuCkaebEFhRCtP/1ns8HEUKi4ceLo5Zpe5m2L:rrRGH3Cptpfhd4KF03C1wyOtP7H7KinI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693503132, "uuid": "16f24f18-55a3-404b-9c65-7c48da1f02d1", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693503132, "uuid": "48a79c93-cb19-410e-9268-3157b417d0e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693503132, "uuid": "3aa1d167-634c-4398-9ebe-6c7b8ddd7c12", "value": "SecuriteInfo.com.MSIL.Kryptik.BGX.tr.18275.1094", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388c8936-481c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693499654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499654, "uuid": "e23574be-c712-42ac-9814-f46564cc31cc", "comment": "Malware payload", "value": "134a4f0351d989e8f459cf34d40b32a9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499654, "uuid": "e1d7960c-6aa5-4dc2-961f-0516ea3677c4", "comment": "Malware payload", "value": "e455b703abb657b3c1198a2b6518fb591dec745199b5ef927d53c07acee2f2c8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499654, "uuid": "4836988f-8e78-454c-bf38-bee15010323d", "comment": "Malware payload", "value": "133fc0d146ad103bc50e810576fd75dfc61adf9d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693499654, "uuid": "36d6aa55-c61c-4d6e-aae2-4f93bcbc9a0a", "comment": "Malware payload", "value": "a47d68da4f9f9e1aa3a7372c936b5ff0879149599450b88575abd1e5c723cac5547e490e159fdc2eb7d8d209764cdb7d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499654, "uuid": "a47126d9-da4c-4f87-a6dd-0a212c54ec4e", "value": "T1C2252351BEE52F2BC318E03C20576945128ABE9C5B79E1FB1BE279BE213CF360517189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499654, "uuid": "708379d5-0213-4da4-aab9-194a2d92a2e6", "value": "24576:ExH/gkSemm795kZ/BTV2Ybzo+3vA9K+qtJQcOy:Kd1+nhPYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693499654, "uuid": "ef1532d9-77a8-4527-8d44-fb320baa2592", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693499654, "uuid": "3575ab4f-4f55-4419-9650-0258a06894f6", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693499654, "uuid": "8946ac2e-8aae-4ce6-80a0-f953dd709a25", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.9979.9352", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24d00b2-4834-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693510219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693510219, "uuid": "a236a6a9-c9c5-46c6-883f-4985184e026c", "comment": "Malware payload (njrat)", "value": "0dc689f7349bdb4df33cb582154b13a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693510219, "uuid": "de63924f-ba3a-4487-a53f-1789d11d3621", "comment": "Malware payload (njrat)", "value": "e897a30c719b8fdd9972b29fed87fb410f02e83e1b937d984a94ff491dd2fc80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693510219, "uuid": "9b8f1a85-1e87-47c5-9fac-7bf2ef359cdb", "comment": "Malware payload (njrat)", "value": "307ffcd9039444a2ef35ad37c70acb2de777e98e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693510219, "uuid": "8c61d769-746d-4b63-b480-94b5a846853d", "comment": "Malware payload (njrat)", "value": "0a23dfda839fab425ea0ef20ff6670b449b8b77a1b55004c8749d64daeccfdf3d42dc3969d1a55d991c1a13a7dc34c08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693510219, "uuid": "bbe2cebc-84f2-421f-bf90-3748ec6d810c", "value": "T1BA032A4D7FE18168C5FD157B05B2D41207BBE04B6E23D90E8EE564AA37636C18B90EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693510219, "uuid": "e0830e5a-95c8-4249-bb8f-9b91f31150ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693510219, "uuid": "c7b27a04-c5b7-45a2-ab8b-9450b3b95d95", "value": "384:F6/gUiDrblmJEpRGyEfdDPTuWCYqAlyrAF+rMRTyN/0L+EcoinblneHQM3epzXBu:c/yHpR9EfdDCWClA0rM+rMRa8Nun6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693510219, "uuid": "e12da299-f135-4397-b110-9aed18006f13", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693510219, "uuid": "9c4b6024-c677-4201-8efb-ad8f7eec52cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693510219, "uuid": "dbe16256-2f4b-4c9e-b2e1-81adc115f26e", "value": "0dc689f7349bdb4df33cb582154b13a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120e8ff0-47c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693460505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460505, "uuid": "b9f6de07-bad6-4829-aeb3-10828d64539e", "comment": "Malware payload (AgentTesla)", "value": "21cd38786ccaee7305123707ced27f43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460505, "uuid": "95627e5f-86ca-4d06-a452-821c9824769a", "comment": "Malware payload (AgentTesla)", "value": "e8c89752942b8011820e9d04753700eb70f77a8701796ef7e826399cf889f9ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460505, "uuid": "d1a6e85f-54f9-4243-909e-411b58439d48", "comment": "Malware payload (AgentTesla)", "value": "f594e2f6ec6f8a93542bacfb244c36705086af1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460505, "uuid": "f19699a4-11a4-4d80-911b-dc9850adea62", "comment": "Malware payload (AgentTesla)", "value": "f35112f5c9bf1c2cf4551961257b7bc2b97b5956af5049879ff71d41de195ff0f02c3a6f35101b5b0442613019749dfc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460505, "uuid": "36c5daad-7f17-4b3e-89c6-d468c883e00f", "value": "T15CC4126174F86B09F5FD17F500E3026507F1181E10BEEB8CAED670CDA6B6F04A948AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460505, "uuid": "fff59984-a568-4615-933d-83d6cc2d6905", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460505, "uuid": "16d4c09d-a9e3-4a7c-a77b-0dbfff64feae", "value": "12288:eULPObnA36hOdWkXyoceEfP0bTqLpiXUhYOapXcl6kpd2rH:3LP+DOXyoQ0bTqLbhNjpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460505, "uuid": "ae10b6e9-333d-43c0-b170-44c70c340686", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460505, "uuid": "d542e548-a343-40f4-9e7b-43094c7be805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460505, "uuid": "7e06ed1c-99f4-4a4a-b72d-4f371a23a909", "value": "E-DEKONT_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8bd314-47c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693463019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463019, "uuid": "66ebbb79-8e97-44d3-b671-da8671c14395", "comment": "Malware payload", "value": "b19e3c2a84adc5cb0e8246430cd289fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463019, "uuid": "9e52cec9-1c2c-414b-a24f-60d7d743b93f", "comment": "Malware payload", "value": "ea478d9b06c3b33b009e7ea36e5d437837833944993aa4e71d794376bf12d5fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463019, "uuid": "94f5a66d-9804-48cf-9825-fbaf2015c5f7", "comment": "Malware payload", "value": "b0736c9c4dc2d1013f3794a604efa965b1cd0cb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463019, "uuid": "0fd16922-7a86-4967-b407-0c4b5ad6685c", "comment": "Malware payload", "value": "28e464ccae3e59856a742c213c09057f1e9e7af203c40aa1c0aee694acac95963f12f36a02cfcd79a1ec936e684c374b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463019, "uuid": "8380fdf3-f0ff-48d4-a430-694a16691d6f", "value": "T124D52322BAC48436DD7A1A711FE44B317B397C712B358BD7A7446E0AAF31291AE34353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463019, "uuid": "d25cfe0a-3e39-43ee-8c0d-dbcaec74c495", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463019, "uuid": "522351a7-1b82-4d06-885f-a18bcbbcf887", "value": "49152:mDkUrjrxRvdRVQioFIG5Ethdc2tg9eLJshFttFRMHWJDyxgTF1:m4UT4FRuUss/t1iQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693463019, "uuid": "682bb23f-1c10-4a5c-8341-35ca8471a454", "value": 2845757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693463019, "uuid": "c55d4f40-af57-4c2b-a5cb-92bf0df0e8eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463019, "uuid": "688fba0a-d5c8-4ab1-b37b-3b17d24da7cc", "value": "b19e3c2a84adc5cb0e8246430cd289fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4dbc8fa-47fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693486950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693486950, "uuid": "85fcac4e-573f-4fb8-8618-ec9135385e22", "comment": "Malware payload (AgentTesla)", "value": "71dc2ce12aee1cbcd299fcc20901a95c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693486950, "uuid": "d69d4116-09ac-4402-8cd5-97dd741ba4d5", "comment": "Malware payload (AgentTesla)", "value": "eb617190b27e7449ed078297a96bf5b8b11e02e0f3bf1fa2bc947cac60e8590c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693486950, "uuid": "96fc1e1b-363f-4127-a787-d84d24378275", "comment": "Malware payload (AgentTesla)", "value": "cb3d4ebe25321e370a81449eab26debb946e73a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693486950, "uuid": "dbc4fae8-db3d-439f-a72e-a0d5e7213116", "comment": "Malware payload (AgentTesla)", "value": "85615a7548e0ca4f296d662eeae56c5e32c676eb2d24639002f33843e0a094acdf8e3eb0f62d4294816249a36d8dcb07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693486950, "uuid": "4adfd67c-312c-4e13-9caf-21c1053cf68b", "value": "T146D41200B2B93F23E57483FA8555B21007F297126322E52C1EE472DBAE27F56987C75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693486950, "uuid": "bd6537d5-2a28-45c6-8e52-50abbaf0761c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693486950, "uuid": "babe4dbb-f4e6-4f24-a9be-c3f386daa833", "value": "12288:bzfOZ1Lmv7j07El6ihsgNXYbll01bfCCBSUgUZFBJkW+CUc:vWZ+f0Yl7hLNXClSRaCo2bDkDCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693486950, "uuid": "46fa5947-5247-426e-b63c-a051410e7e88", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693486950, "uuid": "f220ea4a-39ff-4f5d-b208-26cb68acd1c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693486950, "uuid": "8eddabdb-d9c1-48e4-9ec0-2f68d8ee37df", "value": "9692532161_INV_SZV_WJG_001_20230831_180610.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a64c314-47f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693482906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693482906, "uuid": "e192198b-33fb-4398-940b-d465e94608ed", "comment": "Malware payload (AgentTesla)", "value": "801f1580112977b562bf873d5f68c23b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693482906, "uuid": "e3dce4bf-b0a7-406c-8c35-0e2b3b05f6e5", "comment": "Malware payload (AgentTesla)", "value": "ee0cac0d318f5f50ed54e662794819ed731abee9203a3f8e1445add029ef37bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693482906, "uuid": "0c74d73a-fa9b-4904-a3d6-0de1115bfb7f", "comment": "Malware payload (AgentTesla)", "value": "a39d81cd1047a15d84d5ae1eb2bece0599111cae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693482906, "uuid": "bdf7ba84-def3-4976-977f-d2abba720823", "comment": "Malware payload (AgentTesla)", "value": "8d875dfcafc9e4f480a8854674b4dd07c68ce1bb2ecb48811d1505bbd65216fbdba9b2f674843513628db43488ed92f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693482906, "uuid": "6275a9bd-98f1-45e6-ba1f-3ac2f9e133b3", "value": "T11581A4B22B0D2437D546C4F3D5543EBA2662F26AC7CF6B1013AEF9F20C3B51A5DA5904", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693482906, "uuid": "793bf8ad-9d53-46a1-886b-e3e6ed17baef", "value": "96:A7EhU8ErIbSXQEoZ/yUsXaMrO8TDHkiZnVF0nQ:qEAIeXQ1yUYTDzZn3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693482906, "uuid": "083d9895-d0be-4068-b3a1-9215c22028aa", "value": 4085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693482906, "uuid": "6838fdca-a191-4c05-91ec-1e3e9771a3c4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693482906, "uuid": "79206f25-7838-4ce2-9d19-e1aed567de73", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.13068.26089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0814b2d-47ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693466354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466354, "uuid": "2de98067-3834-4e5d-87da-fca2dcdfdf9d", "comment": "Malware payload", "value": "2a9b45e48cb9f128449873dc18aa190d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466354, "uuid": "6b5c2e3f-9b5b-4cb6-b609-f281c1b01b7b", "comment": "Malware payload", "value": "ee180791e63d1ca4c51cb3e377c2b829f5332cbeb61a087f571582b97054a423", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466354, "uuid": "584d78ab-e034-427d-9a1b-caf105ed0c1f", "comment": "Malware payload", "value": "59b903a29a0270d6dada8fa7d9b1024728aa4f0b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693466354, "uuid": "3a32f90e-99f2-4032-b4ef-32d1e4d97ed2", "comment": "Malware payload", "value": "529d368c9c3d084609449212f8e47fee37c64ae01a2539bedaa276d257b31ce745f6942540b798276cc5d5d389aefb03", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466354, "uuid": "e5045449-0a86-49f0-9d1a-9389f8164056", "value": "T1A0363323811C7A3FE8F6174487757A4295A8790CA0B485A7FF93E3E932BCDD84B19631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466354, "uuid": "92dac92b-2dbc-4a2e-8b99-4527f8b38952", "value": "98304:avylihz8olgFzu1t2tk5mPpqH22OymoL+c9tH0qmXfUXmxMXs47xBms73UWBSlHH:aQih50yt2ysp222OdontHUczsw/Lpgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693466354, "uuid": "506bbb95-7461-4662-8be5-588ca1a90c0d", "value": 5210600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693466354, "uuid": "80f82973-0bd6-4217-99f3-1c27f378a6e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693466354, "uuid": "ee656b31-335c-4921-8c5d-9fe038d4ecd3", "value": "2a9b45e48cb9f128449873dc18aa190d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbf99ed-47c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1693463017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463017, "uuid": "8b6ba34b-0529-4cee-a552-e298852b858e", "comment": "Malware payload (DarkTortilla)", "value": "19738b8471a13d3197a94dddc3d609ce", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463017, "uuid": "2bb93e3c-9efa-4998-a2fd-5e7eda434a42", "comment": "Malware payload (DarkTortilla)", "value": "eed35820ffacfd922412343f51ac4ea22ea10e1391251b785f06af09d614b812", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463017, "uuid": "54bb58cf-c604-4de5-a2d7-6ee34ea6bbb2", "comment": "Malware payload (DarkTortilla)", "value": "b45d4af3c6294b275c345e236ac8b498b173cc06", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463017, "uuid": "81992745-108e-4dad-bc1d-64031b13d06c", "comment": "Malware payload (DarkTortilla)", "value": "79614ba33d49b67e38c0ade928671a3795b24dbfbc9035f85e95ae7cf254b8cbacd595dc8fd58fde8cd206885a003928", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463017, "uuid": "32cc3f72-7c3a-495a-ada5-44c5e2020267", "value": "T1D965E04EFC022F55C331D87B0A8E9A203CAA12BF5F529F1772656987DF805C6B03566B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463017, "uuid": "5d1e1a2c-3b1d-4f4d-a8ea-1e22cdf98041", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463017, "uuid": "8d5a21b0-75b4-40a9-82ac-ecd3cb8ccb21", "value": "24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693463017, "uuid": "fc52b66a-0ee7-4107-8282-ac2415e1999b", "value": 1452780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693463017, "uuid": "4446af53-3173-4e8c-a998-7779f37ecf62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463017, "uuid": "16efde02-e635-41e7-9f4f-7e5505d03cf3", "value": "19738b8471a13d3197a94dddc3d609ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16846adf-47c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693460512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460512, "uuid": "3c32d534-9676-4203-b5dc-6ecf5bf8bad5", "comment": "Malware payload (Formbook)", "value": "be9b92964a18f7150f94b4fecaf9dacf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460512, "uuid": "9424c29f-7de4-4595-95be-0abd1a59e4e2", "comment": "Malware payload (Formbook)", "value": "eed7a348e95b5acd69c7cb10f4e4e44083ec2cd76c148dcd7fc604a625a52e6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460512, "uuid": "da6410ab-53ca-46e3-be75-54f67ba2dd9e", "comment": "Malware payload (Formbook)", "value": "7c4e924bab281d9d4e99d80d776d8a08ccf9da29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693460512, "uuid": "0f2073b8-0c69-49ad-bc89-7a56275d65a1", "comment": "Malware payload (Formbook)", "value": "fb945d6e74b00e420626ab516b80807bfdc37d81e9858980bb3ecfad86880b5d51d15eb4dec5d28c362d585c3310e1f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460512, "uuid": "6fa14297-c993-4c6e-876f-e2645b20ba59", "value": "T15B64231099E4C1AFD4BB4A3014B94375EFBE953B0DA6455F2B3149A8BD13283992FB33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460512, "uuid": "15b94833-8f74-4431-a38f-5d5f34686ed8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460512, "uuid": "6302502d-f8ef-4d94-b9a2-133b4860257b", "value": "6144:PYa63wXMfJzOh2qmLb06HjEI34ucUuW8CYBgKw5/wKgr5c1HD7I:PYNwXMhzOh8Lb0Sf34uTufCYBBfVc1jU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693460512, "uuid": "dc010d49-cf09-491f-bb86-99f23b91549d", "value": 322249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693460512, "uuid": "6672ce1a-6653-4443-93d2-1bb1b3d0284c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693460512, "uuid": "2909eb36-28a8-4cf0-b225-733b4831cf23", "value": "\u00d6deme Listesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5be25b-4837-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693511360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511360, "uuid": "fd349c36-403d-49ee-b2bf-c6bedbbf869d", "comment": "Malware payload (njrat)", "value": "735e2ebea2304cd996ade02f9f62383a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511360, "uuid": "6301391a-4353-4e39-a35c-29fe13f6de8f", "comment": "Malware payload (njrat)", "value": "f44098e7eaec4cd14d896779d38b61cbeb6ee2b276eb2f9fcea26c32ad732ec8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511360, "uuid": "0d96261f-345d-4ef1-a058-8ff626231d1c", "comment": "Malware payload (njrat)", "value": "6bab8de8dea9c950b9028e02f362a4306d363cab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693511360, "uuid": "ec3c436c-df06-49c0-86ac-2f72356cc019", "comment": "Malware payload (njrat)", "value": "0297ce91b02dcf05705fee18186a073837eefff78fdb1c882a20a8198e4ee30768dc09c29e90dfc37d6ec16f5d9e59ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693511360, "uuid": "c5a9927d-de87-4cd2-b482-bd862c0d50c4", "value": "T1BA733A4877F54A12D1BF0EB5897292220B35FC076926F76D09D174AA5FB36C08A09FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693511360, "uuid": "df41d182-6937-4b48-b47b-bd7c5ad9b5aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693511360, "uuid": "61249b39-5bee-4109-bc8c-2312ab3d4d20", "value": "1536:Uti+6Y9yhU1uDppS5wpOk3JCK6pFoRXd6fOpd/9nEh9TGWJcR:rhU1AQwpOk5CK6DO/9ESWJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693511360, "uuid": "dbf10f62-d55c-4c31-8477-468c116c760d", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693511360, "uuid": "1751b2c7-9460-4529-aeb6-8b1fa844d258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693511360, "uuid": "7b67e3e2-6c13-470c-92d5-8a5902e9bc44", "value": "x8R6DMflpsiZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975fc12d-4845-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693517422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517422, "uuid": "a20459e8-fbd7-4a0c-86ab-95a008f3f07d", "comment": "Malware payload (Amadey)", "value": "c8f10cd2ff37f8779cc9a94428a6f9ad", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517422, "uuid": "61275122-a3d7-4dce-826f-1dd6611d0f72", "comment": "Malware payload (Amadey)", "value": "f4c9efddd1dd4b3714e4de8389c8565a9876a901df35fbbae9a35701d660ff9c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517422, "uuid": "4520d765-8cac-46ef-a233-0403e1d65145", "comment": "Malware payload (Amadey)", "value": "d8b384fd4c7ae8ccfe5712df21c99841d6ba948d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693517422, "uuid": "d1916e62-aa34-4e65-b135-ff7485bb4be5", "comment": "Malware payload (Amadey)", "value": "821ac1a34d8957445f3934fd48ad06cdaf7132cbb293ca6797104077407f64455c3977a1e297d29ce47238211219dadf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517422, "uuid": "2e003799-8d58-411d-8b4d-a82185eee44e", "value": "T1AE252312ABD49171DCB217705DFA13D32B33BDB16EB8429322468D670AF3AD09572727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517422, "uuid": "39d40559-a80b-4b91-a7ad-cb68a7e6a999", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517422, "uuid": "538f493c-bf99-4459-a3fa-b1065eaabfb6", "value": "24576:ZyU2Tb+RWga7hYQlz+aTbfWkI/Kk1fFH:MHTbvgWOQJTbfDI/Kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693517422, "uuid": "f9311402-3bd1-4adc-8c95-a5caa2b8bcec", "value": 1041408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693517422, "uuid": "40b78815-48c9-4928-b7c1-23dfccd1aa50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693517422, "uuid": "f5e80395-22ba-420f-93c5-a38353f7a8a9", "value": "c8f10cd2ff37f8779cc9a94428a6f9ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16651269-47ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693479410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693479410, "uuid": "cd71ad1a-4a8f-4b0a-8aa7-3c3a5933bd31", "comment": "Malware payload (AgentTesla)", "value": "7e568041ae9fd32a610c782896df334e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693479410, "uuid": "2c6b36cb-fa28-4cbf-b0d6-81c9edf14b6f", "comment": "Malware payload (AgentTesla)", "value": "f57b3cc8c8112b9d6d0d7091f3a0ad9e2fbaae12324aa3c70abc6238dc75f770", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693479410, "uuid": "91a6bf54-5b8f-4d78-ae37-67be64fc27ad", "comment": "Malware payload (AgentTesla)", "value": "8eafac350a1115e15a0a0c6ba9def27f935a6792", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693479410, "uuid": "5d3c1270-225d-4fff-b987-e63e130d712b", "comment": "Malware payload (AgentTesla)", "value": "689fc32d2c6a269a689446b0c1130e0516e4d5b413dcdbdb541294c23cdc1a9a70f2c612fe5badcca59a13af7c1bdfd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693479410, "uuid": "334d02ff-70ff-4fc9-bb3b-4079dd2b35ea", "value": "T182459225D020B3F6FA8217B83467E74002405FFDBE9C60AE6EA77D0954B33912ABD5D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693479410, "uuid": "40bace96-ad55-40e6-a646-960dfb705fdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693479410, "uuid": "134498c8-feb2-4da7-8e7f-be960894feb1", "value": "24576:uZIkfrIkfH6J2FBX2CmruLKREx/88bCbjU8bl:+boKPK1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693479410, "uuid": "c1bf543a-1541-44dd-a2e0-d67598685d05", "value": 1253376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693479410, "uuid": "6d7ae618-f399-44dc-9470-2a56fd34fbe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693479410, "uuid": "18909e1b-821d-4c11-9097-4e5341d3f0fb", "value": "\u6674\u7f8e\u65b0\u8ba2\u5355OP53532.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b50fdac-47fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693485619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485619, "uuid": "a5a3cf91-59fe-4f25-9ba8-e05de43d860e", "comment": "Malware payload (RedLineStealer)", "value": "bf1807ec443b76a12ad675f7cb6bf23a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485619, "uuid": "86fdeefe-9ef8-42d3-afc2-2276d53c4815", "comment": "Malware payload (RedLineStealer)", "value": "f6fd042b83f85be44113bf9ed832bee5e7de2270b19704947a4da30f078998cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485619, "uuid": "5cf12115-05d2-444d-8057-7c3f06d9bed8", "comment": "Malware payload (RedLineStealer)", "value": "d6eeec1c8cc1ac59d65c778cd66ea4084d633401", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485619, "uuid": "6ffe733f-ea4c-48b8-a3d4-017fc0c7b906", "comment": "Malware payload (RedLineStealer)", "value": "95b25e9dbf9f618c0828b7f0c772d97900698d01e16f38d0e905800f11fe15cd05829275d8888998db5f2d8985100f22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485619, "uuid": "23f9c3b8-1f35-434e-be5e-f6b2d699dfc7", "value": "T1E4442A923E60E003DAD12971D9E187AD111BB6E74EEA0BCF039DC7552EF78F45A26807", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485619, "uuid": "2d981e8b-91fd-4361-9075-8700598b22de", "value": "79949fb04969b0ad00a160f76c9427ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485619, "uuid": "4cbbf411-cfeb-4fe7-ad03-e17ee2ee005d", "value": "3072:zxWXLSyBIbiyAeqwcBbGgabMMy1AxH/HLf/Ji49WCoMY5Z+:zxWzbhdBbGgabvy1AeemZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693485619, "uuid": "a4bea9c6-a917-48fb-b9ee-722bdb26ec16", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693485619, "uuid": "7d03afbd-9187-4db3-b057-9fa7ed012989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485619, "uuid": "f27b5fa6-97a6-4b4c-b48b-9f68929fdeb2", "value": "bf1807ec443b76a12ad675f7cb6bf23a.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4624271a-4839-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693512132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693512132, "uuid": "22600db8-86fe-4075-9de0-3a276d9902ea", "comment": "Malware payload (RedLineStealer)", "value": "02fdf6b83c0c0c4b60010d33907c987f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693512132, "uuid": "f1097b02-56c5-4de4-bdce-870d197c56a0", "comment": "Malware payload (RedLineStealer)", "value": "f751f33272d7f6b9c0643a6581250febcf8910a4eb5acf80e56cfb3d1145af17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693512132, "uuid": "7a1b40e3-e71d-4453-81ef-8f239975ae6c", "comment": "Malware payload (RedLineStealer)", "value": "06451e3540046f14be5e73cdd198ea69d0e26cbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693512132, "uuid": "8206c4a7-b4bc-42c9-8eb2-8e820ceb3427", "comment": "Malware payload (RedLineStealer)", "value": "445187467b6f1078f639923e0cd4f3f64a93ccddf0fd9da2630fe2faecb96a62e20fca086f10630b5207520409db2f57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693512132, "uuid": "d30d7237-f740-4a0a-b278-69e1916f052a", "value": "T115840220FBE2D03BD45607B016B0CF913FBBBD6025B5A99B8718193F1DB06C0A969797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693512132, "uuid": "4e013640-8cc8-450b-8eb6-4ca7a3f92846", "value": "ec0247b44470961b20f0db210d28af81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693512132, "uuid": "07fc8bc3-ba70-4e11-9f91-7a73824d8294", "value": "6144:+7zReNksouAXRTJffzwMQW0R74pn7eaUeZabqoqLBFpi5u87QMr19:+5Ykso/XRFjVQtmleaUeEOb7p88Mr19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693512132, "uuid": "017ec3ea-40d4-47ad-a812-4a9174bb08a6", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693512132, "uuid": "3e11a2f0-ce09-45c5-8076-f3a77b97c791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693512132, "uuid": "48d6bf71-d84a-4135-8875-1548f406109d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66d3b94-4850-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693522306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693522306, "uuid": "df150373-c943-4d00-84af-dd157ed52740", "comment": "Malware payload", "value": "b24eb3d6f4b192da47e778b693b9d8d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693522306, "uuid": "887d35dd-4e4e-48b0-99af-9cb5e6415563", "comment": "Malware payload", "value": "f760709128505dad3c485825b3e72646cbf0702336e3f16e7cd609e1c88a8581", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693522306, "uuid": "8ae6b362-9efc-4e20-abe4-68e19b112809", "comment": "Malware payload", "value": "821401e6683f2038e2786cce49c423ea52c43e6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693522306, "uuid": "47cfec75-a16e-41a6-bf7e-75edc5943d51", "comment": "Malware payload", "value": "937b18121a8ec1f7d8c796f51e704644900a47e8bc7549622f81dead8c3a2f7e6389a76cbffd10a5360341b252c4467d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693522306, "uuid": "cb472b71-ce2b-4195-b97a-3ecc445e446f", "value": "T1C9052352BBC94523E4F5233099F602C31B347CA16D3412AB1761589E0CB3BE4AE72B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693522306, "uuid": "bb66445a-fe49-436d-8a91-d90778b73ee7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693522306, "uuid": "0e7c9c36-4543-4980-9c18-f5a4d57c4938", "value": "12288:IMrfy90wII/ZiX9pREwKEALkOO4ekPSllmzLTvfcd0dGXU5z67Eq8bCci18Ro0BU:HyqI/+9HEPED4eSzLTsdJ4jqLp8buSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693522306, "uuid": "3146eefa-1988-43a9-955d-52fd5e373938", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693522306, "uuid": "100b4fdb-127f-482c-9f1c-d95e581c158a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693522306, "uuid": "26956bfb-fa5c-48aa-abcc-ebea84647cc8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8ceb67-47fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693485863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485863, "uuid": "433b804b-803e-4dcf-9813-c119a92514c7", "comment": "Malware payload (AgentTesla)", "value": "4952568d9c4001507f1dddb00ecab840", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485863, "uuid": "66702e67-1266-47a6-a6aa-f1fa802867e7", "comment": "Malware payload (AgentTesla)", "value": "f9d4d72bd272a4c2d5a84f7ce2dbe3cf5d041de49a87560252ea1cd40ee5edab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485863, "uuid": "24e0086e-04dd-4b8c-b1f7-d33350c97030", "comment": "Malware payload (AgentTesla)", "value": "dc8a47073962efe91fb965db992c84d401da391b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693485863, "uuid": "37c2691d-49dc-403a-899d-1ee54abfd3da", "comment": "Malware payload (AgentTesla)", "value": "5588747fa9e4e4463a041258e82feaa3878fa565d1e4c38d800019377b4ee023bb90e198a2f900a84d50048d282f8c23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485863, "uuid": "25e65274-cace-4ce2-9583-240e269928ab", "value": "T1382523349D1B4EFD8929137891A63E5923649EC5CCB0EFCE53C0B3A61C8B7129927C79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485863, "uuid": "2656c2b9-cfbe-4cee-b254-70fff19059a2", "value": "24576:i7jIEkrDvmeLFsPXmK9IwHl1oCGG5SXCzi3Ij+kz:i7qU2KdHdt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693485863, "uuid": "0c7f5d61-eb81-4a6f-a049-23801a793ccf", "value": 965140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693485863, "uuid": "e72c900e-5f75-421c-be3a-e477a72a6732", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693485863, "uuid": "2db93d99-7b92-41c4-ba23-b297e9d12016", "value": "System Update Form.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225d37f5-47c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693463109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463109, "uuid": "2248ad66-77e6-44c4-a6a9-44367675f5f9", "comment": "Malware payload", "value": "879778693e38d80116f5862805a456ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463109, "uuid": "29223578-d625-4b5c-ba7e-948e2c33deae", "comment": "Malware payload", "value": "fa4674f783962f90ae5352387aa31f1c841a4a280197db427ce1ad5e7bdbf0e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463109, "uuid": "19c1ff0c-8ad6-43d5-9614-3ab4ff5c2ae1", "comment": "Malware payload", "value": "0cad3a0cf12bb0ae1e0a182487d1fb9c48c9bae4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463109, "uuid": "01818078-22d8-43e1-a1b2-6d2c8776f69d", "comment": "Malware payload", "value": "746e30e10d61ef9e63c6028e33e37ed20bf09548aee7e7404a3d2fbe123157f74597334f8346088ed144b861ac53b943", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463109, "uuid": "1b74e06e-095e-4598-809f-2c97e61a1d2e", "value": "T1B5A5CF0BBA4F8DE1D3467776C59F140C0BAADB853627D73F798E235528037BA9A09207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463109, "uuid": "07d9d1b3-95d4-4e97-8648-400c63b150a8", "value": "49152:ZZvrmWKGDNB7G87UOZ0rFiNkSoVm+/2By:ZZRNlUOyr1Su/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693463109, "uuid": "7f35d5f2-9778-4fef-9bd1-033c81c99f79", "value": 2120963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693463109, "uuid": "8c8f1fba-2e6a-429d-9260-7750f9cc4ec1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463109, "uuid": "be97ee0c-a1ab-42ee-bc53-9c3e9c522b7a", "value": "879778693e38d80116f5862805a456ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06016cee-47c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693463061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463061, "uuid": "606420da-9b4c-45ea-99b6-d266e0e9973a", "comment": "Malware payload", "value": "b28f6da8dc0283c0b1c8e808d51dd01b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463061, "uuid": "3e30b418-d15c-4a9c-9ec3-a78f60ca1ac1", "comment": "Malware payload", "value": "fa8cba48b12a40e6dd1c4e995dee238edd6e74bec1950366b8ccf6f46b263382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463061, "uuid": "d24184f9-00d0-45aa-bf1b-cd7d7ffcb468", "comment": "Malware payload", "value": "94eb05c86743833fe9f44f31ca50667cb53dec1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693463061, "uuid": "8e599ef5-eb6c-41db-aef6-7ddb4bf2eee0", "comment": "Malware payload", "value": "99a5b9ade3fd1493f8473b52774440b9b85e351fce7b49fbaaa27c147112f926811bbf64743ad91a94efa691fbf71a47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463061, "uuid": "ab1cf768-7b01-4ad9-bf45-1f4fba1e0b16", "value": "T1FE052217E7D59232ECB5137098F7279303317D62A97C96673B4291A80D726C4A4323BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463061, "uuid": "e858ca3d-6e65-45eb-9dbb-d708f4a2312d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463061, "uuid": "6e76e9c3-7c04-4f54-a6b9-5574dd8760fe", "value": "24576:OyDUWp+/UYaT9yDRun3P2FDGE4qWKwxnX:dHQUB9Won3eN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693463061, "uuid": "5b9a25a8-8ec5-42d8-886a-168da4e9086e", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693463061, "uuid": "014e0a34-fdc5-42df-a3d9-f48619970085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693463061, "uuid": "d4e21a90-74cb-4050-8296-ca147f525621", "value": "b28f6da8dc0283c0b1c8e808d51dd01b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4288e0-480b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693492578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492578, "uuid": "c1dd069b-7b8c-4cd2-a374-0a6bad7969a4", "comment": "Malware payload (AgentTesla)", "value": "f8cb5d6d15cc29e2fa8f5fa441440ab1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492578, "uuid": "bdfd6d41-8d6e-49fb-9f25-9aa6f73ee8d6", "comment": "Malware payload (AgentTesla)", "value": "faaa913f0d90b0848bb2ccb743fc3f14d93c21c0085b569dac67cbc14273624f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492578, "uuid": "489b4a77-0c83-4854-99f0-be3ac748ac9f", "comment": "Malware payload (AgentTesla)", "value": "4c4d0691d1921bddecaffc6a969e4c992a1b0022", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693492578, "uuid": "31e01343-6a56-49d6-9154-1779a88960e2", "comment": "Malware payload (AgentTesla)", "value": "967800e36ddbc3f49c3f5472cda33428b34c3b0950d0c59501a0835e0ba7c55cc4a99de9469e4327ec5e8f3015025952", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492578, "uuid": "8f8da3f6-8974-49ee-93b2-af50e9a6024c", "value": "T1FB05E001B254C712E964B7F7D021A7F407B6EE26E6F2D24B1D817CDA36B3B500B52A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492578, "uuid": "8de5986f-e381-4e65-aadd-376de4f3f482", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492578, "uuid": "85167114-6b63-41b1-8829-1459f46cf553", "value": "24576:NUOPypIzgWUgZxIo6aqApySa+m3mHl67BnrE:NUOPypIzDUex79rpyiErE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693492578, "uuid": "3a06e561-2797-4151-a159-201e2d587253", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693492578, "uuid": "46aa6bdf-a4ad-4e59-87db-74beec19374e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693492578, "uuid": "d1fb9378-abdc-440e-955e-6c8af6ac5c62", "value": "SecuriteInfo.com.W32.MSIL_Agent.FUB.gen.Eldorado.25418.27671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b022ee3-482b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693506073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693506073, "uuid": "4707291c-afd5-4504-a443-e8a65f2310f2", "comment": "Malware payload (Mirai)", "value": "6ab0beb02cdf1c5676f57dea3f22248e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693506073, "uuid": "7f9206b5-679d-4e64-866a-2a19fdb88ba5", "comment": "Malware payload (Mirai)", "value": "fad0c36864468f51aea71d78b9b91ee9c28960ff719e05c924f65ad35747f80d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693506073, "uuid": "1ec058bd-6420-441a-ae19-c1c5ef357b71", "comment": "Malware payload (Mirai)", "value": "d499b34b0bd9b92366335b73b1e42a8c6baa0529", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693506073, "uuid": "d15e85e6-a1f5-4d2e-82a0-5204668d1d4c", "comment": "Malware payload (Mirai)", "value": "f533e16a20b00e019db554273b663db6a38d8c93bb9191e23b7b11d230cc12a332d4958c05b8dd05873ec5488e407a6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693506073, "uuid": "5324205a-fe69-4927-bd67-6e3a23f550da", "value": "T162739409BF650FF7ECAFCD3749A92B45298D551B21A83B357934C818F25B24F09E38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693506073, "uuid": "24c58244-883e-47dd-a7ed-4c9f1834ca74", "value": "1536:2IAOJmU2GXDqw4BhLAUAWDAHjg0a2HNM/D8vU:2NOYU2GXDqw6aWDj/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693506073, "uuid": "37d8a2fd-3256-4279-8c28-57c1a5df8703", "value": 73488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693506073, "uuid": "7dab3285-850f-4946-a940-0484f943f27f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693506073, "uuid": "546b4c8e-1e95-4c5e-9ac9-24f98146e95a", "value": "6ab0beb02cdf1c5676f57dea3f22248e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b79ede-482d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693507032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693507032, "uuid": "b3ff1254-2894-4f66-8917-8a2aede6a65b", "comment": "Malware payload", "value": "d38a35de750d0d8628cb073a9a0ad8b2", "object_relation": "md5", "Tag": [ { "name": "4240553492", "colour": "#63DFF5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693507032, "uuid": "88933f7e-9dae-4233-8d9e-40d551e2fe56", "comment": "Malware payload", "value": "fd685d5811578ac189ffc6802615e11c86424765cc231a024e97c03c99f37947", "object_relation": "sha256", "Tag": [ { "name": "4240553492", "colour": "#63DFF5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693507032, "uuid": "4aaf2403-6970-4db1-88ec-5b17d2d4355f", "comment": "Malware payload", "value": "b98af1c8fe2a75060fa25a7eee20c32518271822", "object_relation": "sha1", "Tag": [ { "name": "4240553492", "colour": "#63DFF5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693507032, "uuid": "501d5ac3-fe0b-427c-b486-b556cac727e8", "comment": "Malware payload", "value": "e1f8292e9b0f97421019835901e7e93c975035c0ac2a2a799495395028bacd3bcf3ef4a7d18387cd10485eb8f3511b43", "object_relation": "sha3-384", "Tag": [ { "name": "4240553492", "colour": "#63DFF5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693507032, "uuid": "83683dae-6710-46e9-8c3a-15263fe420f4", "value": "T176F2DE2A776D2351461E16F3AE2E429CF301817C114B0AD8323CD79E7B2A51F4BA9EF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693507032, "uuid": "c1b8f23f-b205-4bef-9dc6-2506da56bb84", "value": "768:RwRahuDvIhINs1sCT7A797k7a7a7Q7u7F7r7e7I7B7C7D7N7y7o727B7of7y7M76:RwRahBhIN3CTMJ4W+cC5fS0VWnJWk6l5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693507032, "uuid": "df2478b5-ab7b-47e9-ad3b-be22b62c281f", "value": 35079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693507032, "uuid": "3f024ff8-b398-47fa-84cd-7a5732c3b9de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693507032, "uuid": "b30a4cca-cd93-42f0-8165-57794be6cef9", "value": "Document_Scan_482.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37100fb4-47ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693451118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693451118, "uuid": "c8c0cead-7d34-4d55-9b4c-483c423cd09d", "comment": "Malware payload (DCRat)", "value": "a27d25820c536552817bfac7fc0f569c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693451118, "uuid": "944c6566-0f38-419c-afd0-ec4e89113c2a", "comment": "Malware payload (DCRat)", "value": "fe0df1727c7c7306b14d113287e45ea8e5b4e4088d595e3da21ae8d0a21be490", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693451118, "uuid": "14b9014f-2d36-46cd-986d-8a9f6f77c308", "comment": "Malware payload (DCRat)", "value": "474a5223015c33a29d0c1f223e0ed5ef5ecd3a1c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693451118, "uuid": "9e61f063-d102-4996-8de5-41a9d47333e4", "comment": "Malware payload (DCRat)", "value": "9a63b039b3226148dae819f57eb8877d9209eda505a26b00149c5c6b970964e9be1d43c9946cdbbbdc8b31e340798382", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693451118, "uuid": "3c525b31-5967-47ba-b7c6-4b6f8e2ea040", "value": "T1E7E4238238EA53D0D91AC93796F05F9C58A0CD01FC4B27B243947E5EDA271E12F857AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693451118, "uuid": "6210690c-fa37-4941-8d74-f7cd876338ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693451118, "uuid": "27101cbe-0e3b-4d6d-b7d2-ff3f917a2f03", "value": "12288:kikJ/Wmo/SCs2TCpyyDRwQJmMhN6b2GmsCBnxD+t:kJ/yvClJmoNuNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693451118, "uuid": "c350e331-5ee0-4851-9b82-8502a736bcf0", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693451118, "uuid": "38d58f72-7522-4a93-88e3-fccf120f028e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693451118, "uuid": "5c86edcf-1ac9-4eac-9084-df7188d5e2f2", "value": "a27d25820c536552817bfac7fc0f569c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }